Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Versions of Mozilla Firefox ESR prior to 31.4 are unpatched for the following vulnerabilities : 

 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)
 - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636)
 - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637)
 - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638)
 - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)
 - A flaw exists in Web Audio that can allow a small block of memory to be read. (CVE-2014-8640)
 - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641)
 - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642)
 - A flaw exists in the Gecko Media Plugin which can allow an attacker to break out of the sandbox. (CVE-2014-8643)

This update fixes the following security issues in MozillaFirefox :

  - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 (bmo#1109889,     bmo#1111737, bmo#1026774, bmo#1027300, bmo#1054538,     bmo#1067473, bmo#1070962, bmo#1072130, bmo#1072871,     bmo#1098583) Miscellaneous memory safety hazards     (rv:35.0 / rv:31.4)

  - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon     requests lack an Origin header

  - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie     injection through Proxy Authenticate responses

  - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free     in WebRTC

Also Mozilla NSS was updated to 3.17.3 to fix :

  - The QuickDER decoder now decodes lengths robustly     (bmo#1064670/CVE-2014-1569)

  - Support for TLS_FALLBACK_SCSV has been added to the     ssltap and tstclnt utilities

  - Changes in CA certificates

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

Mozilla seamonkey was updated to SeaMonkey 2.32 (bnc#910669)

  - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous     memory safety hazards

  - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized     memory use during bitmap rendering

  - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon     requests lack an Origin header

  - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie     injection through Proxy Authenticate responses

  - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of     uninitialized memory in Web Audio

  - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free     in WebRTC

  - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only)     Gecko Media Plugin sandbox escape

  - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP     responder certificates failure with id-pkix-ocsp-nocheck     extension

  - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper     bypass through DOM objects

  - use GStreamer 1.0 from 13.2 on

MozillaThunderbird was updated to Thunderbird 31.4.0 (bnc#910669)

  - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous     memory safety hazards

  - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon     requests lack an Origin header

  - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie     injection through Proxy Authenticate responses

MozillaFirefox was updated to version 35.0 (bnc#910669)

Notable features :

  - Firefox Hello with new rooms-based conversations model

  - Implemented HTTP Public Key Pinning Extension (for     enhanced authentication of encrypted connections)

Security fixes :

  - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous     memory safety hazards

  - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized     memory use during bitmap rendering

  - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon     requests lack an Origin header

  - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie     injection through Proxy Authenticate responses

  - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of     uninitialized memory in Web Audio

  - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free     in WebRTC

  - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only)     Gecko Media Plugin sandbox escape

  - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP     responder certificates failure with id-pkix-ocsp-nocheck     extension

  - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper     bypass through DOM objects

  - obsolete tracker-miner-firefox < 0.15 because it leads     to startup crashes (bnc#908892)

Versions of SeaMonkey earlier than 2.32 are unpatched against the following vulnerabilities : 

  - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636)

  - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637)

  - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)

  - A flaw exists in Web Audio that cam allow a small block of memory to be read. (CVE-2014-8640)

  - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641)

  - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642)

Versions of Mozilla Thunderbird prior to 31.4 are prone to the following vulnerabilities : 

 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)
 - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header. This allows malicious sites to perform XSRF attacks. (CVE-2014-8638)
 - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)

Versions of Mozilla Firefox earlier than 35.0 are unpatched for the following vulnerabilities : 

 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)
 - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636)
 - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637)
 - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638)
 - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)
 - A flaw exists in Web Audio that can allow a small block of memory to be read. (CVE-2014-8640)
 - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641)
 - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642)
 - A flaw exists in the Gecko Media Plugin which can allow an attacker to break out of the sandbox. (CVE-2014-8643)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2458-1 advisory.

    Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence     Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit these to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2014-8634, CVE-2014-8635)

    Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some     circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass security restrictions. (CVE-2014-8636)

    Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a     canvas element. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to steal confidential information. (CVE-2014-8637)

    Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638)

    Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the     originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially     exploit this to conduct session-fixation attacks. (CVE-2014-8639)

    Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service. (CVE-2014-8640)

    Mitchell Harper discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8641)

    Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder     certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with     a revoked certificate. (CVE-2014-8642)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Mozilla Project reports :

MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4)

