Vulnerabilities > CVE-2014-1595 - Information Management Errors vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications, which allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_FIREFOX_31_3_ESR.NASL description The version of Firefox ESR 31.x installed on the remote Mac OS X host is prior to 31.3. It is, therefore, affected by the following vulnerabilities : - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with last seen 2020-06-01 modified 2020-06-02 plugin id 79661 published 2014-12-02 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79661 title Firefox ESR 31.x < 31.3 Multiple Vulnerabilities (Mac OS X) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(79661); script_version("1.7"); script_cvs_date("Date: 2019/11/25"); script_cve_id( "CVE-2014-1587", "CVE-2014-1588", "CVE-2014-1590", "CVE-2014-1592", "CVE-2014-1593", "CVE-2014-1594", "CVE-2014-1595" ); script_bugtraq_id( 71391, 71392, 71394, 71395, 71396, 71397, 71398 ); script_name(english:"Firefox ESR 31.x < 31.3 Multiple Vulnerabilities (Mac OS X)"); script_summary(english:"Checks the version of Firefox."); script_set_attribute(attribute:"synopsis", value: "The remote Mac OS X host contains a web browser that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Firefox ESR 31.x installed on the remote Mac OS X host is prior to 31.3. It is, therefore, affected by the following vulnerabilities : - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594) - An information disclosure vulnerability exists due to the CoreGraphic framework creating log files containing sensitive information in the '/tmp' directory. (CVE-2014-1595)"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-83.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-85.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-87.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-88.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-89.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-90.html"); script_set_attribute(attribute:"solution", value: "Upgrade to Firefox ESR 31.3 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-1594"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"patch_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox_esr"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("macosx_firefox_installed.nasl"); script_require_keys("MacOSX/Firefox/Installed"); exit(0); } include("mozilla_version.inc"); kb_base = "MacOSX/Firefox"; get_kb_item_or_exit(kb_base+"/Installed"); version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1); path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1); is_esr = get_kb_item(kb_base+"/is_esr"); if (isnull(is_esr)) audit(AUDIT_NOT_INST, "Mozilla Firefox ESR"); mozilla_check_version(product:'firefox', version:version, path:path, esr:TRUE, fix:'31.3', min:'31.0', severity:SECURITY_WARNING, xss:FALSE);
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_7AE618709DD24884A2F2F19BB5784D09.NASL description The Mozilla Project reports : ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer MFSA-2014-88 Buffer overflow while parsing media content MFSA-2014-87 Use-after-free during HTML5 parsing MFSA-2014-86 CSP leaks redirect data via violation reports MFSA-2014-85 XMLHttpRequest crashes with some input streams MFSA-2014-84 XBL bindings accessible via improper CSS declarations MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3) last seen 2020-06-01 modified 2020-06-02 plugin id 79707 published 2014-12-04 reporter This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79707 title FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2018 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(79707); script_version("1.14"); script_cvs_date("Date: 2018/12/19 13:21:18"); script_cve_id("CVE-2014-1569", "CVE-2014-1587", "CVE-2014-1588", "CVE-2014-1589", "CVE-2014-1590", "CVE-2014-1591", "CVE-2014-1592", "CVE-2014-1593", "CVE-2014-1594", "CVE-2014-1595"); script_name(english:"FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09)"); script_summary(english:"Checks for updated packages in pkg_info output"); script_set_attribute( attribute:"synopsis", value: "The remote FreeBSD host is missing one or more security-related updates." ); script_set_attribute( attribute:"description", value: "The Mozilla Project reports : ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer MFSA-2014-88 Buffer overflow while parsing media content MFSA-2014-87 Use-after-free during HTML5 parsing MFSA-2014-86 CSP leaks redirect data via violation reports MFSA-2014-85 XMLHttpRequest crashes with some input streams MFSA-2014-84 XBL bindings accessible via improper CSS declarations MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)" ); # https://www.mozilla.org/security/advisories/mfsa2014-83 script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-83/" ); # https://www.mozilla.org/security/advisories/mfsa2014-84 script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-84/" ); # https://www.mozilla.org/security/advisories/mfsa2014-85 script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-85/" ); # https://www.mozilla.org/security/advisories/mfsa2014-86 script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-86/" ); # https://www.mozilla.org/security/advisories/mfsa2014-87 script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-87/" ); # https://www.mozilla.org/security/advisories/mfsa2014-88 script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-88/" ); # https://www.mozilla.org/security/advisories/mfsa2014-89 script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-89/" ); # https://www.mozilla.org/security/advisories/mfsa2014-90 script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-90/" ); # https://www.mozilla.org/security/advisories/ script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/" ); # https://vuxml.freebsd.org/freebsd/7ae61870-9dd2-4884-a2f2-f19bb5784d09.