Mozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions.

Versions of Mozilla Firefox ESR prior to 31.5 are unpatched for the following vulnerabilities : 

 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)


NOTE : The following vulnerabilities exist only within the stable release, and do not affect any Firefox ESR releases :

 - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832)
 - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830)
 - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in plaintext connections. (CVE-2015-0834)
 - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829)
 - A double-free issue exists when sending a zero-length 'XmlHttpRequest' (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828)
 - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825)
 - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826)
 - An issue exists in the 'DrawTarget()' function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824)
 - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823)
 - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821)

MozillaThunderbird was updated to fix 20 security issues.

These security issues were fixed :

  - CVE-2015-2727: Mozilla Firefox 38.0 and Firefox ESR 38.0     allowed user-assisted remote attackers to read arbitrary     files or execute arbitrary JavaScript code with chrome     privileges via a crafted website that is accessed with     unspecified mouse and keyboard actions. NOTE: this     vulnerability exists because of a CVE-2015-0821     regression (bsc#935979).

  - CVE-2015-2725: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 39.0,     Firefox ESR 38.x before 38.1, and Thunderbird before     38.1 allowed remote attackers to cause a denial of     service (memory corruption and application crash) or     possibly execute arbitrary code via unknown vectors     (bsc#935979).

  - CVE-2015-2736: The nsZipArchive::BuildFileList function     in Mozilla Firefox before 39.0, Firefox ESR 31.x before     31.8 and 38.x before 38.1, and Thunderbird before 38.1     accesses unintended memory locations, which allowed     remote attackers to have an unspecified impact via a     crafted ZIP archive (bsc#935979).

  - CVE-2015-2724: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 39.0,     Firefox ESR 31.x before 31.8 and 38.x before 38.1, and     Thunderbird before 38.1 allowed remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via unknown vectors (bsc#935979).

  - CVE-2015-2730: Mozilla Network Security Services (NSS)     before 3.19.1, as used in Mozilla Firefox before 39.0,     Firefox ESR 31.x before 31.8 and 38.x before 38.1, and     other products, did not properly perform Elliptical     Curve Cryptography (ECC) multiplications, which made it     easier for remote attackers to spoof ECDSA signatures     via unspecified vectors (bsc#935979).

  - CVE-2015-2743: PDF.js in Mozilla Firefox before 39.0 and     Firefox ESR 31.x before 31.8 and 38.x before 38.1     enables excessive privileges for internal Workers, which     might allowed remote attackers to execute arbitrary code     by leveraging a Same Origin Policy bypass (bsc#935979).

  - CVE-2015-2740: Buffer overflow in the     nsXMLHttpRequest::AppendToResponseText function in     Mozilla Firefox before 39.0, Firefox ESR 31.x before     31.8 and 38.x before 38.1, and Thunderbird before 38.1     might allowed remote attackers to cause a denial of     service or have unspecified other impact via unknown     vectors (bsc#935979).

  - CVE-2015-2741: Mozilla Firefox before 39.0, Firefox ESR     38.x before 38.1, and Thunderbird before 38.1 do not     enforce key pinning upon encountering an X.509     certificate problem that generates a user dialog, which     allowed user-assisted man-in-the-middle attackers to     bypass intended access restrictions by triggering a (1)     expired certificate or (2) mismatched hostname for a     domain with pinning enabled (bsc#935979).

  - CVE-2015-2728: The IndexedDatabaseManager class in the     IndexedDB implementation in Mozilla Firefox before 39.0     and Firefox ESR 31.x before 31.8 and 38.x before 38.1     misinterprets an unspecified IDBDatabase field as a     pointer, which allowed remote attackers to execute     arbitrary code or cause a denial of service (memory     corruption and application crash) via unspecified     vectors, related to a 'type confusion' issue     (bsc#935979).

  - CVE-2015-2729: The     AudioParamTimeline::AudioNodeInputValue function in the     Web Audio implementation in Mozilla Firefox before 39.0     and Firefox ESR 38.x before 38.1 did not properly     calculate an oscillator rendering range, which allowed     remote attackers to obtain sensitive information from     process memory or cause a denial of service     (out-of-bounds read) via unspecified vectors     (bsc#935979).