MFSA-2015-02 Uninitialized memory use during bitmap rendering

MFSA-2015-03 sendBeacon requests lack an Origin header

MFSA-2015-04 Cookie injection through Proxy Authenticate responses

MFSA-2015-05 Read of uninitialized memory in Web Audio

MFSA-2015-06 Read-after-free in WebRTC

MFSA-2015-07 Gecko Media Plugin sandbox escape

MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension

MFSA-2015-09 XrayWrapper bypass through DOM objects

The version of SeaMonkey installed on the remote host is prior to 2.32. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists where DOM objects with some specific     properties can bypass XrayWrappers. This can allow web     content to confuse privileged code, potentially     enabling privilege escalation. (CVE-2014-8636)

  - A flaw exists in the rendering of bitmap images. When     rending a malformed bitmap image, memory may not always     be properly initialized, which can result in a leakage     of data to web content. (CVE-2014-8637)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A flaw exists in Web Audio that cam allow a small block     of memory to be read. (CVE-2014-8640)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

  - A flaw exists where delegated Online Certificate Status     Protocol responder certificates fail to recognize the     id-pkix-ocsp-nocheck extension. This can result in a     user connecting to a site with a revoked certificate.
    (CVE-2014-8642)

The version of Thunderbird installed on the remote Windows host is prior to 31.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header. This allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

The version of Firefox installed on the remote Windows host is prior to 35.0. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists where DOM objects with some specific     properties can bypass XrayWrappers. This can allow web     content to confuse privileged code, potentially     enabling privilege escalation. (CVE-2014-8636)

  - A flaw exists in the rendering of bitmap images. When     rending a malformed bitmap image, memory may not always     be properly initialized, which can result in a leakage     of data to web content. (CVE-2014-8637)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A flaw exists in Web Audio that cam allow a small block     of memory to be read. (CVE-2014-8640)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

  - A flaw exists where delegated Online Certificate Status     Protocol responder certificates fail to recognize the     id-pkix-ocsp-nocheck extension. This can result in a     user connecting to a site with a revoked certificate.
    (CVE-2014-8642)

  - A flaw exists in the Gecko Media Plugin which can allow     an attacker to break out of the sandbox. (CVE-2014-8643)

The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

The version of Thunderbird installed on the remote Mac OS X host is prior to 31.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header. This allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

The version of Firefox installed on the remote Mac OS X host is prior to 35.0. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists where DOM objects with some specific     properties can bypass XrayWrappers. This can allow web     content to confuse privileged code, potentially     enabling privilege escalation. (CVE-2014-8636)

  - A flaw exists in the rendering of bitmap images. When     rending a malformed bitmap image, memory may not always     be properly initialized, which can result in a leakage     of data to web content. (CVE-2014-8637)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A flaw exists in Web Audio that cam allow a small block     of memory to be read. (CVE-2014-8640)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

  - A flaw exists where delegated Online Certificate Status     Protocol responder certificates fail to recognize the     id-pkix-ocsp-nocheck extension. This can result in a     user connecting to a site with a revoked certificate.
    (CVE-2014-8642)

The version of Firefox ESR 31.x installed on the remote Mac OS X host is prior to 31.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

ID	Name	Product	Family	Severity
701250	Mozilla Firefox ESR < 31.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
83666	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0076-1)	Nessus	SuSE Local Security Checks	high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
81142	openSUSE Security Update : seamonkey (openSUSE-SU-2015:0192-1)	Nessus	SuSE Local Security Checks	high
80993	openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2015:0133-1)	Nessus	SuSE Local Security Checks	high
80843	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2015:0077-2)	Nessus	SuSE Local Security Checks	high
8626	SeaMonkey < 2.32 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
8625	Mozilla Thunderbird < 31.4 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
8624	Mozilla Firefox < 35.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
80548	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2458-1)	Nessus	Ubuntu Local Security Checks	high
80538	FreeBSD : mozilla -- multiple vulnerabilities (bd62c640-9bb9-11e4-a5ad-000c297fb80f)	Nessus	FreeBSD Local Security Checks	high
80525	SeaMonkey < 2.32 Vulnerability	Nessus	Windows	high
80524	Mozilla Thunderbird < 31.4 Multiple Vulnerabilities	Nessus	Windows	high
80523	Firefox < 35 Multiple Vulnerabilities	Nessus	Windows	high
80522	Firefox ESR 31.x < 31.4 Multiple Vulnerabilities	Nessus	Windows	high
80521	Mozilla Thunderbird < 31.4 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
80520	Firefox < 35.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
80519	Firefox ESR 31.x < 31.4 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2014-8635

high

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high