Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake cursor image.

Versions of Mozilla Firefox ESR prior to 24.6 are unpatched against the following vulnerabilities :

 - Buffer overflows due to insufficient input validation in Gamepad API and Web Audio Speex resampler, which can be leveraged to execute arbitrary code or cause denial of service conditions (CVE-2014-1543, CVE-2014-1542)
 - Use-after-free errors in SMIL Animation Controller, Event Listener Manager, and various other locations, which may be triggered via web content to cause a potentially exploitable crash (CVE-2014-1540, CVE-2014-1539, CVE-2014-1536, CVE-2014-1537)
 - Clickjacking through cursor invisibility when the cursor leaves the embedded flash object (OS X platform only) (CVE-2014-1539)
 - Miscellaneous memory safety hazards (CVE-2014-1533, CVE-2014-1534)

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

seamonkey was updated to version 2.26.1 to fix nine security issues.

These security issues were fixed :

  - Miscellaneous memory safety hazards     (CVE-2014-1533/CVE-2014-1534)

  - Use-after-free and out of bounds issues found using     Address Sanitizer     (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538)

  - Use-after-free in Event Listener Manager (CVE-2014-1540)

  - Use-after-free with SMIL Animation Controller     (CVE-2014-1541)

  - Buffer overflow in Web Audio Speex resampler     (CVE-2014-1542)

  - Out of bounds write in NSPR (CVE-2014-1545)

mozilla-nspr was updated to version 4.10.6 to fix one security issue :

  - OOB write with sprintf and console functions     (CVE-2014-1545)

MozillaFirefox was updated to version 30.0 to fix eight security issues :

  - Miscellaneous memory safety hazards     (CVE-2014-1533/CVE-2014-1534)

  - Use-after-free and out of bounds issues found using     Address Sanitizer     (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538)

  - Use-after-free in Event Listener Manager (CVE-2014-1540)

  - Use-after-free with SMIL Animation Controller     (CVE-2014-1541)

  - Buffer overflow in Web Audio Speex resampler     (CVE-2014-1542)

Several non-security bugs were also fixed in this release.

Versions of Mozilla Thunderbird prior to 24.6 are unpatched against the following vulnerabilities :

 - Use-after-free issue in the SMIL Animation Controller, among other use-after-free and out-of-bounds issues, which may be exploited via web content to induce a potentially exploitable crash. (CVE-2014-1541, CVE-2014-1536, CVE-2014-1537, CVE-2014-1538)
 - Click-jacking that can be exploited due to cursor invisibility when leaving an embedded flash object (Note, only OS X is affected: CVE-2014-1539)
 - Other miscellaneous memory safety hazards (CVE-2014-1533, CVE-2014-1534)

The version of Firefox installed on the remote Mac OS X host is a version prior to version 30.0. It is, therefore, affected by multiple vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. Note that these issues only affect Firefox     29. (CVE-2014-1533, CVE-2014-1534)

  - An out-of-bounds read issue exists in     'PropertyProvider::FindJustificationRange'.
    (CVE-2014-1536)

  - Use-after-free memory issues exist in     'mozilla::dom::workers::WorkerPrivateParent',     'nsTextEditRules::CreateMozBR', and the SMIL Animation     Controller that could lead to code execution.
    (CVE-2014-1537, CVE-2014-1538, CVE-2014-1541)

  - An issue exists when the cursor is used on an embedded     Flash object which can make the cursor invisible and     lead to clickjacking attacks. (CVE-2014-1539)

  - A use-after-free memory issue exists in the event     listener manager. Note that this issue only affects     Firefox 29. (CVE-2014-1540)

  - A buffer overflow issue exists in the Speex resampler     for Web Audio that could lead to code execution.
    (CVE-2014-1542)

Versions of Mozilla Firefox earlier than 30.0 are unpatched against the following vulnerabilities :

 - Buffer overflows due to insufficient input validation in Gamepad API and Web Audio Speex resampler, which can be leveraged to execute arbitrary code or cause denial of service conditions (CVE-2014-1543, CVE-2014-1542)
 - Use-after-free errors in SMIL Animation Controller, Event Listener Manager, and various other locations, which may be triggered via web content to cause a potentially exploitable crash (CVE-2014-1540, CVE-2014-1539, CVE-2014-1538; on non-ESR Firefox only: CVE-2014-1536, CVE-2014-1537)
 - Clickjacking through cursor invisibility when the cursor leaves the embedded flash object (OS X platform only) (CVE-2014-1539)
 - Miscellaneous memory safety hazards (CVE-2014-1533, CVE-2014-1534)

ID	Name	Product	Family	Severity
701245	Mozilla Firefox ESR < 24.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
76339	openSUSE Security Update : seamonkey (openSUSE-SU-2014:0855-1)	Nessus	SuSE Local Security Checks	critical
76181	openSUSE Security Update : MozillaFirefox / mozilla-nspr (openSUSE-SU-2014:0819-1)	Nessus	SuSE Local Security Checks	critical
8292	Mozilla Thunderbird < 24.6 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	medium
74437	Firefox < 30.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
8290	Mozilla Firefox < 30.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2014-1539

critical

Tenable Plugins

medium

critical

critical

critical

medium

critical

medium