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?f69da4b0" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:firefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:firefox-esr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:libxul"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-firefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-seamonkey"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-thunderbird"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:nss"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:seamonkey"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:thunderbird"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/01"); script_set_attribute(attribute:"patch_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/12/04"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"firefox<34.0,1")) flag++; if (pkg_test(save_report:TRUE, pkg:"firefox-esr<31.3.0,1")) flag++; if (pkg_test(save_report:TRUE, pkg:"linux-firefox<34.0,1")) flag++; if (pkg_test(save_report:TRUE, pkg:"linux-seamonkey<2.31")) flag++; if (pkg_test(save_report:TRUE, pkg:"linux-thunderbird<31.3.0")) flag++; if (pkg_test(save_report:TRUE, pkg:"seamonkey<2.31")) flag++; if (pkg_test(save_report:TRUE, pkg:"thunderbird<31.3.0")) flag++; if (pkg_test(save_report:TRUE, pkg:"libxul<31.3.0")) flag++; if (pkg_test(save_report:TRUE, pkg:"nss<3.17.3")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family MacOS X Local Security Checks NASL id MACOSX_FIREFOX_34.NASL description The version of Firefox installed on the remote Mac OS X host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists due to the last seen 2020-06-01 modified 2020-06-02 plugin id 79662 published 2014-12-02 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79662 title Firefox < 34.0 Multiple Vulnerabilities (Mac OS X) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(79662); script_version("1.14"); script_cvs_date("Date: 2019/11/25"); script_cve_id( "CVE-2014-1569", "CVE-2014-1587", "CVE-2014-1588", "CVE-2014-1589", "CVE-2014-1590", "CVE-2014-1591", "CVE-2014-1592", "CVE-2014-1593", "CVE-2014-1594", "CVE-2014-1595", "CVE-2014-8631", "CVE-2014-8632" ); script_bugtraq_id( 71391, 71392, 71393, 71394, 71395, 71396, 71397, 71398, 71399, 71556, 71560, 71675 ); script_name(english:"Firefox < 34.0 Multiple Vulnerabilities (Mac OS X)"); script_summary(english:"Checks the version of Firefox."); script_set_attribute(attribute:"synopsis", value: "The remote Mac OS X host contains a web browser that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Firefox installed on the remote Mac OS X host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists due to the 'XrayWrappers' filter not properly validating object properties. This allows a remote attacker to bypass security protection mechanisms to access protected objects. (CVE-2014-8631) - A security bypass vulnerability exists due to Chrome Object Wrappers (COW) being passed as native interfaces. This allows a remote attacker to access normally protected objects. (CVE-2014-8632) - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER. (CVE-2014-1569) - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A security bypass vulnerability exists due improper declaration of chrome accessible CSS primary namespaces allowing for XML Binding Language (XBL) bindings to be triggered remotely. (CVE-2014-1589) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - An information disclosure vulnerability exists due to Content Security Policy (CSP) violation reports triggered by a redirect not properly removing path information which can reveal sensitive information. Note that this only affects Firefox 33. (CVE-2014-1591) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594) - An information disclosure vulnerability exists due to the CoreGraphic framework creating log files containing sensitive information in the '/tmp' directory. (CVE-2014-1595)"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-83/"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-84/"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-85/"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-86/"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-87/"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-88/"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-89/"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-90/"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2014-91/"); script_set_attribute(attribute:"solution", value: "Upgrade to Firefox 34.0 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-1569"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"patch_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("macosx_firefox_installed.nasl"); script_require_keys("MacOSX/Firefox/Installed"); exit(0); } include("mozilla_version.inc"); kb_base = "MacOSX/Firefox"; get_kb_item_or_exit(kb_base+"/Installed"); version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1); path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1); if (get_kb_item(kb_base + '/is_esr')) exit(0, 'The Mozilla Firefox installation is in the ESR branch.'); mozilla_check_version(product:'firefox', version:version, path:path, esr:FALSE, fix:'34.0', severity:SECURITY_HOLE, xss:FALSE);
