Multiple heap-based buffer overflows in the navigator.getGamepads function in the Gamepad API in Mozilla Firefox before 30.0 allow remote attackers to execute arbitrary code by using non-contiguous axes with a (1) physical or (2) virtual Gamepad device.

Versions of Mozilla Firefox ESR prior to 24.6 are unpatched against the following vulnerabilities :

 - Buffer overflows due to insufficient input validation in Gamepad API and Web Audio Speex resampler, which can be leveraged to execute arbitrary code or cause denial of service conditions (CVE-2014-1543, CVE-2014-1542)
 - Use-after-free errors in SMIL Animation Controller, Event Listener Manager, and various other locations, which may be triggered via web content to cause a potentially exploitable crash (CVE-2014-1540, CVE-2014-1539, CVE-2014-1536, CVE-2014-1537)
 - Clickjacking through cursor invisibility when the cursor leaves the embedded flash object (OS X platform only) (CVE-2014-1539)
 - Miscellaneous memory safety hazards (CVE-2014-1533, CVE-2014-1534)

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

The installed version of SeaMonkey is a version prior to 2.26.1. It is, therefore, affected by the following vulnerabilities :

  - There are multiple memory safety bugs in the browser     engine. Several of these bugs show evidence of     memory corruption, which may allow an attacker to     execute arbitrary code. (CVE-2014-1533, CVE-2014-1534)

  - There are multiple use-after-free and out of bounds     read issues. These issues have the potential to be     exploited, resulting in remote code execution.
    (CVE-2014-1536, CVE-2014-1537, CVE-2014-1538)

  - A use-after-free error exists in the SMIL Animation     Controller when interacting with and rendering     improperly formed web content. This may result in a     potentially exploitable crash. (CVE-2014-1541)

  - A use-after-free flaw exists in the event listener     manager that can be triggered by web content. This may     result in a potentially exploitable crash.
    (CVE-2014-1540)

  - A flaw exists in the Speex resample in Web Audio that     results in a buffer overflow when working with audio     content that exceeds the expected bounds. This flaw     results in a potentially exploitable crash.
    (CVE-2014-1542)

  - There exists a buffer overflow in the Gamepad API when     it is exercised with a gamepad device with     non-contiguous axes. This flaw results in a potentially     exploitable crash. (CVE-2014-1543)

seamonkey was updated to version 2.26.1 to fix nine security issues.

These security issues were fixed :

  - Miscellaneous memory safety hazards     (CVE-2014-1533/CVE-2014-1534)

  - Use-after-free and out of bounds issues found using     Address Sanitizer     (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538)

  - Use-after-free in Event Listener Manager (CVE-2014-1540)

  - Use-after-free with SMIL Animation Controller     (CVE-2014-1541)

  - Buffer overflow in Web Audio Speex resampler     (CVE-2014-1542)

  - Out of bounds write in NSPR (CVE-2014-1545)

mozilla-nspr was updated to version 4.10.6 to fix one security issue :

  - OOB write with sprintf and console functions     (CVE-2014-1545)

MozillaFirefox was updated to version 30.0 to fix eight security issues :

  - Miscellaneous memory safety hazards     (CVE-2014-1533/CVE-2014-1534)

  - Use-after-free and out of bounds issues found using     Address Sanitizer     (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538)

  - Use-after-free in Event Listener Manager (CVE-2014-1540)

  - Use-after-free with SMIL Animation Controller     (CVE-2014-1541)

  - Buffer overflow in Web Audio Speex resampler     (CVE-2014-1542)

Several non-security bugs were also fixed in this release.

The Mozilla Project reports :

MFSA 2014-48 Miscellaneous memory safety hazards (rv:30.0 / rv:24.6)

MFSA 2014-49 Use-after-free and out of bounds issues found using Address Sanitizer

MFSA 2014-51 Use-after-free in Event Listener Manager

MFSA 2014-52 Use-after-free with SMIL Animation Controller

MFSA 2014-53 Buffer overflow in Web Audio Speex resampler

MFSA 2014-54 Buffer overflow in Gamepad API

MFSA 2014-55 Out of bounds write in NSPR

The version of Firefox installed on the remote host is a version prior to 30.0 and is, therefore, affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. Note that these issues only affect Firefox     29. (CVE-2014-1533, CVE-2014-1534)

  - An out-of-bounds read issue exists in     'PropertyProvider::FindJustificationRange'.
    (CVE-2014-1536)

  - Use-after-free memory issues exist in     'mozilla::dom::workers::WorkerPrivateParent',     'nsTextEditRules::CreateMozBR', and the SMIL Animation     Controller that could lead to code execution.
    (CVE-2014-1537, CVE-2014-1538, CVE-2014-1541)

  - A use-after-free memory issue exists in the event     listener manager. Note that this issue only affects     Firefox 29. (CVE-2014-1540)

  - A buffer overflow issue exists in the Speex resampler     for Web Audio that could lead to code execution.
    (CVE-2014-1542)

  - A buffer overflow issue exists in the Gamepad API that     could lead to code execution. Note that this issue     only affects Firefox 29 on Windows 8 when a physical or     virtual gamepad is attached. (CVE-2014-1543)

Versions of Mozilla Firefox earlier than 30.0 are unpatched against the following vulnerabilities :

 - Buffer overflows due to insufficient input validation in Gamepad API and Web Audio Speex resampler, which can be leveraged to execute arbitrary code or cause denial of service conditions (CVE-2014-1543, CVE-2014-1542)
 - Use-after-free errors in SMIL Animation Controller, Event Listener Manager, and various other locations, which may be triggered via web content to cause a potentially exploitable crash (CVE-2014-1540, CVE-2014-1539, CVE-2014-1538; on non-ESR Firefox only: CVE-2014-1536, CVE-2014-1537)
 - Clickjacking through cursor invisibility when the cursor leaves the embedded flash object (OS X platform only) (CVE-2014-1539)
 - Miscellaneous memory safety hazards (CVE-2014-1533, CVE-2014-1534)

ID	Name	Product	Family	Severity
701245	Mozilla Firefox ESR < 24.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
77283	SeaMonkey < 2.26.1 Multiple Vulnerabilities	Nessus	Windows	critical
76339	openSUSE Security Update : seamonkey (openSUSE-SU-2014:0855-1)	Nessus	SuSE Local Security Checks	critical
76181	openSUSE Security Update : MozillaFirefox / mozilla-nspr (openSUSE-SU-2014:0819-1)	Nessus	SuSE Local Security Checks	critical
74444	FreeBSD : mozilla -- multiple vulnerabilities (888a0262-f0d9-11e3-ba0c-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	critical
74440	Firefox < 30.0 Multiple Vulnerabilities	Nessus	Windows	critical
8290	Mozilla Firefox < 30.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2014-1543

critical

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

medium