Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.

Versions of Mozilla Firefox ESR prior to 24.6 are unpatched against the following vulnerabilities :

 - Buffer overflows due to insufficient input validation in Gamepad API and Web Audio Speex resampler, which can be leveraged to execute arbitrary code or cause denial of service conditions (CVE-2014-1543, CVE-2014-1542)
 - Use-after-free errors in SMIL Animation Controller, Event Listener Manager, and various other locations, which may be triggered via web content to cause a potentially exploitable crash (CVE-2014-1540, CVE-2014-1539, CVE-2014-1536, CVE-2014-1537)
 - Clickjacking through cursor invisibility when the cursor leaves the embedded flash object (OS X platform only) (CVE-2014-1539)
 - Miscellaneous memory safety hazards (CVE-2014-1533, CVE-2014-1534)

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

The installed version of SeaMonkey is a version prior to 2.26.1. It is, therefore, affected by the following vulnerabilities :

  - There are multiple memory safety bugs in the browser     engine. Several of these bugs show evidence of     memory corruption, which may allow an attacker to     execute arbitrary code. (CVE-2014-1533, CVE-2014-1534)

  - There are multiple use-after-free and out of bounds     read issues. These issues have the potential to be     exploited, resulting in remote code execution.
    (CVE-2014-1536, CVE-2014-1537, CVE-2014-1538)

  - A use-after-free error exists in the SMIL Animation     Controller when interacting with and rendering     improperly formed web content. This may result in a     potentially exploitable crash. (CVE-2014-1541)

  - A use-after-free flaw exists in the event listener     manager that can be triggered by web content. This may     result in a potentially exploitable crash.
    (CVE-2014-1540)

  - A flaw exists in the Speex resample in Web Audio that     results in a buffer overflow when working with audio     content that exceeds the expected bounds. This flaw     results in a potentially exploitable crash.
    (CVE-2014-1542)

  - There exists a buffer overflow in the Gamepad API when     it is exercised with a gamepad device with     non-contiguous axes. This flaw results in a potentially     exploitable crash. (CVE-2014-1543)

seamonkey was updated to version 2.26.1 to fix nine security issues.

These security issues were fixed :

  - Miscellaneous memory safety hazards     (CVE-2014-1533/CVE-2014-1534)

  - Use-after-free and out of bounds issues found using     Address Sanitizer     (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538)

  - Use-after-free in Event Listener Manager (CVE-2014-1540)

  - Use-after-free with SMIL Animation Controller     (CVE-2014-1541)

  - Buffer overflow in Web Audio Speex resampler     (CVE-2014-1542)

  - Out of bounds write in NSPR (CVE-2014-1545)

mozilla-nspr was updated to version 4.10.6 to fix one security issue :

  - OOB write with sprintf and console functions     (CVE-2014-1545)

MozillaFirefox was updated to version 30.0 to fix eight security issues :

  - Miscellaneous memory safety hazards     (CVE-2014-1533/CVE-2014-1534)

  - Use-after-free and out of bounds issues found using     Address Sanitizer     (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538)

  - Use-after-free in Event Listener Manager (CVE-2014-1540)

  - Use-after-free with SMIL Animation Controller     (CVE-2014-1541)

  - Buffer overflow in Web Audio Speex resampler     (CVE-2014-1542)

Several non-security bugs were also fixed in this release.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2243-1 advisory.

    Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff     Walden, Kyle Huey, Jesse Ruderman, Gregor Wagner, Benoit Jacob and Karl Tomlinson discovered multiple     memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit these to cause a denial of service via application crash, or execute     arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1533, CVE-2014-1534)

    Abhishek Arya discovered multiple use-after-free and out-of-bounds read issues in Firefox. An attacker     could potentially exploit these to cause a denial of service via application crash or execute arbitrary     code with the priviliges of the user invoking Firefox. (CVE-2014-1536, CVE-2014-1537, CVE-2014-1538)

    Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in the event listener manager. An     attacker could potentially exploit this to cause a denial of service via application crash or execute     arbitrary code with the priviliges of the user invoking Firefox. (CVE-2014-1540)

    A use-after-free was discovered in the SMIL animation controller. An attacker could potentially exploit     this to cause a denial of service via application crash or execute arbitrary code with the priviliges of     the user invoking Firefox. (CVE-2014-1541)

    Holger Fuhrmannek discovered a buffer overflow in Web Audio. An attacker could potentially exploit this to     cause a denial of service via application crash or execute arbitrary code with the priviliges of the user     invoking Firefox. (CVE-2014-1542)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Mozilla Project reports :