NASL family MacOS X Local Security Checks NASL id MACOSX_THUNDERBIRD_31_3.NASL description The version of Thunderbird installed on the remote Mac OS X host is a version prior to 31.3. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in last seen 2020-06-01 modified 2020-06-02 plugin id 79663 published 2014-12-02 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79663 title Mozilla Thunderbird < 31.3 Multiple Vulnerabilities (Mac OS X) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(79663); script_version("1.10"); script_cvs_date("Date: 2019/11/25"); script_cve_id( "CVE-2014-1569", "CVE-2014-1587", "CVE-2014-1588", "CVE-2014-1590", "CVE-2014-1592", "CVE-2014-1593", "CVE-2014-1594", "CVE-2014-1595" ); script_bugtraq_id( 71391, 71392, 71394, 71395, 71396, 71397, 71398, 71675 ); script_name(english:"Mozilla Thunderbird < 31.3 Multiple Vulnerabilities (Mac OS X)"); script_summary(english:"Checks the version of Thunderbird."); script_set_attribute(attribute:"synopsis", value: "The remote Mac OS X host contains a mail client that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Thunderbird installed on the remote Mac OS X host is a version prior to 31.3. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER. (CVE-2014-1569) - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594) - An information disclosure vulnerability exists due to the CoreGraphic framework creating log files containing sensitive information in the '/tmp' directory. (CVE-2014-1595)"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-83.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-85.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-87.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-88.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-89.html"); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/security/announce/2014/mfsa2014-90.html"); script_set_attribute(attribute:"solution", value: "Upgrade to Thunderbird 31.3 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-1569"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"patch_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/12/02"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("macosx_thunderbird_installed.nasl"); script_require_keys("MacOSX/Thunderbird/Installed"); exit(0); } include("mozilla_version.inc"); kb_base = "MacOSX/Thunderbird"; get_kb_item_or_exit(kb_base+"/Installed"); version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1); path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1); if (get_kb_item(kb_base + '/is_esr')) exit(0, 'The Mozilla Thunderbird install is in the ESR branch.'); mozilla_check_version(product:'thunderbird', version:version, path:path, esr:FALSE, fix:'31.3', min:'31.0', severity:SECURITY_HOLE, xss:FALSE);
NASL family SuSE Local Security Checks NASL id SUSE_11_FIREFOX-201412-141208.NASL description Mozilla Firefox has been updated to the 31.3ESR release fixing bugs and security issues. - Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2014-83 / CVE-2014-1588 / CVE-2014-1587) - Security researcher Joe Vennix from Rapid7 reported that passing a JavaScript object to XMLHttpRequest that mimics an input stream will a crash. This crash is not exploitable and can only be used for denial of service attacks. (MFSA 2014-85 / CVE-2014-1590) - Security researcher Berend-Jan Wever reported a use-after-free created by triggering the creation of a second root element while parsing HTML written to a document created with document.open(). This leads to a potentially exploitable crash. (MFSA 2014-87 / CVE-2014-1592) - Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a buffer overflow during the parsing of media content. This leads to a potentially exploitable crash. (MFSA 2014-88 / CVE-2014-1593) - Security researchers Byoungyoung Lee, Chengyu Song, and Taesoo Kim at the Georgia Tech Information Security Center (GTISC) reported a bad casting from the BasicThebesLayer to BasicContainerLayer, resulting in undefined behavior. This behavior is potentially exploitable with some compilers but no clear mechanism to trigger it through web content was identified. (MFSA 2014-89 / CVE-2014-1594) - Security researcher Kent Howard reported an Apple issue present in OS X 10.10 (Yosemite) where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X from versions 10.6 through 10.9, the CoreGraphics had this logging ability but it was turned off by default. In OS X 10.10, this logging was turned on by default for some applications that use a custom memory allocator, such as jemalloc, because of an initialization bug in the framework. This issue has been addressed in Mozilla products by explicitly turning off the framework last seen 2020-06-05 modified 2014-12-15 plugin id 80023 published 2014-12-15 reporter This script is Copyright (C) 2014-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/80023 title SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10064) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SuSE 11 update