Vulnerabilities > CVE-2014-1505 - Information Exposure vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE

Summary

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.

Vulnerable Configurations

Part Description Count
Application
Mozilla
703
Application
Novell
1
OS
Canonical
3
OS
Debian
2
OS
Redhat
10
OS
Opensuse
3
OS
Suse
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2151-1.NASL
    descriptionBenoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman and Christoph Diehl discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1493) Atte Kettunen discovered an out-of-bounds read during WAV file decoding. If a user had enabled audio, an attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2014-1497) Robert O
    last seen2020-03-18
    modified2014-03-22
    plugin id73148
    published2014-03-22
    reporterUbuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73148
    titleUbuntu 12.04 LTS / 12.10 / 13.10 : thunderbird vulnerabilities (USN-2151-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-2151-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(73148);
      script_version("1.19");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2014-1493", "CVE-2014-1497", "CVE-2014-1505", "CVE-2014-1508", "CVE-2014-1509", "CVE-2014-1510", "CVE-2014-1511", "CVE-2014-1512", "CVE-2014-1513", "CVE-2014-1514");
      script_bugtraq_id(66425);
      script_xref(name:"USN", value:"2151-1");
    
      script_name(english:"Ubuntu 12.04 LTS / 12.10 / 13.10 : thunderbird vulnerabilities (USN-2151-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman,
    Dan Gohman and Christoph Diehl discovered multiple memory safety
    issues in Thunderbird. If a user were tricked in to opening a
    specially crafted message with scripting enabled, an attacker could
    potentially exploit these to cause a denial of service via application
    crash, or execute arbitrary code with the privileges of the user
    invoking Thunderbird. (CVE-2014-1493)
    
    Atte Kettunen discovered an out-of-bounds read during WAV file
    decoding. If a user had enabled audio, an attacker could potentially
    exploit this to cause a denial of service via application crash.
    (CVE-2014-1497)
    
    Robert O'Callahan discovered a mechanism for timing attacks involving
    SVG filters and displacements input to feDisplacementMap. If a user
    had enabled scripting, an attacker could potentially exploit this to
    steal confidential information across domains. (CVE-2014-1505)
    
    Tyson Smith and Jesse Schwartzentruber discovered an out-of-bounds
    read during polygon rendering in MathML. If a user had enabled
    scripting, an attacker could potentially exploit this to steal
    confidential information across domains. (CVE-2014-1508)
    
    John Thomson discovered a memory corruption bug in the Cairo graphics
    library. If a user had a malicious extension installed, an attacker
    could potentially exploit this to cause a denial of service via
    application crash, or execute arbitrary code with the privileges of
    the user invoking Thunderbird. (CVE-2014-1509)
    
    Mariusz Mlynski discovered that web content could open a chrome
    privileged page and bypass the popup blocker in some circumstances. If
    a user had enabled scripting, an attacker could potentially exploit
    this to execute arbitrary code with the privileges of the user
    invoking Thunderbird. (CVE-2014-1510, CVE-2014-1511)
    
    It was discovered that memory pressure during garbage collection
    resulted in memory corruption in some circumstances. If a user had
    enabled scripting, an attacker could potentially exploit this to cause
    a denial of service via application crash or execute arbitrary code
    with the privileges of the user invoking Thunderbird. (CVE-2014-1512)
    
    Juri Aedla discovered out-of-bounds reads and writes with
    TypedArrayObject in some circumstances. If a user had enabled
    scripting, an attacker could potentially exploit this to cause a
    denial of service via application crash or execute arbitrary code with
    the privileges of the user invoking Thunderbird. (CVE-2014-1513)
    
