The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element.

Versions of Mozilla Firefox ESR prior to 24.5 are unpatched against the following vulnerabilities :

 - Use-after-free vulnerabilities in nsHostResolver, imgLoader, and Text Track Manager (for HTML video), which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531, CVE-2014-1525)
 - A potentially exploitable out-of-bounds write in Cairo, a potentially exploitable out-of-bounds read issue with Web Audio, and a non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1528, CVE-2014-1522, CVE-2014-1523)
 - Improper wildcard matching of domains in the Network Security Services (NSS library), which has since been fixed by updating to version 3.16 (CVE-2014-1492)
 - Potential privilege escalation via Xray Wrappers bypass, which can occur if a user used the debugger to interact with a malicious page (CVE-2014-1526)
 - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)
 - Privilege escalation via the Mozilla Maintenance Service Installer, which writes to a globally writeable temporary directory during the update process (Windows only) (CVE-2014-1520)
 - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)
 - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)
 - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

This is a SeaMonkey update to version 2.26 :

  - MFSA 2014-34/CVE-2014-1518/CVE-2014-1519 Miscellaneous     memory safety hazards

  - MFSA 2014-36/CVE-2014-1522 (bmo#995289) Web Audio memory     corruption issues

  - MFSA 2014-37/CVE-2014-1523 (bmo#969226) Out of bounds     read while decoding JPG images

  - MFSA 2014-38/CVE-2014-1524 (bmo#989183) Buffer overflow     when using non-XBL object as XBL

  - MFSA 2014-39/CVE-2014-1525 (bmo#989210) Use-after-free     in the Text Track Manager for HTML video

  - MFSA 2014-41/CVE-2014-1528 (bmo#963962) Out-of-bounds     write in Cairo

  - MFSA 2014-42/CVE-2014-1529 (bmo#987003) Privilege     escalation through Web Notification API

  - MFSA 2014-43/CVE-2014-1530 (bmo#895557) Cross-site     scripting (XSS) using history navigations

  - MFSA 2014-44/CVE-2014-1531 (bmo#987140) Use-after-free     in imgLoader while resizing images

  - MFSA 2014-45/CVE-2014-1492 (bmo#903885) Incorrect IDNA     domain name matching for wildcard certificates (fixed by     NSS 3.16)

  - MFSA 2014-46/CVE-2014-1532 (bmo#966006) Use-after-free     in nsHostResolver

  - MFSA 2014-47/CVE-2014-1526 (bmo#988106) Debugger can     bypass XrayWrappers with JavaScript

  - rebased patches

  - added aarch64 porting patches

  - mozilla-aarch64-bmo-810631.patch

  - mozilla-aarch64-bmo-962488.patch

  - mozilla-aarch64-bmo-963023.patch

  - mozilla-aarch64-bmo-963024.patch

  - mozilla-aarch64-bmo-963027.patch

  - requires NSPR 4.10.3 and NSS 3.16

  - added mozilla-icu-strncat.patch to fix post build checks

This is a MozillaFirefox update to version 29.0 :

  - MFSA 2014-34/CVE-2014-1518/CVE-2014-1519 Miscellaneous     memory safety hazards

  - MFSA 2014-36/CVE-2014-1522 (bmo#995289) Web Audio memory     corruption issues

  - MFSA 2014-37/CVE-2014-1523 (bmo#969226) Out of bounds     read while decoding JPG images

  - MFSA 2014-38/CVE-2014-1524 (bmo#989183) Buffer overflow     when using non-XBL object as XBL

  - MFSA 2014-39/CVE-2014-1525 (bmo#989210) Use-after-free     in the Text Track Manager for HTML video

  - MFSA 2014-41/CVE-2014-1528 (bmo#963962) Out-of-bounds     write in Cairo

  - MFSA 2014-42/CVE-2014-1529 (bmo#987003) Privilege     escalation through Web Notification API

  - MFSA 2014-43/CVE-2014-1530 (bmo#895557) Cross-site     scripting (XSS) using history navigations

  - MFSA 2014-44/CVE-2014-1531 (bmo#987140) Use-after-free     in imgLoader while resizing images

  - MFSA 2014-45/CVE-2014-1492 (bmo#903885) Incorrect IDNA     domain name matching for wildcard certificates (fixed by     NSS 3.16)

