maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process.

Versions of Mozilla Firefox ESR prior to 24.5 are unpatched against the following vulnerabilities :

 - Use-after-free vulnerabilities in nsHostResolver, imgLoader, and Text Track Manager (for HTML video), which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531, CVE-2014-1525)
 - A potentially exploitable out-of-bounds write in Cairo, a potentially exploitable out-of-bounds read issue with Web Audio, and a non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1528, CVE-2014-1522, CVE-2014-1523)
 - Improper wildcard matching of domains in the Network Security Services (NSS library), which has since been fixed by updating to version 3.16 (CVE-2014-1492)
 - Potential privilege escalation via Xray Wrappers bypass, which can occur if a user used the debugger to interact with a malicious page (CVE-2014-1526)
 - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)
 - Privilege escalation via the Mozilla Maintenance Service Installer, which writes to a globally writeable temporary directory during the update process (Windows only) (CVE-2014-1520)
 - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)
 - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)
 - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

This Mozilla Firefox and Mozilla NSS update to 24.5.0esr fixes the following several security and non-security issues :

  - Miscellaneous memory safety hazards. (MFSA 2014-34 /     CVE-2014-1518)

  - Out of bounds read while decoding JPG images. (MFSA     2014-37 / CVE-2014-1523)

  - Buffer overflow when using non-XBL object as XBL. (MFSA     2014-38 / CVE-2014-1524)

  - Privilege escalation through Web Notification API. (MFSA     2014-42 / CVE-2014-1529)

  - Cross-site scripting (XSS) using history navigations.
    (MFSA 2014-43 / CVE-2014-1530)

  - Use-after-free in imgLoader while resizing images. (MFSA     2014-44 / CVE-2014-1531)

  - Use-after-free in nsHostResolver Mozilla NSS has been     updated to 3.16:. (MFSA 2014-46 / CVE-2014-1532)

  - required for Firefox 29

  - In a wildcard certificate, the wildcard character should     not be embedded within the U-label of an     internationalized domain name. See the last bullet point     in RFC 6125, Section 7.2. (CVE-2014-1492)

  - Update of root certificates.

Versions of Mozilla Firefox earlier than 29.0 are unpatched against the following vulnerabilities :

 - Use-after-free vulnerabilities in nsHostResolver, imgLoader, and Text Track Manager (for HTML video), which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531, CVE-2014-1525)
 - A potentially exploitable out-of-bounds write in Cairo, a potentially exploitable out-of-bounds read issue with Web Audio, and a non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1528, CVE-2014-1522, CVE-2014-1523)
 - Improper wildcard matching of domains in the Network Security Services (NSS library), which has since been fixed by updating to version 3.16 (CVE-2014-1492)
 - Potential privilege escalation via Xray Wrappers bypass, which can occur if a user used the debugger to interact with a malicious page (CVE-2014-1526)
 - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)
 - Privilege escalation via the Mozilla Maintenance Service Installer, which writes to a globally writeable temporary directory during the update process (Windows only) (CVE-2014-1520)
 - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)
 - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)
 - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

Update to latest upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Mozilla Project reports :

MFSA 2014-34 Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)

MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer

MFSA 2014-36 Web Audio memory corruption issues

MFSA 2014-37 Out of bounds read while decoding JPG images

MFSA 2014-38 Buffer overflow when using non-XBL object as XBL

MFSA 2014-39 Use-after-free in the Text Track Manager for HTML video

MFSA 2014-41 Out-of-bounds write in Cairo

MFSA 2014-42 Privilege escalation through Web Notification API

MFSA 2014-43 Cross-site scripting (XSS) using history navigations

MFSA 2014-44 Use-after-free in imgLoader while resizing images

MFSA 2014-45 Incorrect IDNA domain name matching for wildcard certificates

MFSA 2014-46 Use-after-free in nsHostResolve

MFSA 2014-47 Debugger can bypass XrayWrappers with JavaScript

The installed version of Firefox is a version prior to 29.0 and is, therefore, potentially affected by the following vulnerabilities :

  - An issue exists in the Network Security (NSS) library     due to improper handling of IDNA domain prefixes for     wildcard certificates. This issue could allow man-in-     the-middle attacks. (CVE-2014-1492)

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1518, CVE-2014-1519)

  - An issue exists related to the 'Mozilla Maintenance     Service' that could lead to privilege escalation due to     the creation of a writeable temporary directory during     the update process. (CVE-2014-1520)

  - An out-of-bounds read issue exists in the Web Audio     feature that could lead to information disclosure.
    (CVE-2014-1522)

  - An out-of-bounds read issue exists when decoding     certain JPG images that could lead to a denial of     service. (CVE-2014-1523)

  - A memory corruption issue exists due to improper     validation of XBL objects that could lead to arbitrary     code execution. (CVE-2014-1524)

  - A use-after-free memory issue exists in the Text Track     Manager during HTML video processing that could lead     to arbitrary code execution. (CVE-2014-1525)

  - An issue exists related to the debugger bypassing     XrayWrappers that could lead to privilege escalation.
    (CVE-2014-1526)

  - An out-of-bounds write issue exists in the Cairo     graphics library that could lead to arbitrary code     execution.	Note that this issue only affects Firefox     28 and SeaMonkey 2.25. (CVE-2014-1528)

  - A security bypass issue exists in the Web Notification     API that could lead to arbitrary code execution.
    (CVE-2014-1529)

  - A cross-site scripting issue exists that could allow an     attacker to load another website other than the URL for     the website that is shown in the address bar.
    (CVE-2014-1530)

  - A use-after-free issue exists due to an 'imgLoader'     object being freed when being resized.  This issue     could lead to arbitrary code execution. (CVE-2014-1531)

  - A use-after-free issue exists during host resolution     that could lead to arbitrary code execution.
    (CVE-2014-1532)

The installed version of Firefox ESR 24.x is a version prior to 24.5.
It is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1518, CVE-2014-1519)

  - An issue exists related to the 'Mozilla Maintenance     Service' that could lead to privilege escalation due to     the creation of a writeable temporary directory during     the update process. (CVE-2014-1520)

  - An out-of-bounds read issue exists when decoding     certain JPG images that could lead to a denial of     service. (CVE-2014-1523)

  - A memory corruption issue exists due to improper     validation of XBL objects that could lead to arbitrary     code execution. (CVE-2014-1524)

  - A security bypass issue exists in the Web Notification     API that could lead to arbitrary code execution.
    (CVE-2014-1529)

  - A cross-site scripting issue exists that could allow an     attacker to load another website other than the URL for     the website that is shown in the address bar.
    (CVE-2014-1530)

  - A use-after-free issue exists due to an 'imgLoader'     object being freed when being resized.  This issue     could lead to arbitrary code execution. (CVE-2014-1531)

  - A use-after-free issue exists during host resolution     that could lead to arbitrary code execution.
    (CVE-2014-1532)

ID	Name	Product	Family	Severity
701244	Mozilla Firefox ESR < 24.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
74006	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 9185)	Nessus	SuSE Local Security Checks	critical
8213	Mozilla Firefox < 29.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
73848	Fedora 19 : firefox-29.0-5.fc19 / thunderbird-24.5.0-1.fc19 / xulrunner-29.0-1.fc19 (2014-5829)	Nessus	Fedora Local Security Checks	critical
73819	Fedora 20 : firefox-29.0-5.fc20 / thunderbird-24.5.0-1.fc20 / xulrunner-29.0-1.fc20 (2014-5833)	Nessus	Fedora Local Security Checks	critical
73779	FreeBSD : mozilla -- multiple vulnerabilities (985d4d6c-cfbd-11e3-a003-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	critical
73769	Firefox < 29.0 Multiple Vulnerabilities	Nessus	Windows	critical
73768	Firefox ESR 24.x < 24.5 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2014-1520

high

Tenable Plugins

high

critical

critical

high

critical

critical

critical

critical

critical