Mozilla Firefox before 26.0 and SeaMonkey before 2.23 on Linux allow user-assisted remote attackers to read clipboard data by leveraging certain middle-click paste operations.

Versions of Mozilla Firefox ESR prior to 24.2 are prone to the following vulnerabilities :

 - Miscellaneous memory safety hazards (CVE-2013-5609, CVE-2013-5610)
 - Application Installation doorhanger does not get properly dismissed, which can be leveraged to trick a user into installing an application from one site while thinking it originated from another (CVE-2013-5611)
 - Potential XSS vulnerability via cross-domain inheritance of charset (CVE-2013-5612)
 - Sandbox restrictions are not properly applied to nested object elements, which could be leveraged to bypass restrictions (CVE-2013-5614)
 - Use-after-free in event listeners, table editing user interface, synthetic mouse movement can lead to a potentially exploitable crash (CVE-2013-5616, CVE-2013-5613, CVE-2013-5618)
 - Binary search algorithms in the Javascript engine contain potential out-of-bounds array access, though these are not directly exploitable (CVE-2013-5619)
 - Segmentation violation when replacing ordered list elements in a document via script can lead to a potentially exploitable crash (CVE-2013-6671)
 - On Linux systems, clipboard content may be made accessible to web content when a user pastes a selection with a middle-click, which can lead to information disclosure (CVE-2013-6672)
 - Extended validation root certificates remain trusted even if the user has explicitly removes the trust. (CVE-2013-6673)
 - GetElementIC typed arrays can be generated outside observed typesets, with unknown security impact (CVE-2013-5615)
 - Issues in the JPEG image processing library can allow arbitrary memory to be read, as well as cross-domain theft (CVE-2013-6629, CVE-2013-6630)
 - An intermediary CA that is chained up to a root within Mozilla's root store was revoked for supplying an intermediate certificate that allowed a man-in-the-middle proxy to perform traffic management of domain names and IP addresses the certificate holder did not own or control.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

This update fixes the following security issues with SeaMonkey :

  - update to SeaMonkey 2.23 (bnc#854370))

  - requires NSPR 4.10.2 and NSS 3.15.3.1

  - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous     memory safety hazards

  - MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application     Installation doorhanger persists on navigation

  - MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character     encoding cross-origin XSS attack

  - MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox     restrictions not applied to nested object elements

  - MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free     in event listeners

  - MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free     during Table Editing

  - MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential     overflow in JavaScript binary search algorithms

  - MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation     violation when replacing ordered list elements

  - MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard     information disclosure though selection paste

  - MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings     for built-in roots ignored during EV certificate     validation

  - MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449)     Use-after-free in synthetic mouse movement

  - MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC     typed array stubs can be generated outside observed     typesets

  - MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693)     JPEG information leak

  - MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI     certificate (fixed via NSS 3.15.3.1)

  - rebased patches :

  - mozilla-nongnome-proxies.patch

  - mozilla-shared-nss-db.patch

- update to Firefox 26.0 (bnc#854367, bnc#854370)

  - rebased patches

  - requires NSPR 4.10.2 and NSS 3.15.3.1

  - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous     memory safety hazards

  - MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application     Installation doorhanger persists on navigation

  - MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character     encoding cross-origin XSS attack

  - MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox     restrictions not applied to nested object elements

  - MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free     in event listeners

  - MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free     during Table Editing

  - MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential     overflow in JavaScript binary search algorithms

  - MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation     violation when replacing ordered list elements

  - MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard     information disclosure though selection paste

  - MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings     for built-in roots ignored during EV certificate     validation

  - MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449)     Use-after-free in synthetic mouse movement

  - MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC     typed array stubs can be generated outside observed     typesets

  - MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693)     JPEG information leak

  - MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI     certificate (fixed via NSS 3.15.3.1)

  - removed gecko.js preference file as GStreamer is enabled     by default now

Mozilla Firefox has been updated to the 24.2.0 ESR security release.

This is a major upgrade from the 17 ESR release branch.

