Vulnerabilities > CVE-2014-8641 - Unspecified vulnerability in Mozilla Firefox, Firefox ESR and Seamonkey

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
mozilla
nessus

Summary

Use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, and SeaMonkey before 2.32 allows remote attackers to execute arbitrary code via crafted track data. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>

Vulnerable Configurations

Part Description Count
Application
Mozilla
472

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201504-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. Workaround : There are no known workarounds at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id82632
    published2015-04-08
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82632
    titleGLSA-201504-01 : Mozilla Products: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201504-01.
    #
    # The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(82632);
      script_version("1.7");
      script_cvs_date("Date: 2019/08/12 17:35:38");
    
      script_cve_id("CVE-2013-1741", "CVE-2013-2566", "CVE-2013-5590", "CVE-2013-5591", "CVE-2013-5592", "CVE-2013-5593", "CVE-2013-5595", "CVE-2013-5596", "CVE-2013-5597", "CVE-2013-5598", "CVE-2013-5599", "CVE-2013-5600", "CVE-2013-5601", "CVE-2013-5602", "CVE-2013-5603", "CVE-2013-5604", "CVE-2013-5605", "CVE-2013-5606", "CVE-2013-5607", "CVE-2013-5609", "CVE-2013-5610", "CVE-2013-5612", "CVE-2013-5613", "CVE-2013-5614", "CVE-2013-5615", "CVE-2013-5616", "CVE-2013-5618", "CVE-2013-5619", "CVE-2013-6671", "CVE-2013-6672", "CVE-2013-6673", "CVE-2014-1477", "CVE-2014-1478", "CVE-2014-1479", "CVE-2014-1480", "CVE-2014-1481", "CVE-2014-1482", "CVE-2014-1483", "CVE-2014-1485", "CVE-2014-1486", "CVE-2014-1487", "CVE-2014-1488", "CVE-2014-1489", "CVE-2014-1490", "CVE-2014-1491", "CVE-2014-1492", "CVE-2014-1493", "CVE-2014-1494", "CVE-2014-1496", "CVE-2014-1497", "CVE-2014-1498", "CVE-2014-1499", "CVE-2014-1500", "CVE-2014-1502", "CVE-2014-1504", "CVE-2014-1505", "CVE-2014-1508", "CVE-2014-1509", "CVE-2014-1510", "CVE-2014-1511", "CVE-2014-1512", "CVE-2014-1513", "CVE-2014-1514", "CVE-2014-1518", "CVE-2014-1519", "CVE-2014-1520", "CVE-2014-1522", "CVE-2014-1523", "CVE-2014-1524", "CVE-2014-1525", "CVE-2014-1526", "CVE-2014-1529", "CVE-2014-1530", "CVE-2014-1531", "CVE-2014-1532", "CVE-2014-1533", "CVE-2014-1534", "CVE-2014-1536", "CVE-2014-1537", "CVE-2014-1538", "CVE-2014-1539", "CVE-2014-1540", "CVE-2014-1541", "CVE-2014-1542", "CVE-2014-1543", "CVE-2014-1544", "CVE-2014-1545", "CVE-2014-1547", "CVE-2014-1548", "CVE-2014-1549", "CVE-2014-1550", "CVE-2014-1551", "CVE-2014-1552", "CVE-2014-1553", "CVE-2014-1554", "CVE-2014-1555", "CVE-2014-1556", "CVE-2014-1557", "CVE-2014-1558", "CVE-2014-1559", "CVE-2014-1560", "CVE-2014-1561", "CVE-2014-1562", "CVE-2014-1563", "CVE-2014-1564", "CVE-2014-1565", "CVE-2014-1566", "CVE-2014-1567", "CVE-2014-1568", "CVE-2014-1574", "CVE-2014-1575", "CVE-2014-1576", "CVE-2014-1577", "CVE-2014-1578", "CVE-2014-1580", "CVE-2014-1581", "CVE-2014-1582", "CVE-2014-1583", "CVE-2014-1584", "CVE-2014-1585", "CVE-2014-1586", "CVE-2014-1587", "CVE-2014-1588", "CVE-2014-1589", "CVE-2014-1590", "CVE-2014-1591", "CVE-2014-1592", "CVE-2014-1593", "CVE-2014-1594", "CVE-2014-5369", "CVE-2014-8631", "CVE-2014-8632", "CVE-2014-8634", "CVE-2014-8635", "CVE-2014-8636", "CVE-2014-8637", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8640", "CVE-2014-8641", "CVE-2014-8642", "CVE-2015-0817", "CVE-2015-0818", "CVE-2015-0819", "CVE-2015-0820", "CVE-2015-0821", "CVE-2015-0822", "CVE-2015-0823", "CVE-2015-0824", "CVE-2015-0825", "CVE-2015-0826", "CVE-2015-0827", "CVE-2015-0828", "CVE-2015-0829", "CVE-2015-0830", "CVE-2015-0831", "CVE-2015-0832", "CVE-2015-0833", "CVE-2015-0834", "CVE-2015-0835", "CVE-2015-0836");
      script_xref(name:"GLSA", value:"201504-01");
    