information. The text itself is # copyright (C) Novell, Inc. # if (NASL_LEVEL < 3000) exit(0); include("compat.inc"); if (description) { script_id(80023); script_version("1.5"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2014-1587", "CVE-2014-1588", "CVE-2014-1589", "CVE-2014-1590", "CVE-2014-1591", "CVE-2014-1592", "CVE-2014-1593", "CVE-2014-1594", "CVE-2014-1595"); script_name(english:"SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10064)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 11 host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Mozilla Firefox has been updated to the 31.3ESR release fixing bugs and security issues. - Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2014-83 / CVE-2014-1588 / CVE-2014-1587) - Security researcher Joe Vennix from Rapid7 reported that passing a JavaScript object to XMLHttpRequest that mimics an input stream will a crash. This crash is not exploitable and can only be used for denial of service attacks. (MFSA 2014-85 / CVE-2014-1590) - Security researcher Berend-Jan Wever reported a use-after-free created by triggering the creation of a second root element while parsing HTML written to a document created with document.open(). This leads to a potentially exploitable crash. (MFSA 2014-87 / CVE-2014-1592) - Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a buffer overflow during the parsing of media content. This leads to a potentially exploitable crash. (MFSA 2014-88 / CVE-2014-1593) - Security researchers Byoungyoung Lee, Chengyu Song, and Taesoo Kim at the Georgia Tech Information Security Center (GTISC) reported a bad casting from the BasicThebesLayer to BasicContainerLayer, resulting in undefined behavior. This behavior is potentially exploitable with some compilers but no clear mechanism to trigger it through web content was identified. (MFSA 2014-89 / CVE-2014-1594) - Security researcher Kent Howard reported an Apple issue present in OS X 10.10 (Yosemite) where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X from versions 10.6 through 10.9, the CoreGraphics had this logging ability but it was turned off by default. In OS X 10.10, this logging was turned on by default for some applications that use a custom memory allocator, such as jemalloc, because of an initialization bug in the framework. This issue has been addressed in Mozilla products by explicitly turning off the framework's logging of input events. On vulnerable systems, this issue can result in private data such as usernames, passwords, and other inputed data being saved to a log file on the local system. (MFSA 2014-90 / CVE-2014-1595)" ); script_set_attribute( attribute:"see_also", value:"http://www.mozilla.org/security/announce/2014/mfsa2014-83.html" ); script_set_attribute( attribute:"see_also", value:"http://www.mozilla.org/security/announce/2014/mfsa2014-85.html" ); script_set_attribute( attribute:"see_also", value:"http://www.mozilla.org/security/announce/2014/mfsa2014-87.html" ); script_set_attribute( attribute:"see_also", value:"http://www.mozilla.org/security/announce/2014/mfsa2014-88.html" ); script_set_attribute( attribute:"see_also", value:"http://www.mozilla.org/security/announce/2014/mfsa2014-89.html" ); script_set_attribute( attribute:"see_also", value:"http://www.mozilla.org/security/announce/2014/mfsa2014-90.html" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=908009" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1587.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1588.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1589.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1590.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1591.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1592.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1593.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1594.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2014-1595.html" ); script_set_attribute(attribute:"solution", value:"Apply SAT patch number 10064."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox-translations"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11"); script_set_attribute(attribute:"patch_publication_date", value:"2014/12/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/12/15"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11"); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu); pl = get_kb_item("Host/SuSE/patchlevel"); if (isnull(pl) || int(pl) != 3) audit(AUDIT_OS_NOT, "SuSE 11.3"); flag = 0; if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"MozillaFirefox-31.3.0esr-0.8.1")) flag++; if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"MozillaFirefox-translations-31.3.0esr-0.8.1")) flag++; if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"MozillaFirefox-31.3.0esr-0.8.1")) flag++; if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"MozillaFirefox-translations-31.3.0esr-0.8.1")) flag++; if (rpm_check(release:"SLES11", sp:3, reference:"MozillaFirefox-31.3.0esr-0.8.1")) flag++; if (rpm_check(release:"SLES11", sp:3, reference:"MozillaFirefox-translations-31.3.0esr-0.8.