    George Hotz discovered an out-of-bounds write with TypedArrayObject.
    If a user had enabled scripting, an attacker could potentially exploit
    this to cause a denial of service via application crash or execute
    arbitrary code with the privileges of the user invoking Thunderbird.
    (CVE-2014-1514).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/2151-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected thunderbird package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox WebIDL Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:13.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/19");
      script_set_attribute(attribute:"patch_publication_date", value:"2014/03/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/03/22");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(12\.04|12\.10|13\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 12.10 / 13.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"12.04", pkgname:"thunderbird", pkgver:"1:24.4.0+build1-0ubuntu0.12.04.1")) flag++;
    if (ubuntu_check(osver:"12.10", pkgname:"thunderbird", pkgver:"1:24.4.0+build1-0ubuntu0.12.10.1")) flag++;
    if (ubuntu_check(osver:"13.10", pkgname:"thunderbird", pkgver:"1:24.4.0+build1-0ubuntu0.13.10.2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2014-0310.NASL
    descriptionFrom Red Hat Security Advisory 2014:0310 : Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O
    last seen2020-05-31
    modified2014-03-19
    plugin id73088
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73088
    titleOracle Linux 5 / 6 : firefox (ELSA-2014-0310)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2014-0310.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O
    last seen2020-06-01
    modified2020-06-02
    plugin id73084
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73084
    titleCentOS 5 / 6 : firefox (CESA-2014:0310)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20140318_FIREFOX_ON_SL5_X.NASL
    descriptionSeveral flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1509) After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-03-18
    modified2014-03-20
    plugin id73114
    published2014-03-20
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73114
    titleScientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20140318)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FIREFOX-201403-140320.NASL
    descriptionMozilla Firefox was updated to 24.4.0ESR release, fixing various security issues and bugs : - Mozilla developers and community identified identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2014-15) - Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, and Christoph Diehl reported memory safety problems and crashes that affect Firefox ESR 24.3 and Firefox 27. (CVE-2014-1493) - Gregor Wagner, Olli Pettay, Gary Kwong, Jesse Ruderman, Luke Wagner, Rob Fletcher, and Makoto Kato reported memory safety problems and crashes that affect Firefox 27. (CVE-2014-1494) - Security researcher Ash reported an issue where the extracted files for updates to existing files are not read only during the update process. This allows for the potential replacement or modification of these files during the update process if a malicious application is present on the local system. (MFSA 2014-16 / CVE-2014-1496) - Security researcher Atte Kettunen from OUSPG reported an out of bounds read during the decoding of WAV format audio files for playback. This could allow web content access to heap data as well as causing a crash. (MFSA 2014-17 / CVE-2014-1497) - Mozilla developer David Keeler reported that the crypto.generateCRFMRequest method did not correctly validate the key type of the KeyParams argument when generating ec-dual-use requests. This could lead to a crash and a denial of service (DOS) attack. (MFSA 2014-18 / CVE-2014-1498) - Mozilla developer Ehsan Akhgari reported a spoofing attack where the permission prompt for a WebRTC session can appear to be from a different site than its actual originating site if a timed navigation occurs during the prompt generation. This allows an attacker to potentially gain access to the webcam or microphone by masquerading as another site and gaining user permission through spoofing. (MFSA 2014-19 / CVE-2014-1499) - Security researchers Tim Philipp Schaefers and Sebastian Neef, the team of Internetwache.org, reported a mechanism using JavaScript onbeforeunload events with page navigation to prevent users from closing a malicious page
    last seen2020-06-05
    modified2014-03-22
    plugin id73147
    published2014-03-22
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73147
    titleSuSE 11.3 Security Update : MozillaFirefox (SAT Patch Number 9049)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201504-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. Workaround : There are no known workarounds at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id82632
    published2015-04-08
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82632
    titleGLSA-201504-01 : Mozilla Products: Multiple vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-0316.NASL
    descriptionAn updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O
    last seen2020-05-31
    modified2014-03-20
    plugin id73113
    published2014-03-20
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73113