Security issues fixed :

  - Application Installation doorhanger persists on     navigation. (MFSA 2013-105). (CVE-2013-5611)

  - Miscellaneous memory safety hazards (rv:24.2). (MFSA     2013-104). (CVE-2013-5609)

  - Miscellaneous memory safety hazards (rv:26.0). (MFSA     2013-104). (CVE-2013-5610)

  - Character encoding cross-origin XSS attack. (MFSA     2013-106). (CVE-2013-5612)

  - Sandbox restrictions not applied to nested object     elements. (MFSA 2013-107). (CVE-2013-5614)

  - Use-after-free in event listeners. (MFSA 2013-108).
    (CVE-2013-5616)

  - Potential overflow in JavaScript binary search     algorithms. (MFSA 2013-110). (CVE-2013-5619)

  - Segmentation violation when replacing ordered list     elements. (MFSA 2013-111). (CVE-2013-6671)

  - Trust settings for built-in roots ignored during EV     certificate validation. (MFSA 2013-113). (CVE-2013-6673)

  - Use-after-free in synthetic mouse movement. (MFSA     2013-114). (CVE-2013-5613)

  - GetElementIC typed array stubs can be generated outside     observed typesets. (MFSA 2013-115). (CVE-2013-5615)

  - Linux clipboard information disclosure though selection     paste. (MFSA 2013-112). (CVE-2013-6672)

  - Use-after-free during Table Editing (MFSA 2013-109).
    (CVE-2013-5618)

New upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of SeaMonkey earlier than 2.23 are prone to the following vulnerabilities:

  - Miscellaneous memory safety hazards (CVE-2013-5609, CVE-2013-5610)

  - Potential XSS vulnerability via cross-domain inheritance of charset (CVE-2013-5612)

  - Sandbox restrictions are not properly applied to nested object elements, which could be leveraged to bypass restrictions (CVE-2013-5614)

  - Use-after-free in event listeners, table editing user interface, synthetic mouse movement can lead to a potentially exploitable crash (CVE-2013-5616, CVE-2013-5613, CVE-2013-5618)

  - Binary search algorithms in the Javascript engine are contain potential out-of-bounds array access, though these are not directly exploitable (CVE-2013-5619)

  - Segmentation violation when replacing ordered list elements in a document via script can lead to a potentially exploitable crash (CVE-2013-6671)

  - On Linux systems, clipboard content may be made accessible to web content when a user pastes a selection with a middle-click, which can lead to information disclosure (CVE-2013-6672)

  - Extended validation root certificates remain trusted even if the user has explicitly removes the trust. (CVE-2013-6673)

  - GetElementIC typed arrays can be generated outside observed typesets, with unknown security impact (CVE-2013-5615)

  - Issues in the JPEG image processing library can allow arbitrary memory to be read, as well as cross-domain theft (CVE-2013-6629, CVE-2013-6630)

  - An intermediary CA that is chained up to a root within Mozilla's root store was revoked for supplying an intermediate certificate that allowed a man-in-the-middle proxy to perform traffic management of domain names and IP addresses the certificate holder did not own or control.

Versions of Mozilla Firefox earlier than 26.0 are prone to the following vulnerabilities :

 - Miscellaneous memory safety hazards (CVE-2013-5609, CVE-2013-5610)
 - Application Installation doorhanger does not get properly dismissed, which can be leveraged to trick a user into installing an application from one site while thinking it originated from another (CVE-2013-5611)
 - Potential XSS vulnerability via cross-domain inheritance of charset (CVE-2013-5612)
 - Sandbox restrictions are not properly applied to nested object elements, which could be leveraged to bypass restrictions (CVE-2013-5614)
 - Use-after-free in event listeners, table editing user interface, synthetic mouse movement can lead to a potentially exploitable crash (CVE-2013-5616, CVE-2013-5613, CVE-2013-5618)
 - Binary search algorithms in the Javascript engine contain potential out-of-bounds array access, though these are not directly exploitable (CVE-2013-5619)
 - Segmentation violation when replacing ordered list elements in a document via script can lead to a potentially exploitable crash (CVE-2013-6671)
 - On Linux systems, clipboard content may be made accessible to web content when a user pastes a selection with a middle-click, which can lead to information disclosure (CVE-2013-6672)
 - Extended validation root certificates remain trusted even if the user has explicitly removes the trust. (CVE-2013-6673)
 - GetElementIC typed arrays can be generated outside observed typesets, with unknown security impact (CVE-2013-5615)
 - Issues in the JPEG image processing library can allow arbitrary memory to be read, as well as cross-domain theft (CVE-2013-6629, CVE-2013-6630)
 - An intermediary CA that is chained up to a root within Mozilla's root store was revoked for supplying an intermediate certificate that allowed a man-in-the-middle proxy to perform traffic management of domain names and IP addresses the certificate holder did not own or control.