  - CVE-2015-2739: The ArrayBufferBuilder::append function     in Mozilla Firefox before 39.0, Firefox ESR 31.x before     31.8 and 38.x before 38.1, and Thunderbird before 38.1     accesses unintended memory locations, which has     unspecified impact and attack vectors (bsc#935979).

  - CVE-2015-2738: The     YCbCrImageDataDeserializer::ToDataSourceSurface function     in the YCbCr implementation in Mozilla Firefox before     39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1,     and Thunderbird before 38.1 reads data from     uninitialized memory locations, which has unspecified     impact and attack vectors (bsc#935979).

  - CVE-2015-2737: The rx::d3d11::SetBufferData function in     the Direct3D 11 implementation in Mozilla Firefox before     39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1,     and Thunderbird before 38.1 reads data from     uninitialized memory locations, which has unspecified     impact and attack vectors (bsc#935979).

  - CVE-2015-2721: Mozilla Network Security Services (NSS)     before 3.19, as used in Mozilla Firefox before 39.0,     Firefox ESR 31.x before 31.8 and 38.x before 38.1,     Thunderbird before 38.1, and other products, did not     properly determine state transitions for the TLS state     machine, which allowed man-in-the-middle attackers to     defeat cryptographic protection mechanisms by blocking     messages, as demonstrated by removing a forward-secrecy     property by blocking a ServerKeyExchange message, aka a     'SMACK SKIP-TLS' issue (bsc#935979).

  - CVE-2015-2735: nsZipArchive.cpp in Mozilla Firefox     before 39.0, Firefox ESR 31.x before 31.8 and 38.x     before 38.1, and Thunderbird before 38.1 accesses     unintended memory locations, which allowed remote     attackers to have an unspecified impact via a crafted     ZIP archive (bsc#935979).

  - CVE-2015-2734: The     CairoTextureClientD3D9::BorrowDrawTarget function in the     Direct3D 9 implementation in Mozilla Firefox before     39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1,     and Thunderbird before 38.1 reads data from     uninitialized memory locations, which has unspecified     impact and attack vectors (bsc#935979).

  - CVE-2015-2733: Use-after-free vulnerability in the     CanonicalizeXPCOMParticipant function in Mozilla Firefox     before 39.0 and Firefox ESR 31.x before 31.8 and 38.x     before 38.1 allowed remote attackers to execute     arbitrary code via vectors involving attachment of an     XMLHttpRequest object to a dedicated worker     (bsc#935979).

  - CVE-2015-2722: Use-after-free vulnerability in the     CanonicalizeXPCOMParticipant function in Mozilla Firefox     before 39.0 and Firefox ESR 31.x before 31.8 and 38.x     before 38.1 allowed remote attackers to execute     arbitrary code via vectors involving attachment of an     XMLHttpRequest object to a shared worker (bsc#935979).

  - CVE-2015-2731: Use-after-free vulnerability in the     CSPService::ShouldLoad function in the microtask     implementation in Mozilla Firefox before 39.0, Firefox     ESR 38.x before 38.1, and Thunderbird before 38.1     allowed remote attackers to execute arbitrary code by     leveraging client-side JavaScript that triggers removal     of a DOM object on the basis of a Content Policy     (bsc#935979).

  - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a     DHE_EXPORT ciphersuite is enabled on a server but not on     a client, did not properly convey a DHE_EXPORT choice,     which allowed man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with     DHE replaced by DHE_EXPORT and then rewriting a     ServerHello with DHE_EXPORT replaced by DHE, aka the     'Logjam' issue (bsc#931600).

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

SeaMonkey was updated to 2.33 (bnc#917597)

  - MFSA 2015-11/CVE-2015-0835/CVE-2015-0836 Miscellaneous     memory safety hazards

  - MFSA 2015-12/CVE-2015-0833 (bmo#945192) Invoking Mozilla     updater will load locally stored DLL files (Windows     only)

  - MFSA 2015-13/CVE-2015-0832 (bmo#1065909) Appended period     to hostnames can bypass HPKP and HSTS protections

  - MFSA 2015-14/CVE-2015-0830 (bmo#1110488) Malicious WebGL     content crash when writing strings

  - MFSA 2015-15/CVE-2015-0834 (bmo#1098314) TLS TURN and     STUN connections silently fail to simple TCP connections