      script_name(english:"GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201504-01
    (Mozilla Products: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Firefox, Thunderbird,
          and SeaMonkey. Please review the CVE identifiers referenced below for
          details.
      
    Impact :
    
        A remote attacker could entice a user to view a specially crafted web
          page or email, possibly resulting in execution of arbitrary code or a
          Denial of Service condition. Furthermore, a remote attacker may be able
          to perform Man-in-the-Middle attacks, obtain sensitive information, spoof
          the address bar, conduct clickjacking attacks, bypass security
          restrictions and protection mechanisms,  or have other unspecified
          impact.
      
    Workaround :
    
        There are no known workarounds at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201504-01"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All firefox users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-client/firefox-31.5.3'
        All firefox-bin users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-client/firefox-bin-31.5.3'
        All thunderbird users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=mail-client/thunderbird-31.5.0'
        All thunderbird-bin users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=mail-client/thunderbird-bin-31.5.0'
        All seamonkey users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-client/seamonkey-2.33.1'
        All seamonkey-bin users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-client/seamonkey-bin-2.33.1'
        All nspr users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-libs/nspr-4.10.6'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:firefox-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:nspr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:seamonkey-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:thunderbird-bin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2013/03/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/04/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/04/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-libs/nspr", unaffected:make_list("ge 4.10.6"), vulnerable:make_list("lt 4.10.6"))) flag++;
    if (qpkg_check(package:"www-client/firefox-bin", unaffected:make_list("ge 31.5.3"), vulnerable:make_list("lt 31.5.3"))) flag++;
    if (qpkg_check(package:"www-client/seamonkey", unaffected:make_list("ge 2.33.1"), vulnerable:make_list("lt 2.33.1"))) flag++;
    if (qpkg_check(package:"www-client/seamonkey-bin", unaffected:make_list("ge 2.33.1"), vulnerable:make_list("lt 2.33.1"))) flag++;
    if (qpkg_check(package:"mail-client/thunderbird-bin", unaffected:make_list("ge 31.5.0"), vulnerable:make_list("lt 31.5.0"))) flag++;
    if (qpkg_check(package:"www-client/firefox", unaffected:make_list("ge 31.5.3"), vulnerable:make_list("lt 31.5.3"))) flag++;
    if (qpkg_check(package:"mail-client/thunderbird", unaffected:make_list("ge 31.5.0"), vulnerable:make_list("lt 31.5.0"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Mozilla Products");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20150113_FIREFOX_ON_SL5_X.NASL
    descriptionSeveral flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641) It was found that the Beacon interface implementation in Firefox did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) This update also fixes the following bug : - The default dictionary for Firefox
    last seen2020-03-18
    modified2015-01-15
    plugin id80545
    published2015-01-15
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80545
    titleScientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150113)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(80545);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2014-8634", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8641");
    
      script_name(english:"Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150113)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several flaws were found in the processing of malformed web content. A
    web page containing malicious content could cause Firefox to crash or,
    potentially, execute arbitrary code with the privileges of the user
    running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641)
    
    It was found that the Beacon interface implementation in Firefox did
    not follow the Cross-Origin Resource Sharing (CORS) specification. A
    web page containing malicious content could allow a remote attacker to
    conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638)
    
    This update also fixes the following bug :
    
      - The default dictionary for Firefox's spell checker is
        now correctly set to the system's locale language.
    