    titleRHEL 5 / 6 : thunderbird (RHSA-2014:0316)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_28.NASL
    descriptionThe installed version of Firefox is a version prior to 28.0 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist that could lead to arbitrary code execution. (CVE-2014-1493, CVE-2014-1494) - An issue exists where extracted files for updates are not read-only while updating. An attacker may be able to modify these extracted files resulting in privilege escalation. (CVE-2014-1496) - An out-of-bounds read error exists when decoding WAV format audio files that could lead to a denial of service attack or information disclosure. (CVE-2014-1497) - An issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id73099
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73099
    titleFirefox < 28.0 Multiple Vulnerabilities
  • NASL familyWindows
    NASL idSEAMONKEY_2_25.NASL
    descriptionThe installed version of SeaMonkey is a version prior to 2.25 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist that could lead to arbitrary code execution. (CVE-2014-1493, CVE-2014-1494) - An issue exists where extracted files for updates are not read-only while updating. An attacker may be able to modify these extracted files resulting in privilege escalation. (CVE-2014-1496) - An out-of-bounds read error exists when decoding WAV format audio files that could lead to a denial of service attack or information disclosure. (CVE-2014-1497) - An issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id73101
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73101
    titleSeaMonkey < 2.25 Multiple Vulnerabilities
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_24_4.NASL
    descriptionThe installed version of Thunderbird is a version prior to 24.4 and is, therefore, potentially affected the following vulnerabilities: - Memory issues exist that could lead to arbitrary code execution. (CVE-2014-1493, CVE-2014-1494) - An issue exists where extracted files for updates are not read-only while updating. An attacker may be able to modify these extracted files resulting in privilege escalation. (CVE-2014-1496) - An out-of-bounds read error exists when decoding WAV format audio files that could lead to a denial of service attack or information disclosure. (CVE-2014-1497) - An out-of-bounds read error exists when polygons are rendered in
    last seen2020-06-01
    modified2020-06-02
    plugin id73100
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73100
    titleMozilla Thunderbird < 24.4 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2014-321.NASL
    descriptionMozilla Thunderbird was updated to 24.4.0. Mozilla SeaMonkey was updated to 2.25. - MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous memory safety hazards - MFSA 2014-17/CVE-2014-1497 (bmo#966311) Out of bounds read during WAV file decoding - MFSA 2014-18/CVE-2014-1498 (bmo#935618) crypto.generateCRMFRequest does not validate type of key - MFSA 2014-19/CVE-2014-1499 (bmo#961512) Spoofing attack on WebRTC permission prompt - MFSA 2014-20/CVE-2014-1500 (bmo#956524) onbeforeunload and JavaScript navigation DOS - MFSA 2014-22/CVE-2014-1502 (bmo#972622) WebGL content injection from one domain to rendering in another - MFSA 2014-23/CVE-2014-1504 (bmo#911547) Content Security Policy for data: documents not preserved by session restore - MFSA 2014-26/CVE-2014-1508 (bmo#963198) Information disclosure through polygon rendering in MathML - MFSA 2014-27/CVE-2014-1509 (bmo#966021) Memory corruption in Cairo during PDF font rendering - MFSA 2014-28/CVE-2014-1505 (bmo#941887) SVG filters information disclosure through feDisplacementMap - MFSA 2014-29/CVE-2014-1510/CVE-2014-1511 (bmo#982906, bmo#982909) Privilege escalation using WebIDL-implemented APIs - MFSA 2014-30/CVE-2014-1512 (bmo#982957) Use-after-free in TypeObject - MFSA 2014-31/CVE-2014-1513 (bmo#982974) Out-of-bounds read/write through neutering ArrayBuffer objects - MFSA 2014-32/CVE-2014-1514 (bmo#983344) Out-of-bounds write through TypedArrayObject after neutering
    last seen2020-06-05
    modified2014-06-13
    plugin id75333
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75333
    titleopenSUSE Security Update : MozillaThunderbird / seamonkey (openSUSE-SU-2014:0584-1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_24_4.NASL
    descriptionThe installed version of Thunderbird is a version prior to version 24.4. It is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist that could lead to arbitrary code execution. (CVE-2014-1493, CVE-2014-1494) - An issue exists where extracted files for updates are not read-only while updating. An attacker may be able to modify these extracted files resulting in privilege escalation. (CVE-2014-1496) - An out-of-bounds read error exists when decoding WAV format audio files that could lead to a denial of service attack or information disclosure. (CVE-2014-1497) - An out-of-bounds read error exists when polygons are rendered in
    last seen2020-06-01
    modified2020-06-02
    plugin id73097
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73097
    titleThunderbird < 24.4 Multiple Vulnerabilities (Mac OS X)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20140319_THUNDERBIRD_ON_SL5_X.NASL
    descriptionSeveral flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1509) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-03-18