MFSA 2014-48 Miscellaneous memory safety hazards (rv:30.0 / rv:24.6)

MFSA 2014-49 Use-after-free and out of bounds issues found using Address Sanitizer

MFSA 2014-51 Use-after-free in Event Listener Manager

MFSA 2014-52 Use-after-free with SMIL Animation Controller

MFSA 2014-53 Buffer overflow in Web Audio Speex resampler

MFSA 2014-54 Buffer overflow in Gamepad API

MFSA 2014-55 Out of bounds write in NSPR

The version of Firefox installed on the remote host is a version prior to 30.0 and is, therefore, affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. Note that these issues only affect Firefox     29. (CVE-2014-1533, CVE-2014-1534)

  - An out-of-bounds read issue exists in     'PropertyProvider::FindJustificationRange'.
    (CVE-2014-1536)

  - Use-after-free memory issues exist in     'mozilla::dom::workers::WorkerPrivateParent',     'nsTextEditRules::CreateMozBR', and the SMIL Animation     Controller that could lead to code execution.
    (CVE-2014-1537, CVE-2014-1538, CVE-2014-1541)

  - A use-after-free memory issue exists in the event     listener manager. Note that this issue only affects     Firefox 29. (CVE-2014-1540)

  - A buffer overflow issue exists in the Speex resampler     for Web Audio that could lead to code execution.
    (CVE-2014-1542)

  - A buffer overflow issue exists in the Gamepad API that     could lead to code execution. Note that this issue     only affects Firefox 29 on Windows 8 when a physical or     virtual gamepad is attached. (CVE-2014-1543)

The version of Firefox installed on the remote Mac OS X host is a version prior to version 30.0. It is, therefore, affected by multiple vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. Note that these issues only affect Firefox     29. (CVE-2014-1533, CVE-2014-1534)

  - An out-of-bounds read issue exists in     'PropertyProvider::FindJustificationRange'.
    (CVE-2014-1536)

  - Use-after-free memory issues exist in     'mozilla::dom::workers::WorkerPrivateParent',     'nsTextEditRules::CreateMozBR', and the SMIL Animation     Controller that could lead to code execution.
    (CVE-2014-1537, CVE-2014-1538, CVE-2014-1541)

  - An issue exists when the cursor is used on an embedded     Flash object which can make the cursor invisible and     lead to clickjacking attacks. (CVE-2014-1539)

  - A use-after-free memory issue exists in the event     listener manager. Note that this issue only affects     Firefox 29. (CVE-2014-1540)

  - A buffer overflow issue exists in the Speex resampler     for Web Audio that could lead to code execution.
    (CVE-2014-1542)

Versions of Mozilla Firefox earlier than 30.0 are unpatched against the following vulnerabilities :

 - Buffer overflows due to insufficient input validation in Gamepad API and Web Audio Speex resampler, which can be leveraged to execute arbitrary code or cause denial of service conditions (CVE-2014-1543, CVE-2014-1542)
 - Use-after-free errors in SMIL Animation Controller, Event Listener Manager, and various other locations, which may be triggered via web content to cause a potentially exploitable crash (CVE-2014-1540, CVE-2014-1539, CVE-2014-1538; on non-ESR Firefox only: CVE-2014-1536, CVE-2014-1537)
 - Clickjacking through cursor invisibility when the cursor leaves the embedded flash object (OS X platform only) (CVE-2014-1539)
 - Miscellaneous memory safety hazards (CVE-2014-1533, CVE-2014-1534)

ID	Name	Product	Family	Severity
701245	Mozilla Firefox ESR < 24.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
77283	SeaMonkey < 2.26.1 Multiple Vulnerabilities	Nessus	Windows	critical
76339	openSUSE Security Update : seamonkey (openSUSE-SU-2014:0855-1)	Nessus	SuSE Local Security Checks	critical
76181	openSUSE Security Update : MozillaFirefox / mozilla-nspr (openSUSE-SU-2014:0819-1)	Nessus	SuSE Local Security Checks	critical
74493	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2243-1)	Nessus	Ubuntu Local Security Checks	high
74444	FreeBSD : mozilla -- multiple vulnerabilities (888a0262-f0d9-11e3-ba0c-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	critical
74440	Firefox < 30.0 Multiple Vulnerabilities	Nessus	Windows	critical
74437	Firefox < 30.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
8290	Mozilla Firefox < 30.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2014-1540

high

Tenable Plugins

medium

critical

critical

critical

critical

high

critical

critical

critical

medium