    After installing the update, Firefox must be restarted for the changes
    to take effect."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1501&L=scientific-linux-errata&T=0&P=1000
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?65b14813"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:firefox-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:xulrunner-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/15");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL5", reference:"firefox-31.4.0-1.el5_11")) flag++;
    if (rpm_check(release:"SL5", reference:"firefox-debuginfo-31.4.0-1.el5_11")) flag++;
    
    if (rpm_check(release:"SL6", reference:"firefox-31.4.0-1.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"firefox-debuginfo-31.4.0-1.el6_6")) flag++;
    
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"firefox-31.4.0-1.el7_0")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"firefox-debuginfo-31.4.0-1.el7_0")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"xulrunner-31.4.0-1.el7_0")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"xulrunner-debuginfo-31.4.0-1.el7_0")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"xulrunner-devel-31.4.0-1.el7_0")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox / firefox-debuginfo / xulrunner / xulrunner-debuginfo / etc");
    }
    
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_35_0.NASL
    descriptionThe version of Firefox installed on the remote Windows host is prior to 35.0. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636) - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637) - A flaw exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id80523
    published2015-01-14
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80523
    titleFirefox < 35 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(80523);
      script_version("1.12");
      script_cvs_date("Date: 2019/11/25");
    
      script_cve_id(
        "CVE-2014-8634",
        "CVE-2014-8635",
        "CVE-2014-8636",
        "CVE-2014-8637",
        "CVE-2014-8638",
        "CVE-2014-8639",
        "CVE-2014-8640",
        "CVE-2014-8641",
        "CVE-2014-8642",
        "CVE-2014-8643"
      );
      script_bugtraq_id(
        72041,
        72042,
        72043,
        72044,
        72045,
        72046,
        72047,
        72048,
        72049,
        72050
      );
    
      script_name(english:"Firefox < 35 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Firefox.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a web browser that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Firefox installed on the remote Windows host is prior
    to 35.0. It is, therefore, affected by the following vulnerabilities :
    
      - Multiple unspecified memory safety issues exist within
        the browser engine. (CVE-2014-8634, CVE-2014-8635)
    
      - A flaw exists where DOM objects with some specific
        properties can bypass XrayWrappers. This can allow web
        content to confuse privileged code, potentially
        enabling privilege escalation. (CVE-2014-8636)
    
      - A flaw exists in the rendering of bitmap images. When
        rending a malformed bitmap image, memory may not always
        be properly initialized, which can result in a leakage
        of data to web content. (CVE-2014-8637)
    
      - A flaw exists in 'navigator.sendBeacon()' in which it
        does not follow the cross-origin resource sharing
        specification. This results in requests from
        'sendBeacon()' lacking an 'origin' header, which allows
        malicious sites to perform XSRF attacks. (CVE-2014-8638)
    
      - A flaw exists when receiving 407 Proxy Authentication
        responses with a 'set-cookie' header. This can allow
        a session-fixation attack. (CVE-2014-8639)
    
      - A flaw exists in Web Audio that cam allow a small block
        of memory to be read. (CVE-2014-8640)
    
      - A read-after-free flaw exists in WebRTC due to the way
        tracks are handled, which can result in a potentially
        exploitable crash or incorrect WebRTC behavior.
        (CVE-2014-8641)
    
      - A flaw exists where delegated Online Certificate Status
        Protocol responder certificates fail to recognize the
        id-pkix-ocsp-nocheck extension. This can result in a
        user connecting to a site with a revoked certificate.
        (CVE-2014-8642)
    