  - MFSA 2015-16/CVE-2015-0831 (bmo#1130514) Use-after-free     in IndexedDB

  - MFSA 2015-17/CVE-2015-0829 (bmo#1128939) Buffer overflow     in libstagefright during MP4 video playback

  - MFSA 2015-18/CVE-2015-0828 (bmo#1030667, bmo#988675)     Double-free when using non-default memory allocators     with a zero-length XHR

  - MFSA 2015-19/CVE-2015-0827 (bmo#1117304) Out-of-bounds     read and write while rendering SVG content

  - MFSA 2015-20/CVE-2015-0826 (bmo#1092363) Buffer overflow     during CSS restyling

  - MFSA 2015-21/CVE-2015-0825 (bmo#1092370) Buffer     underflow during MP3 playback

  - MFSA 2015-22/CVE-2015-0824 (bmo#1095925) Crash using     DrawTarget in Cairo graphics library

  - MFSA 2015-23/CVE-2015-0823 (bmo#1098497) Use-after-free     in Developer Console date with OpenType Sanitiser

  - MFSA 2015-24/CVE-2015-0822 (bmo#1110557) Reading of     local files through manipulation of form autocomplete

  - MFSA 2015-25/CVE-2015-0821 (bmo#1111960) Local files or     privileged URLs in pages can be opened into new tabs

  - MFSA 2015-26/CVE-2015-0819 (bmo#1079554) UI Tour     whitelisted sites in background tab can spoof foreground     tabs

  - MFSA 2015-27CVE-2015-0820 (bmo#1125398) Caja Compiler     JavaScript sandbox bypass

Update to SeaMonkey 2.32.1

  - fixed MailNews feeds not updating

  - fixed selected profile in Profile Manager not remembered

  - fixed opening a bookmark folder in tabs on Linux

  - fixed Troubleshooting Information (about:support) with     the Modern theme

Versions of Mozilla Firefox earlier than 36.0 are unpatched for the following vulnerabilities : 

 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)


NOTE : The following vulnerabilities exist only within the stable release, and do not affect any Firefox ESR releases :

 - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832)
 - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830)
 - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in plaintext connections. (CVE-2015-0834)
 - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829)
 - A double-free issue exists when sending a zero-length 'XmlHttpRequest' (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828)
 - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825)
 - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826)
 - An issue exists in the 'DrawTarget()' function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824)
 - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823)
 - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821)

MozillaFirefox, mozilla-nss were updated to fix 18 security issues.

MozillaFirefox was updated to version 36.0. These security issues were fixed :

  - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory     safety hazards

  - CVE-2015-0832: Appended period to hostnames can bypass     HPKP and HSTS protections

  - CVE-2015-0830: Malicious WebGL content crash when     writing strings

  - CVE-2015-0834: TLS TURN and STUN connections silently     fail to simple TCP connections

  - CVE-2015-0831: Use-after-free in IndexedDB

  - CVE-2015-0829: Buffer overflow in libstagefright during     MP4 video playback

  - CVE-2015-0828: Double-free when using non-default memory     allocators with a zero-length XHR

  - CVE-2015-0827: Out-of-bounds read and write while     rendering SVG content

  - CVE-2015-0826: Buffer overflow during CSS restyling

  - CVE-2015-0825: Buffer underflow during MP3 playback

  - CVE-2015-0824: Crash using DrawTarget in Cairo graphics     library

  - CVE-2015-0823: Use-after-free in Developer Console date     with OpenType Sanitiser

  - CVE-2015-0822: Reading of local files through     manipulation of form autocomplete

  - CVE-2015-0821: Local files or privileged URLs in pages     can be opened into new tabs

  - CVE-2015-0819: UI Tour whitelisted sites in background     tab can spoof foreground tabs

  - CVE-2015-0820: Caja Compiler JavaScript sandbox bypass

mozilla-nss was updated to version 3.17.4 to fix the following issues :

  - CVE-2014-1569: QuickDER decoder length issue     (bnc#910647).

  - bmo#1084986: If an SSL/TLS connection fails, because     client and server don't have any common protocol version     enabled, NSS has been changed to report error code     SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting     SSL_ERROR_NO_CYPHER_OVERLAP).

  - bmo#1112461: libpkix was fixed to prefer the newest     certificate, if multiple certificates match.