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family MacOS X Local Security Checks NASL id MACOSX_10_10_2.NASL description The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.2. This update contains several security-related fixes for the following components : - bash - Bluetooth - CFNetwork Cache - CommerceKit Framework - CoreGraphics - CoreSymbolication - CPU Software - FontParser - Foundation - Intel Graphics Driver - IOAcceleratorFamily - IOHIDFamily - IOKit - IOUSBFamily - Kernel - LaunchServices - libnetcore - LoginWindow - lukemftp - OpenSSL - Safari - SceneKit - Security - security_taskgate - Spotlight - SpotlightIndex - sysmond - UserAccountUpdater Note that successful exploitation of the most serious issues can result in arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 81087 published 2015-01-29 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81087 title Mac OS X 10.10.x < 10.10.2 Multiple Vulnerabilities (POODLE) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(81087); script_version("1.20"); script_cvs_date("Date: 2019/11/25"); script_cve_id( "CVE-2014-1595", "CVE-2014-3192", "CVE-2014-3566", "CVE-2014-3567", "CVE-2014-3568", "CVE-2014-4371", "CVE-2014-4389", "CVE-2014-4419", "CVE-2014-4420", "CVE-2014-4421", "CVE-2014-4460", "CVE-2014-4461", "CVE-2014-4476", "CVE-2014-4477", "CVE-2014-4479", "CVE-2014-4481", "CVE-2014-4483", "CVE-2014-4484", "CVE-2014-4485", "CVE-2014-4486", "CVE-2014-4487", "CVE-2014-4488", "CVE-2014-4489", "CVE-2014-4491", "CVE-2014-4492", "CVE-2014-4495", "CVE-2014-4498", "CVE-2014-4499", "CVE-2014-6277", "CVE-2014-7186", "CVE-2014-7187", "CVE-2014-7861", "CVE-2014-8517", "CVE-2014-8817", "CVE-2014-8819", "CVE-2014-8820", "CVE-2014-8821", "CVE-2014-8822", "CVE-2014-8823", "CVE-2014-8824", "CVE-2014-8825", "CVE-2014-8826", "CVE-2014-8827", "CVE-2014-8830", "CVE-2014-8831", "CVE-2014-8832", "CVE-2014-8833", "CVE-2014-8834", "CVE-2014-8835", "CVE-2014-8836", "CVE-2014-8837", "CVE-2014-8838", "CVE-2014-8839" ); script_bugtraq_id( 69919, 69924, 69927, 69928, 69950, 70152, 70154, 70165, 70249, 70273, 70574, 70585, 70586, 70792, 71135, 71136, 71394, 72327, 72328, 72329, 72330, 72331 ); script_xref(name:"CERT", value:"577193"); script_xref(name:"IAVA", value:"2014-A-0142"); script_xref(name:"APPLE-SA", value:"APPLE-SA-2015-01-27-4"); script_name(english:"Mac OS X 10.10.x < 10.10.2 Multiple Vulnerabilities (POODLE)"); script_summary(english:"Checks the version of Mac OS X."); script_set_attribute(attribute:"synopsis", value: "The remote host is missing a Mac OS X update that fixes multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.2. This update contains several security-related fixes for the following components : - bash - Bluetooth - CFNetwork Cache - CommerceKit Framework - CoreGraphics - CoreSymbolication - CPU Software - FontParser - Foundation - Intel Graphics Driver - IOAcceleratorFamily - IOHIDFamily - IOKit - IOUSBFamily - Kernel - LaunchServices - libnetcore - LoginWindow - lukemftp - OpenSSL - Safari - SceneKit - Security - security_taskgate - Spotlight - SpotlightIndex - sysmond - UserAccountUpdater Note that successful exploitation of the most serious issues can result in arbitrary code execution."); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/en-us/HT204244"); script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/534559"); script_set_attribute(attribute:"see_also", value:"https://www.imperialviolet.org/2014/10/14/poodle.html"); script_set_attribute(attribute:"see_also", value:"https://www.openssl.org/~bodo/ssl-poodle.pdf"); script_set_attribute(attribute:"see_also", value:"https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00"); script_set_attribute(attribute:"solution", value: "Upgrade to Mac OS X 10.10.2 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-8836"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'tnftp "savefile" Arbitrary Command Execution'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"in_the_news", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/09/17"); script_set_attribute(attribute:"patch_publication_date", value:"2015/01/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/29"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl"); script_require_ports("Host/MacOSX/Version", "Host/OS"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); os = get_kb_item("Host/MacOSX/Version"); if (!os) { os = get_kb_item_or_exit("Host/OS"); if ("Mac OS X" >!< os) audit(AUDIT_OS_NOT, "Mac OS X"); c = get_kb_item("Host/OS/Confidence"); if (c <= 70) exit(1, "Can't determine the host's OS with sufficient confidence."); } if (!os) audit(AUDIT_OS_NOT, "Mac OS X"); match = eregmatch(pattern:"Mac OS X ([0-9]+(\.[0-9]+)+)", string:os); if (isnull(match)) exit(1, "Failed to parse the Mac OS X version ('" + os + "')."); version = match[1]; if (!ereg(pattern:"^10\.10([^0-9]|$)", string:version)) audit(AUDIT_OS_NOT, "Mac OS X 10.10", "Mac OS X "+version); fixed_version = "10.10.2"; if (ver_compare(ver:version, fix:fixed_version, strict:FALSE) == -1) { if (report_verbosity > 0) { report = '\n Installed version : ' + version + '\n Fixed version : ' + fixed_version + '\n'; security_hole(port:0, extra:report); } else security_hole(0); exit(0); } else exit(0, "The host is not affected as it is running Mac OS X "+version+".");
References
- http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
- http://support.apple.com/HT204244
- http://www.mozilla.org/security/announce/2014/mfsa2014-90.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.reddit.com/r/netsec/comments/2ocxac/apple_coregraphics_framework_on_os_x_1010_is/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1092855