  - MFSA 2014-46/CVE-2014-1532 (bmo#966006) Use-after-free     in nsHostResolver

  - MFSA 2014-47/CVE-2014-1526 (bmo#988106) Debugger can     bypass XrayWrappers with JavaScript

  - rebased patches

  - removed obsolete patches

  - firefox-browser-css.patch

  - mozilla-aarch64-599882cfb998.diff

  - mozilla-aarch64-bmo-963028.patch

  - mozilla-aarch64-bmo-963029.patch

  - mozilla-aarch64-bmo-963030.patch

  - mozilla-aarch64-bmo-963031.patch

  - requires NSS 3.16

  - added mozilla-icu-strncat.patch to fix post build checks

  - add mozilla-aarch64-599882cfb998.patch,     mozilla-aarch64-bmo-810631.patch,     mozilla-aarch64-bmo-962488.patch,     mozilla-aarch64-bmo-963030.patch,     mozilla-aarch64-bmo-963027.patch,     mozilla-aarch64-bmo-963028.patch,     mozilla-aarch64-bmo-963029.patch,     mozilla-aarch64-bmo-963023.patch,     mozilla-aarch64-bmo-963024.patch,     mozilla-aarch64-bmo-963031.patch: AArch64 porting

  - Add patch for bmo#973977

  - mozilla-ppc64-xpcom.patch

  - Refresh mozilla-ppc64le-xpcom.patch patch

  - Adapt mozilla-ppc64le-xpcom.patch to Mozilla > 24.0     build system

This is also a mozilla-nss update to version 3.16 :

  - required for Firefox 29

  - bmo#903885 - (CVE-2014-1492) In a wildcard certificate,     the wildcard character should not be embedded within the     U-label of an internationalized domain name. See the     last bullet point in RFC 6125, Section 7.2.

  - Supports the Linux x32 ABI. To build for the Linux x32     target, set the environment variable USE_X32=1 when     building NSS. New Functions :

  - NSS_CMSSignerInfo_Verify New Macros

  - TLS_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA,     etc., cipher suites that were first defined in SSL 3.0     can now be referred to with their official IANA names in     TLS, with the TLS_ prefix. Previously, they had to be     referred to with their names in SSL 3.0, with the SSL_     prefix. Notable Changes :

  - ECC is enabled by default. It is no longer necessary to     set the environment variable NSS_ENABLE_ECC=1 when     building NSS. To disable ECC, set the environment     variable NSS_DISABLE_ECC=1 when building NSS.

  - libpkix should not include the common name of CA as DNS     names when evaluating name constraints.

  - AESKeyWrap_Decrypt should not return SECSuccess for     invalid keys.

  - Fix a memory corruption in sec_pkcs12_new_asafe.

  - If the NSS_SDB_USE_CACHE environment variable is set,     skip the runtime test sdb_measureAccess.

  - The built-in roots module has been updated to version     1.97, which adds, removes, and distrusts several     certificates.

  - The atob utility has been improved to automatically     ignore lines of text that aren't in base64 format.

  - The certutil utility has been improved to support     creation of version 1 and version 2 certificates, in     addition to the existing version 3 support.

Versions of SeaMonkey earlier than 2.26 are unpatched against the following vulnerabilities:

  - Use-after-free vulnerabilities in nsHostResolver, imgLoader, and Text Track Manager (for HTML video), which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531, CVE-2014-1525)

  - A potentially exploitable out-of-bounds write in Cairo, a potentially exploitable out-of-bounds read issue with Web Audio, and a non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1528, CVE-2014-1522, CVE-2014-1523)

  - Improper wildcard matching of domains in the Network Security Services (NSS library), which has since been fixed by updating to version 3.16 (CVE-2014-1492)

  - Potential privilege escalation via Xray Wrappers bypass, which can occur if a user used the debugger to interact with a malicious page (CVE-2014-1526)

  - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)

  - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)

  - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)

  - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

Versions of Mozilla Firefox earlier than 29.0 are unpatched against the following vulnerabilities :

 - Use-after-free vulnerabilities in nsHostResolver, imgLoader, and Text Track Manager (for HTML video), which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531, CVE-2014-1525)
 - A potentially exploitable out-of-bounds write in Cairo, a potentially exploitable out-of-bounds read issue with Web Audio, and a non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1528, CVE-2014-1522, CVE-2014-1523)
 - Improper wildcard matching of domains in the Network Security Services (NSS library), which has since been fixed by updating to version 3.16 (CVE-2014-1492)
 - Potential privilege escalation via Xray Wrappers bypass, which can occur if a user used the debugger to interact with a malicious page (CVE-2014-1526)
 - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)
 - Privilege escalation via the Mozilla Maintenance Service Installer, which writes to a globally writeable temporary directory during the update process (Windows only) (CVE-2014-1520)
 - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)
 - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)
 - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

Update to latest upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2185-1 advisory.

    Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd, John     Schoenick, Karl Tomlinson, Vladimir Vukicevic and Christian Holler discovered multiple memory safety     issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit these to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Firefox. (CVE-2014-1518, CVE-2014-1519)

    An out of bounds read was discovered in Web Audio. An attacker could potentially exploit this cause a     denial of service via application crash or execute arbitrary code with the privileges of the user invoking     Firefox. (CVE-2014-1522)

    Abhishek Arya discovered an out of bounds read when decoding JPG images. An attacker could potentially     exploit this to cause a denial of service via application crash. (CVE-2014-1523)

    Abhishek Arya discovered a buffer overflow when a script uses a non-XBL object as an XBL object. An     attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking     Firefox. (CVE-2014-1524)

    Abhishek Arya discovered a use-after-free in the Text Track Manager when processing HTML video. An     attacker could potentially exploit this to cause a denial of service via application crash or execute     arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1525)

    Jukka Jylnki discovered an out-of-bounds write in Cairo when working with canvas in some circumstances.
    An attacker could potentially exploit this to cause a denial of service via application crash or execute     arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1528)

    Mariusz Mlynski discovered that sites with notification permissions can run script in a privileged context     in some circumstances. An attacker could exploit this to execute arbitrary code with the privileges of the     user invoking Firefox. (CVE-2014-1529)

    It was discovered that browser history navigations could be used to load a site with the addressbar     displaying the wrong address. An attacker could potentially exploit this to conduct cross-site scripting     or phishing attacks. (CVE-2014-1530)

    A use-after-free was discovered when resizing images in some circumstances. An attacker could potentially     exploit this to cause a denial of service via application crash or execute arbitrary code with the     privileges of the user invoking Firefox. (CVE-2014-1531)

    Christian Heimes discovered that NSS did not handle IDNA domain prefixes correctly for wildcard     certificates. An attacker could potentially exploit this by using a specially crafted certificate to     conduct a machine-in-the-middle attack. (CVE-2014-1492)

    Tyson Smith and Jesse Schwartzentruber discovered a use-after-free during host resolution in some     circumstances. An attacker could potentially exploit this to cause a denial of service via application     crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1532)

    Boris Zbarsky discovered that the debugger bypassed XrayWrappers for some objects. If a user were tricked     in to opening a specially crafted website whilst using the debugger, an attacker could potentially exploit     this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1526)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Mozilla Project reports :

MFSA 2014-34 Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)

MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer

MFSA 2014-36 Web Audio memory corruption issues

MFSA 2014-37 Out of bounds read while decoding JPG images

MFSA 2014-38 Buffer overflow when using non-XBL object as XBL

MFSA 2014-39 Use-after-free in the Text Track Manager for HTML video

MFSA 2014-41 Out-of-bounds write in Cairo

MFSA 2014-42 Privilege escalation through Web Notification API

MFSA 2014-43 Cross-site scripting (XSS) using history navigations

MFSA 2014-44 Use-after-free in imgLoader while resizing images

MFSA 2014-45 Incorrect IDNA domain name matching for wildcard certificates

MFSA 2014-46 Use-after-free in nsHostResolve

MFSA 2014-47 Debugger can bypass XrayWrappers with JavaScript

The installed version of SeaMonkey is a version prior to 2.26 and is, therefore, potentially affected by the following vulnerabilities :

  - An issue exists in the Network Security (NSS) library     due to improper handling of IDNA domain prefixes for     wildcard certificates. This issue could allow man-in-     the-middle attacks. (CVE-2014-1492)

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1518, CVE-2014-1519)

  - An out-of-bounds read issue exists in the Web Audio     feature that could lead to information disclosure.
    (CVE-2014-1522)

  - An out-of-bounds read issue exists when decoding     certain JPG images that could lead to a denial of     service. (CVE-2014-1523)

  - A memory corruption issue exists due to improper     validation of XBL objects that could lead to arbitrary     code execution. (CVE-2014-1524)

  - A use-after-free memory issue exists in the Text Track     Manager during HTML video processing that could lead     to arbitrary code execution. (CVE-2014-1525)

  - An issue exists related to the debugger bypassing     XrayWrappers that could lead to privilege escalation.
    (CVE-2014-1526)

  - An out-of-bounds write issue exists in the Cairo     graphics library that could lead to arbitrary code     execution.	Note that this issue only affects Firefox     28 and SeaMonkey prior to version 2.26. (CVE-2014-1528)

  - A security bypass issue exists in the Web Notification     API that could lead to arbitrary code execution.
    (CVE-2014-1529)

  - A cross-site scripting issue exists that could allow an     attacker to load another website other than the URL for     the website that is shown in the address bar.
    (CVE-2014-1530)

  - A use-after-free issue exists due to an 'imgLoader'     object being freed when being resized.  This issue     could lead to arbitrary code execution. (CVE-2014-1531)

  - A use-after-free issue exists during host resolution     that could lead to arbitrary code execution.
    (CVE-2014-1532)

The installed version of Firefox is a version prior to 29.0 and is, therefore, potentially affected by the following vulnerabilities :

  - An issue exists in the Network Security (NSS) library     due to improper handling of IDNA domain prefixes for     wildcard certificates. This issue could allow man-in-     the-middle attacks. (CVE-2014-1492)

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1518, CVE-2014-1519)

  - An issue exists related to the 'Mozilla Maintenance     Service' that could lead to privilege escalation due to     the creation of a writeable temporary directory during     the update process. (CVE-2014-1520)

  - An out-of-bounds read issue exists in the Web Audio     feature that could lead to information disclosure.
    (CVE-2014-1522)

  - An out-of-bounds read issue exists when decoding     certain JPG images that could lead to a denial of     service. (CVE-2014-1523)

  - A memory corruption issue exists due to improper     validation of XBL objects that could lead to arbitrary     code execution. (CVE-2014-1524)

  - A use-after-free memory issue exists in the Text Track     Manager during HTML video processing that could lead     to arbitrary code execution. (CVE-2014-1525)

  - An issue exists related to the debugger bypassing     XrayWrappers that could lead to privilege escalation.
    (CVE-2014-1526)

  - An out-of-bounds write issue exists in the Cairo     graphics library that could lead to arbitrary code     execution.	Note that this issue only affects Firefox     28 and SeaMonkey 2.25. (CVE-2014-1528)

  - A security bypass issue exists in the Web Notification     API that could lead to arbitrary code execution.
    (CVE-2014-1529)

  - A cross-site scripting issue exists that could allow an     attacker to load another website other than the URL for     the website that is shown in the address bar.
    (CVE-2014-1530)

  - A use-after-free issue exists due to an 'imgLoader'     object being freed when being resized.  This issue     could lead to arbitrary code execution. (CVE-2014-1531)

  - A use-after-free issue exists during host resolution     that could lead to arbitrary code execution.
    (CVE-2014-1532)

ID	Name	Product	Family	Severity
701244	Mozilla Firefox ESR < 24.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
75352	openSUSE Security Update : seamonkey (openSUSE-SU-2014:0629-1)	Nessus	SuSE Local Security Checks	critical
75346	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:0599-1)	Nessus	SuSE Local Security Checks	critical
8214	SeaMonkey < 2.26 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
8213	Mozilla Firefox < 29.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
73848	Fedora 19 : firefox-29.0-5.fc19 / thunderbird-24.5.0-1.fc19 / xulrunner-29.0-1.fc19 (2014-5829)	Nessus	Fedora Local Security Checks	critical
73786	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2185-1)	Nessus	Ubuntu Local Security Checks	critical
73779	FreeBSD : mozilla -- multiple vulnerabilities (985d4d6c-cfbd-11e3-a003-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	critical
73771	SeaMonkey < 2.26 Multiple Vulnerabilities	Nessus	Windows	critical
73769	Firefox < 29.0 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2014-1528

high

Tenable Plugins

high

critical

critical

high

high

critical

critical

critical

critical

critical