  - bmo#1094492: fixed a memory corruption issue during     failure of keypair generation.

  - bmo#1113632: fixed a failure to reload a PKCS#11 module     in FIPS mode.

  - bmo#1119983: fixed interoperability of NSS server code     with a LibreSSL client.

The Mozilla Project reports :

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)

MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files

MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections

MFSA-2015-14 Malicious WebGL content crash when writing strings

MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections

MFSA-2015-16 Use-after-free in IndexedDB

MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback

MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR

MFSA-2015-19 Out-of-bounds read and write while rendering SVG content

MFSA-2015-20 Buffer overflow during CSS restyling

MFSA-2015-21 Buffer underflow during MP3 playback

MFSA-2015-22 Crash using DrawTarget in Cairo graphics library

MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser

MFSA-2015-24 Reading of local files through manipulation of form autocomplete

MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs

MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2505-1 advisory.

    Matthew Noorenberghe discovered that Mozilla domains in the allowlist could make UITour API calls from     background tabs. If one of these domains were compromised and open in a background tab, an attacker could

    potentially exploit this to conduct clickjacking attacks. (CVE-2015-0819)

    Jan de Mooij discovered an issue that affects content using the Caja Compiler. If web content loads     specially crafted code, this could be used to bypass sandboxing security measures provided by Caja.
    (CVE-2015-0820)

    Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a     Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to bypass security     restrictions. (CVE-2015-0821)

    Armin Razmdjou discovered that contents of locally readable files could be made available via manipulation     of form autocomplete in some circumstances. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0822)

    Atte Kettunen discovered a use-after-free in the OpenType Sanitiser (OTS) in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash. (CVE-2015-0823)

    Atte Kettunen discovered a crash when drawing images using Cairo in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service. (CVE-2015-0824)

    Atte Kettunen discovered a buffer underflow during playback of MP3 files in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     obtain sensitive information. (CVE-2015-0825)

    Atte Kettunen discovered a buffer overflow during CSS restyling in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-0826)

    Abhishek Arya discovered an out-of-bounds read and write when rendering SVG content in some circumstances.
    If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit     this to obtain sensitive information. (CVE-2015-0827)

    A buffer overflow was discovered in libstagefright during video playback in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-0829)

    Daniele Di Proietto discovered that WebGL could cause a crash in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service. (CVE-2015-0830)

    Paul Bandha discovered a use-after-free in IndexedDB. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0831)

    Muneaki Nishimura discovered that a period appended to a hostname could bypass key pinning and HSTS in     some circumstances. A remote attacker could potentially exloit this to conduct a Machine-in-the-middle     (MITM) attack. (CVE-2015-0832)

    Alexander Kolesnik discovered that Firefox would attempt plaintext connections to servers when handling     turns: and stuns: URIs. A remote attacker could potentially exploit this by conducting a Machine-in-the-     middle (MITM) attack in order to obtain credentials. (CVE-2015-0834)

    Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan     VanderMeulen, Christian Holler, Jesse Ruderman, Randell Jesup, Robin Whittleton, Jon Coppeard, and Nikhil     Marathe discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2015-0835, CVE-2015-0836)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. Note that hosts are only     affected if the updater is not run by the Mozilla     Maintenance Service. (CVE-2015-0833)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

The version of Firefox installed on the remote Mac OS X host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

ID	Name	Product	Family	Severity
701251	Mozilla Firefox ESR < 31.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
84864	openSUSE Security Update : MozillaThunderbird (openSUSE-2015-495) (Logjam)	Nessus	SuSE Local Security Checks	low
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
82013	openSUSE Security Update : seamonkey (openSUSE-2015-250)	Nessus	SuSE Local Security Checks	high
8653	Mozilla Firefox < 36.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
81589	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-185)	Nessus	SuSE Local Security Checks	high
81588	FreeBSD : mozilla -- multiple vulnerabilities (99029172-8253-407d-9d8b-2cfeab9abf81)	Nessus	FreeBSD Local Security Checks	high
81544	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2505-1)	Nessus	Ubuntu Local Security Checks	medium
81521	Firefox < 36 Multiple Vulnerabilities	Nessus	Windows	high
81518	Firefox < 36.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2015-0821

high

Tenable Plugins

high

low

critical

high

high

high

high

medium

high

high