Detections
Analytics
Firefox ESR 31.x < 31.3 Multiple Vulnerabilities
high Nessus Plugin ID 79664
Language:
Synopsis
The remote Windows host contains a web browser that is affected by multiple vulnerabilities.Description
The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.3. It is, therefore, affected by the following vulnerabilities :- A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER.
(CVE-2014-1569)
- Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588)
- A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash.
(CVE-2014-1590)
- A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592)
- A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution.
(CVE-2014-1593)
- A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution.
(CVE-2014-1594)
Solution
Upgrade to Firefox ESR 31.3 or later.See Also
https://www.mozilla.org/security/announce/2014/mfsa2014-83.html
https://www.mozilla.org/security/announce/2014/mfsa2014-85.html
https://www.mozilla.org/security/announce/2014/mfsa2014-87.html
https://www.mozilla.org/security/announce/2014/mfsa2014-88.html
https://www.mozilla.org/security/announce/2014/mfsa2014-89.html
Plugin Details
Severity: High
ID: 79664
File Name: mozilla_firefox_31_3_esr.nasl
Version: 1.10
Type: local
Agent: windows
Family: Windows
Published: 12/2/2014
Updated: 11/25/2019
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2014-1569
Vulnerability Information
CPE: cpe:/a:mozilla:firefox_esr
Required KB Items: Mozilla/Firefox/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 12/2/2014
Vulnerability Publication Date: 12/2/2014
Reference Information
CVE: CVE-2014-1569, CVE-2014-1587, CVE-2014-1588, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593, CVE-2014-1594