The Mozilla Project reports :

MFSA 2013-116 JPEG information leak

MFSA 2013-105 Application Installation doorhanger persists on navigation

MFSA 2013-106 Character encoding cross-origin XSS attack

MFSA 2013-107 Sandbox restrictions not applied to nested object elements

MFSA 2013-108 Use-after-free in event listeners

MFSA 2013-109 Use-after-free during Table Editing

MFSA 2013-110 Potential overflow in JavaScript binary search algorithms

MFSA 2013-111 Segmentation violation when replacing ordered list elements

MFSA 2013-112 Linux clipboard information disclosure though selection paste

MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation

MFSA 2013-114 Use-after-free in synthetic mouse movement

MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets

MFSA 2013-116 JPEG information leak

MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate

Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler and Christoph Diehl discovered multiple memory safety issues in Firefox.
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5609, CVE-2013-5610)

Myk Melez discovered that the doorhanger notification for web app installation could persist between page navigations. An attacker could potentially exploit this to conduct clickjacking attacks.
(CVE-2013-5611)

Masato Kinugawa discovered that pages with missing character set encoding information can inherit character encodings across navigations from another domain. An attacker could potentially exploit this to conduct cross-site scripting attacks. (CVE-2013-5612)

Daniel Veditz discovered that a sandboxed iframe could use an object element to bypass its own restrictions. (CVE-2013-5614)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in event listeners. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5616)

A use-after-free was discovered in the table editing interface. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5618)

Dan Gohman discovered that binary search algorithms in Spidermonkey used arithmetic prone to overflow in several places. However, this is issue not believed to be exploitable. (CVE-2013-5619)

Tyson Smith and Jesse Schwartzentruber discovered a crash when inserting an ordered list in to a document using script. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-6671)

Vincent Lefevre discovered that web content could access clipboard data under certain circumstances, resulting in information disclosure.
(CVE-2013-6672)

Sijie Xia discovered that trust settings for built-in EV root certificates were ignored under certain circumstances, removing the ability for a user to manually untrust certificates from specific authorities. (CVE-2013-6673)

Tyson Smith, Jesse Schwartzentruber and Atte Kettunen discovered a use-after-free in functions for synthetic mouse movement handling. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5613)

Eric Faust discovered that GetElementIC typed array stubs can be generated outside observed typesets. An attacker could possibly exploit this to cause undefined behaviour with a potential security impact. (CVE-2013-5615)

Michal Zalewski discovered several issues with JPEG image handling. An attacker could potentially exploit these to obtain sensitive information. (CVE-2013-6629, CVE-2013-6630).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Firefox 26.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
701241	Mozilla Firefox ESR < 24.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75327	openSUSE Security Update : seamonkey (openSUSE-SU-2014:0008-1)	Nessus	SuSE Local Security Checks	critical
75241	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1918-1)	Nessus	SuSE Local Security Checks	critical
75240	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1917-1)	Nessus	SuSE Local Security Checks	critical
75239	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1916-1)	Nessus	SuSE Local Security Checks	critical
71560	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8657)	Nessus	SuSE Local Security Checks	critical
71559	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8657)	Nessus	SuSE Local Security Checks	critical
71505	Fedora 20 : firefox-26.0-3.fc20 / thunderbird-24.2.0-3.fc20 / xulrunner-26.0-2.fc20 (2013-23519)	Nessus	Fedora Local Security Checks	critical
8072	SeaMonkey < 2.23 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
8070	Mozilla Firefox < 26.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
71452	FreeBSD : mozilla -- multiple vulnerabilities (dd116b19-64b3-11e3-868f-0025905a4771)	Nessus	FreeBSD Local Security Checks	critical
71374	Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : firefox vulnerabilities (USN-2052-1)	Nessus	Ubuntu Local Security Checks	critical
71365	Fedora 19 : firefox-26.0-2.fc19 / xulrunner-26.0-1.fc19 (2013-23127)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2013-6672

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical