Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application.

Mozilla Firefox was updated to version 27. Mozilla SeaMonkey was updated to 2.24, fixing similar issues as Firefox 27. Mozilla Thunderbird was updated to 24.3.0, fixing similar issues as Firefox 27.

The Firefox 27 release brings TLS 1.2 support as a major security feature.

It also fixes following security issues :

  - MFSA 2014-01/CVE-2014-1477/CVE-2014-1478 Miscellaneous     memory safety hazards (rv:27.0 / rv:24.3)

  - MFSA 2014-02/CVE-2014-1479 (bmo#911864) Clone protected     content with XBL scopes

  - MFSA 2014-03/CVE-2014-1480 (bmo#916726) UI selection     timeout missing on download prompts

  - MFSA 2014-04/CVE-2014-1482 (bmo#943803) Incorrect use of     discarded images by RasterImage

  - MFSA 2014-05/CVE-2014-1483 (bmo#950427) Information     disclosure with *FromPoint on iframes

  - MFSA 2014-06/CVE-2014-1484 (bmo#953993) Profile path     leaks to Android system log

  - MFSA 2014-07/CVE-2014-1485 (bmo#910139) XSLT stylesheets     treated as styles in Content Security Policy

  - MFSA 2014-08/CVE-2014-1486 (bmo#942164) Use-after-free     with imgRequestProxy and image proccessing

  - MFSA 2014-09/CVE-2014-1487 (bmo#947592) Cross-origin     information leak through web workers

  - MFSA 2014-10/CVE-2014-1489 (bmo#959531) Firefox default     start page UI content invokable by script

  - MFSA 2014-11/CVE-2014-1488 (bmo#950604) Crash when using     web workers with asm.js

  - MFSA 2014-12/CVE-2014-1490/CVE-2014-1491 (bmo#934545,     bmo#930874, bmo#930857) NSS ticket handling issues

  - MFSA 2014-13/CVE-2014-1481(bmo#936056) Inconsistent     JavaScript handling of access to Window objects

Mozilla NSS was updated to 3.15.4 :

  - required for Firefox 27

  - regular CA root store update (1.96)

  - Reordered the cipher suites offered in SSL/TLS client     hello messages to match modern best practices.

  - Improved SSL/TLS false start. In addition to enabling     the SSL_ENABLE_FALSE_START option, an application must     now register a callback using the     SSL_SetCanFalseStartCallback function.

  - When false start is enabled, libssl will sometimes     return unencrypted, unauthenticated data from PR_Recv     (CVE-2013-1740, bmo#919877)

  - MFSA 2014-12/CVE-2014-1490/CVE-2014-1491 NSS ticket     handling issues New functionality

  - Implemented OCSP querying using the HTTP GET method,     which is the new default, and will fall back to the HTTP     POST method.

  - Implemented OCSP server functionality for testing     purposes (httpserv utility).

  - Support SHA-1 signatures with TLS 1.2 client     authentication.

  - Added the --empty-password command-line option to     certutil, to be used with -N: use an empty password when     creating a new database.

  - Added the -w command-line option to pp: don't wrap long     output lines.

This updates the Mozilla Firefox browser to the 24.3.0ESR security release. The Mozilla NSS libraries are now on version 3.15.4.

The following security issues have been fixed :

  - Memory safety bugs fixed in Firefox ESR 24.3 and Firefox     27.0 (CVE-2014-1477)(bnc#862345). (MFSA 2014-01)

  - Using XBL scopes its possible to steal(clone) native     anonymous content (CVE-2014-1479)(bnc#862348). (MFSA     2014-02)

  - Download 'open file' dialog delay is too quick, doesn't     prevent clickjacking. (CVE-2014-1480). (MFSA 2014-03)

  - Image decoding causing FireFox to crash with Goo Create     (CVE-2014-1482)(bnc#862356). (MFSA 2014-04)

  - caretPositionFromPoint and elementFromPoint leak     information about iframe contents via timing information     (CVE-2014-1483)(bnc#862360). (MFSA 2014-05)

  - Fennec leaks profile path to logcat. (CVE-2014-1484).
    (MFSA 2014-06)

  - CSP should block XSLT as script, not as style.
    (CVE-2014-1485). (MFSA 2014-07)

  - imgRequestProxy Use-After-Free Remote Code Execution     Vulnerability. (CVE-2014-1486). (MFSA 2014-08)

  - Cross-origin information disclosure with error message     of Web Workers. (CVE-2014-1487). (MFSA 2014-09)

  - settings &amp; history ID bug. (CVE-2014-1489). (MFSA     2014-10)

  - Firefox reproducibly crashes when using asm.js code in     workers and transferable objects. (CVE-2014-1488). (MFSA     2014-11)

  - TOCTOU, potential use-after-free in libssl's session     ticket processing (CVE-2014-1490)(bnc#862300) Do not     allow p-1 as a public DH value     (CVE-2014-1491)(bnc#862289). (MFSA 2014-12)

  - Inconsistent this value when invoking getters on window     (CVE-2014-1481)(bnc#862309). (MFSA 2014-13)

Older versions of Mozilla Firefox contain multiple unspecified vulnerabilities that have since been fixed by the vendor. Versions of Firefox for Android older than 27.0 contain the following two vulnerabilities:

  - Unauthorized information disclosure via profile path leaks to the Android system log, which is readable from other applications. (CVE-2014-1484)

  - Issues related to differences in how JavaScript engines deal with native getters on the 'window' object. This can lead to a potential security check bypass issue. (CVE-2014-1481)

The Mozilla Project reports :

MFSA 2014-01 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3)

MFSA 2014-02 Clone protected content with XBL scopes

MFSA 2014-03 UI selection timeout missing on download prompts

MFSA 2014-04 Incorrect use of discarded images by RasterImage

MFSA 2014-05 Information disclosure with *FromPoint on iframes

MFSA 2014-06 Profile path leaks to Android system log

MFSA 2014-07 XSLT stylesheets treated as styles in Content Security Policy

MFSA 2014-08 Use-after-free with imgRequestProxy and image proccessing

MFSA 2014-09 Cross-origin information leak through web workers

MFSA 2014-10 Firefox default start page UI content invokable by script

MFSA 2014-11 Crash when using web workers with asm.js

MFSA 2014-12 NSS ticket handling issues

MFSA 2014-13 Inconsistent JavaScript handling of access to Window objects

ID	Name	Product	Family	Severity
75253	openSUSE Security Update : firefox / seamonkey / thunderbird (openSUSE-SU-2014:0212-1)	Nessus	SuSE Local Security Checks	critical
72554	SuSE 11.3 Security Update : MozillaFirefox (SAT Patch Number 8879)	Nessus	SuSE Local Security Checks	critical
8101	Mozilla Firefox for Android < 27.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	low
72312	FreeBSD : mozilla -- multiple vulnerabilities (1753f0ff-8dd5-11e3-9b45-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2014-1484

medium

Tenable Plugins

critical

critical

low

critical