    modified2014-03-20
    plugin id73116
    published2014-03-20
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73116
    titleScientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20140319)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_24_4_ESR.NASL
    descriptionThe installed version of Firefox ESR 24.x is prior to 24.4 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist that could lead to arbitrary code execution. (CVE-2014-1493, CVE-2014-1494) - A flaw exists in the checkHandshake() function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2014-1495) - An issue exists where extracted files for updates are not read-only while updating. An attacker may be able to modify these extracted files resulting in privilege escalation. (CVE-2014-1496) - An out-of-bounds read error exists when decoding WAV format audio files that could lead to a denial of service attack or information disclosure. (CVE-2014-1497) - An out-of-bounds read error exists when polygons are rendered in
    last seen2020-06-01
    modified2020-06-02
    plugin id73095
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73095
    titleFirefox ESR 24.x < 24.4 Multiple Vulnerabilities (Mac OS X)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2150-1.NASL
    descriptionBenoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Gregor Wagner, Gary Kwong, Luke Wagner, Rob Fletcher and Makoto Kato discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1493, CVE-2014-1494) Atte Kettunen discovered an out-of-bounds read during WAV file decoding. An attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2014-1497) David Keeler discovered that crypto.generateCRFMRequest did not correctly validate all arguments. An attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2014-1498) Ehsan Akhgari discovered that the WebRTC permission dialog can display the wrong originating site information under some circumstances. An attacker could potentially exploit this by tricking a user in order to gain access to their webcam or microphone. (CVE-2014-1499) Tim Philipp Schafers and Sebastian Neef discovered that onbeforeunload events used with page navigations could make the browser unresponsive in some circumstances. An attacker could potentially exploit this to cause a denial of service. (CVE-2014-1500) Jeff Gilbert discovered that WebGL content could manipulate content from another sites WebGL context. An attacker could potentially exploit this to conduct spoofing attacks. (CVE-2014-1502) Nicolas Golubovic discovered that CSP could be bypassed for data: documents during session restore. An attacker could potentially exploit this to conduct cross-site scripting attacks. (CVE-2014-1504) Robert O
    last seen2020-03-18
    modified2014-03-19
    plugin id73092
    published2014-03-19
    reporterUbuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73092
    titleUbuntu 12.04 LTS / 12.10 / 13.10 : firefox vulnerabilities (USN-2150-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2911.NASL
    descriptionMultiple security issues have been found in Icedove, Debian
    last seen2020-03-17
    modified2014-04-23
    plugin id73657
    published2014-04-23
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73657
    titleDebian DSA-2911-1 : icedove - security update
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_610DE647AF8D11E3A25BB4B52FCE4CE8.NASL
    descriptionThe Mozilla Project reports : MFSA 2014-15 Miscellaneous memory safety hazards (rv:28.0 / rv:24.4) MFSA 2014-16 Files extracted during updates are not always read only MFSA 2014-17 Out of bounds read during WAV file decoding MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key MFSA 2014-19 Spoofing attack on WebRTC permission prompt MFSA 2014-20 onbeforeunload and JavaScript navigation DOS MFSA 2014-21 Local file access via Open Link in new tab MFSA 2014-22 WebGL content injection from one domain to rendering in another MFSA 2014-23 Content Security Policy for data: documents not preserved by session restore MFSA 2014-24 Android Crash Reporter open to manipulation MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable to relative path escape MFSA 2014-26 Information disclosure through polygon rendering in MathML MFSA 2014-27 Memory corruption in Cairo during PDF font rendering MFSA 2014-28 SVG filters information disclosure through feDisplacementMap MFSA 2014-29 Privilege escalation using WebIDL-implemented APIs MFSA 2014-30 Use-after-free in TypeObject MFSA 2014-31 Out-of-bounds read/write through neutering ArrayBuffer objects MFSA 2014-32 Out-of-bounds write through TypedArrayObject after neutering
    last seen2020-06-01
    modified2020-06-02
    plugin id73111
    published2014-03-20
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73111
    titleFreeBSD : mozilla -- multiple vulnerabilities (610de647-af8d-11e3-a25b-b4b52fce4ce8)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-0310.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O
    last seen2020-05-31
    modified2014-03-19
    plugin id73090
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73090
    titleRHEL 5 / 6 : firefox (RHSA-2014:0310)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2014-256.NASL