      - A flaw exists in the Gecko Media Plugin which can allow
        an attacker to break out of the sandbox. (CVE-2014-8643)");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Firefox 35.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-8641");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/01/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Firefox/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    
    port = get_kb_item("SMB/transport");
    if (!port) port = 445;
    
    installs = get_kb_list("SMB/Mozilla/Firefox/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Firefox");
    
    mozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'35', severity:SECURITY_HOLE, xss:FALSE, xsrf:TRUE);
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3127.NASL
    descriptionMultiple security issues have been found in Iceweasel, Debian
    last seen2020-03-17
    modified2015-01-15
    plugin id80528
    published2015-01-15
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80528
    titleDebian DSA-3127-1 : iceweasel - security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3127. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(80528);
      script_version("1.10");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2014-8634", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8641");
      script_bugtraq_id(72044);
      script_xref(name:"DSA", value:"3127");
    
      script_name(english:"Debian DSA-3127-1 : iceweasel - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple security issues have been found in Iceweasel, Debian's
    version of the Mozilla Firefox web browser: Multiple memory safety
    errors and implementation errors may lead to the execution of
    arbitrary code, information leaks or denial of service."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/iceweasel"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2015/dsa-3127"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the iceweasel packages.
    
    For the stable distribution (wheezy), these problems have been fixed
    in version 31.4.0esr-1~deb7u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:iceweasel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"iceweasel", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-dbg", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-dev", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ach", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-af", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-all", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-an", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ar", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-as", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ast", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-be", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-bg", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-bn-bd", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-bn-in", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-br", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-bs", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ca", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-cs", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-csb", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-cy", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-da", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-de", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-el", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-en-gb", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-en-za", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-eo", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-es-ar", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-es-cl", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-es-es", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-es-mx", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-et", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-eu", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-fa", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ff", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-fi", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-fr", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-fy-nl", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ga-ie", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-gd", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-gl", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-gu-in", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-he", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-hi-in", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-hr", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-hsb", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-hu", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-hy-am", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-id", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-is", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-it", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ja", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-kk", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-km", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-kn", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ko", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ku", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-lij", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-lt", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-lv", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-mai", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-mk", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ml", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-mr", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ms", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-nb-no", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-nl", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-nn-no", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-or", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-pa-in", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-pl", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-pt-br", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-pt-pt", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-rm", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ro", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ru", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-si", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-sk", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-sl", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-son", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-sq", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-sr", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-sv-se", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-ta", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-te", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-th", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-tr", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-uk", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-vi", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-xh", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-zh-cn", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-zh-tw", reference:"31.4.0esr-1~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"iceweasel-l10n-zu", reference:"31.4.0esr-1~deb7u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-40.NASL
    descriptionMozillaFirefox was updated to version 35.0 (bnc#910669) Notable features : - Firefox Hello with new rooms-based conversations model - Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes : - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892)
    last seen2020-06-05
    modified2015-01-20
    plugin id80843
    published2015-01-20
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80843
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2015:0077-2)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2015-40.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(80843);
      script_version("1.9");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2014-8634", "CVE-2014-8635", "CVE-2014-8636", "CVE-2014-8637", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8640", "CVE-2014-8641", "CVE-2014-8642", "CVE-2014-8643");
    
      script_name(english:"openSUSE Security Update : MozillaFirefox (openSUSE-SU-2015:0077-2)");
      script_summary(english:"Check for the openSUSE-2015-40 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "MozillaFirefox was updated to version 35.0 (bnc#910669)
    
    Notable features :
    
      - Firefox Hello with new rooms-based conversations model
    
      - Implemented HTTP Public Key Pinning Extension (for
        enhanced authentication of encrypted connections)
    
    Security fixes :
    
      - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous
        memory safety hazards
    
      - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized
        memory use during bitmap rendering
    
      - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon
        requests lack an Origin header
    
      - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie
        injection through Proxy Authenticate responses
    
      - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of
        uninitialized memory in Web Audio
    
      - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free
        in WebRTC
    
      - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only)
        Gecko Media Plugin sandbox escape
    
      - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP
        responder certificates failure with id-pkix-ocsp-nocheck
        extension
    
      - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper
        bypass through DOM objects
    
