Firefox < 27.0 Multiple Vulnerabilities

critical Nessus Plugin ID 72331

Language:

Synopsis

The remote Windows host contains a web browser that is potentially affected by multiple vulnerabilities.

Description

The installed version of Firefox is earlier than 27.0 and is, therefore, potentially affected by the following vulnerabilities :

- Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. (CVE-2014-1477, CVE-2014-1478)

- An error exists related to System Only Wrappers (SOW) and the XML Binding Language (XBL) that could allow XUL content to be disclosed. (CVE-2014-1479)

- An error exists related to the 'open file' dialog that could allow users to take unintended actions.
(CVE-2014-1480)

- An error exists related to the JavaScript engine and 'window' object handling that has unspecified impact.
(CVE-2014-1481)

- An error exists related to 'RasterImage' and image decoding that could allow application crashes and possibly arbitrary code execution. (CVE-2014-1482)

- Errors exist related to IFrames, 'document.caretPositionFromPoint' and 'document.elementFromPoint' that could allow cross- origin information disclosure. (CVE-2014-1483)

- An error exists related to the Content Security Policy (CSP) and XSLT stylesheets that could allow unintended script execution. (CVE-2014-1485)

- A use-after-free error exists related to image handling and 'imgRequestProxy' that could allow application crashes and possibly arbitrary code execution.
(CVE-2014-1486)

- An error exists related to 'web workers' that could allow cross-origin information disclosure.
(CVE-2014-1487)

- An error exists related to 'web workers' and 'asm.js' that could allow application crashes and possibly arbitrary code execution. (CVE-2014-1488)

- An error exists that could allow webpages to access activate content from the 'about:home' page that could lead to data loss. (CVE-2014-1489)

- Network Security Services (NSS) contains a race condition in libssl that occurs during session ticket processing. A remote attacker can exploit this flaw to cause a denial of service. (CVE-2014-1490)

- Network Security Services (NSS) does not properly restrict public values in Diffie-Hellman key exchanges, allowing a remote attacker to bypass cryptographic protection mechanisms. (CVE-2014-1491)

Solution

Upgrade to Firefox 27.0 or later.

Plugin Details

Severity: Critical

ID: 72331

File Name: mozilla_firefox_27.nasl

Version: 1.11

Type: local

Agent: windows

Family: Windows

Published: 2/5/2014

Updated: 11/26/2019

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2014-1488

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Required KB Items: Mozilla/Firefox/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 2/4/2014

Vulnerability Publication Date: 2/4/2014

Reference Information

CVE: CVE-2014-1477, CVE-2014-1478, CVE-2014-1479, CVE-2014-1480, CVE-2014-1481, CVE-2014-1482, CVE-2014-1483, CVE-2014-1485, CVE-2014-1486, CVE-2014-1487, CVE-2014-1488, CVE-2014-1489, CVE-2014-1490, CVE-2014-1491

BID: 65316, 65317, 65320, 65321, 65322, 65324, 65326, 65328, 65329, 65330, 65331, 65332, 65334, 65335

Detections

Analytics