    descriptionMozilla Firefox was updated to version 28.0, receiving enhancements, bug and security fixes. Mozilla NSPR was updated to 4.10.4 receiving enhancements, bug and security fixes. Mozilla NSS was updated to 3.15.5 receiving enhancements, bug and security fixes. Changes in MozillaFirefox : - update to Firefox 28.0 (bnc#868603) - MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous memory safety hazards - MFSA 2014-17/CVE-2014-1497 (bmo#966311) Out of bounds read during WAV file decoding - MFSA 2014-18/CVE-2014-1498 (bmo#935618) crypto.generateCRMFRequest does not validate type of key - MFSA 2014-19/CVE-2014-1499 (bmo#961512) Spoofing attack on WebRTC permission prompt - MFSA 2014-20/CVE-2014-1500 (bmo#956524) onbeforeunload and JavaScript navigation DOS - MFSA 2014-22/CVE-2014-1502 (bmo#972622) WebGL content injection from one domain to rendering in another - MFSA 2014-23/CVE-2014-1504 (bmo#911547) Content Security Policy for data: documents not preserved by session restore - MFSA 2014-26/CVE-2014-1508 (bmo#963198) Information disclosure through polygon rendering in MathML - MFSA 2014-27/CVE-2014-1509 (bmo#966021) Memory corruption in Cairo during PDF font rendering - MFSA 2014-28/CVE-2014-1505 (bmo#941887) SVG filters information disclosure through feDisplacementMap - MFSA 2014-29/CVE-2014-1510/CVE-2014-1511 (bmo#982906, bmo#982909) Privilege escalation using WebIDL-implemented APIs - MFSA 2014-30/CVE-2014-1512 (bmo#982957) Use-after-free in TypeObject - MFSA 2014-31/CVE-2014-1513 (bmo#982974) Out-of-bounds read/write through neutering ArrayBuffer objects - MFSA 2014-32/CVE-2014-1514 (bmo#983344) Out-of-bounds write through TypedArrayObject after neutering - requires NSPR 4.10.3 and NSS 3.15.5 - new build dependency (and recommends) : - libpulse - JS math correctness issue (bmo#941381) Changes in mozilla-nspr : - update to version 4.10.4 - bmo#767759: Add support for new x32 abi - bmo#844784: Thread data race in PR_EnterMonitor - bmo#939786: data race nsprpub/pr/src/pthreads/ptthread.c:137 _pt_root - bmo#958796: Users of _beginthreadex that set a custom stack size may not be getting the behavior they want - bmo#963033: AArch64 support update for NSPR - bmo#969061:&#9;Incorrect end-of-list test when iterating over a PRCList in prcountr.c and prtrace.c - bmo#971152: IPv6 detection on linux depends on availability of /proc/net/if_inet6 - update to version 4.10.3 - bmo#749849: ensure we
    last seen2020-06-05
    modified2014-06-13
    plugin id75307
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75307
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:0448-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2881.NASL
    descriptionMultiple security issues have been found in Iceweasel, Debian
    last seen2020-03-17
    modified2014-03-20
    plugin id73106
    published2014-03-20
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73106
    titleDebian DSA-2881-1 : iceweasel - security update
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2014-0316.NASL
    descriptionAn updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O
    last seen2020-05-31
    modified2014-03-20
    plugin id73105
    published2014-03-20
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73105
    titleCentOS 5 / 6 : thunderbird (CESA-2014:0316)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2014-0316.NASL
    descriptionFrom Red Hat Security Advisory 2014:0316 : An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O
    last seen2020-05-31
    modified2014-03-20
    plugin id73112
    published2014-03-20
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/73112
    titleOracle Linux 6 : thunderbird (ELSA-2014-0316)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_28.NASL
    descriptionThe installed version of Firefox is a version prior to version 28.0. It is, therefore, potentially affected by multiple vulnerabilities : - Memory issues exist that could lead to arbitrary code execution. (CVE-2014-1493, CVE-2014-1494) - An issue exists where extracted files for updates are not read-only while updating. An attacker may be able to modify these extracted files resulting in privilege escalation. (CVE-2014-1496) - An out-of-bounds read error exists when decoding WAV format audio files that could lead to a denial of service attack or information disclosure. (CVE-2014-1497) - An issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id73096
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73096
    titleFirefox < 28.0 Multiple Vulnerabilities (Mac OS X)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_24_4_ESR.NASL
    descriptionThe installed version of Firefox ESR 24.x is a version prior to 24.4. It is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist that could lead to arbitrary code execution. (CVE-2014-1493, CVE-2014-1494) - A flaw exists in the checkHandshake() function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2014-1495) - An issue exists where extracted files for updates are not read-only while updating. An attacker may be able to modify these extracted files resulting in privilege escalation. (CVE-2014-1496) - An out-of-bounds read error exists when decoding WAV format audio files that could lead to a denial of service attack or information disclosure. (CVE-2014-1497) - An out-of-bounds read error exists when polygons are rendered in
    last seen2020-06-01
    modified2020-06-02
    plugin id73098
    published2014-03-19
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73098
    titleFirefox ESR 24.x < 24.4 Multiple Vulnerabilities

Redhat

advisories
  • rhsa
    idRHSA-2014:0310
  • rhsa
    idRHSA-2014:0316
rpms
  • firefox-0:24.4.0-1.el5_10
  • firefox-0:24.4.0-1.el6_5
  • firefox-debuginfo-0:24.4.0-1.el5_10
  • firefox-debuginfo-0:24.4.0-1.el6_5
  • thunderbird-0:24.4.0-1.el5_10
  • thunderbird-0:24.4.0-1.el6_5
  • thunderbird-debuginfo-0:24.4.0-1.el5_10
  • thunderbird-debuginfo-0:24.4.0-1.el6_5

Seebug

  • bulletinFamilyexploit
    descriptionBugtraq ID:66418 CVE ID:CVE-2014-1505 Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla所发布的WEB浏览器/新闻组客户端/邮件客户端。 Mozilla Firefox 28.0之前版本, Thunderbird 24.4之前版本,SeaMonkey 2.25之前版本的SVG过滤器实现中存在安全漏洞,远程攻击者可利用此漏洞获取敏感的位移相关信息、绕过同源策略,读取不同域的文本。 0 Mozilla Firefox &lt; 28.0 目前厂商已经发布了升级补丁以修复漏洞,请下载使用: http://www.mozilla.org/security/announce/2014/mfsa2014-28.html
    idSSV:62026
    last seen2017-11-19
    modified2014-04-01
    published2014-04-01
    reporterRoot
    titleMozilla Firefox/Thunderbird/SeaMonkey信息泄露漏洞
  • bulletinFamilyexploit
    descriptionBugtraq ID:66418 CVE ID:CVE-2014-1505 Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla所发布的WEB浏览器/新闻组客户端/邮件客户端。 Mozilla Firefox 28.0之前版本, Thunderbird 24.4之前版本,SeaMonkey 2.25之前版本的SVG过滤器实现中存在安全漏洞,远程攻击者可利用此漏洞获取敏感的位移相关信息、绕过同源策略,读取不同域的文本。 0 Mozilla Firefox &lt; 28.0 目前厂商已经发布了升级补丁以修复漏洞,请下载使用: http://www.mozilla.org/security/announce/2014/mfsa2014-28.html
    idSSV:62025
    last seen2017-11-19
    modified2014-04-01
    published2014-04-01
    reporterRoot
    titleMozilla Firefox/Thunderbird/SeaMonkey安全限制绕过漏洞