      - obsolete tracker-miner-firefox < 0.15 because it leads
        to startup crashes (bnc#908892)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=908892"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=910669"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2015-01/msg00039.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2015-01/msg00042.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected MozillaFirefox packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-branding-upstream");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-other");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/20");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.1|SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.1 / 13.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-35.0-54.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-branding-upstream-35.0-54.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-buildsymbols-35.0-54.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-debuginfo-35.0-54.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-debugsource-35.0-54.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-devel-35.0-54.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-translations-common-35.0-54.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-translations-other-35.0-54.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"MozillaFirefox-35.0-9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"MozillaFirefox-branding-upstream-35.0-9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"MozillaFirefox-buildsymbols-35.0-9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"MozillaFirefox-debuginfo-35.0-9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"MozillaFirefox-debugsource-35.0-9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"MozillaFirefox-devel-35.0-9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"MozillaFirefox-translations-common-35.0-9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"MozillaFirefox-translations-other-35.0-9.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MozillaFirefox / MozillaFirefox-branding-upstream / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-0046.NASL
    descriptionUpdated firefox packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641) It was found that the Beacon interface implementation in Firefox did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, Xiaofeng Zheng, and Mitchell Harper as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. This update also fixes the following bug : * The default dictionary for Firefox
    last seen2020-05-31
    modified2015-01-14
    plugin id80508
    published2015-01-14
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80508
    titleRHEL 5 / 6 / 7 : firefox (RHSA-2015:0046)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2015:0046. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(80508);
      script_version("1.23");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2014-8634", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8641");
      script_bugtraq_id(72044, 72046, 72047, 72049);
      script_xref(name:"RHSA", value:"2015:0046");
    
      script_name(english:"RHEL 5 / 6 / 7 : firefox (RHSA-2015:0046)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "Updated firefox packages that fix multiple security issues and one bug
    are now available for Red Hat Enterprise Linux 5, 6, and 7.
    
    Red Hat Product Security has rated this update as having Critical
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    Mozilla Firefox is an open source web browser. XULRunner provides the
    XUL Runtime environment for Mozilla Firefox.
    
    Several flaws were found in the processing of malformed web content. A
    web page containing malicious content could cause Firefox to crash or,
    potentially, execute arbitrary code with the privileges of the user
    running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641)
    
    It was found that the Beacon interface implementation in Firefox did
    not follow the Cross-Origin Resource Sharing (CORS) specification. A
    web page containing malicious content could allow a remote attacker to
    conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638)
    
    Red Hat would like to thank the Mozilla project for reporting these
    issues. Upstream acknowledges Christian Holler, Patrick McManus,
    Muneaki Nishimura, Xiaofeng Zheng, and Mitchell Harper as the original
    reporters of these issues.
    
    For technical details regarding these flaws, refer to the Mozilla
    security advisories for Firefox 31.4.0 ESR. You can find a link to the
    Mozilla advisories in the References section of this erratum.
    
    This update also fixes the following bug :
    
    * The default dictionary for Firefox's spell checker is now correctly
    set to the system's locale language. (BZ#643954, BZ#1150572)
    
    All Firefox users should upgrade to these updated packages, which
    contain Firefox version 31.4.0 ESR, which corrects these issues. After
    installing the update, Firefox must be restarted for the changes to
    take effect."
      );
      # https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?8b5eaff4"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2015:0046"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2014-8639"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2014-8638"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2014-8634"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2014-8641"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:firefox-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x / 6.x / 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2015:0046";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL5", reference:"firefox-31.4.0-1.el5_11", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL5", reference:"firefox-debuginfo-31.4.0-1.el5_11", allowmaj:TRUE)) flag++;
    
    
      if (rpm_check(release:"RHEL6", reference:"firefox-31.4.0-1.el6_6", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"firefox-debuginfo-31.4.0-1.el6_6", allowmaj:TRUE)) flag++;
    
    
      if (rpm_check(release:"RHEL7", reference:"firefox-31.4.0-1.el7_0", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"firefox-debuginfo-31.4.0-1.el7_0", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"xulrunner-31.4.0-1.el7_0")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"xulrunner-debuginfo-31.4.0-1.el7_0")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"xulrunner-devel-31.4.0-1.el7_0")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox / firefox-debuginfo / xulrunner / xulrunner-debuginfo / etc");
      }
    }
    
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_31_4_ESR.NASL
    descriptionThe version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.4. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id80522
    published2015-01-14
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80522
    titleFirefox ESR 31.x < 31.4 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(80522);
      script_version("1.9");
      script_cvs_date("Date: 2019/11/25");
    
      script_cve_id(
        "CVE-2014-8634",
        "CVE-2014-8635",
        "CVE-2014-8638",
        "CVE-2014-8639",
        "CVE-2014-8641"
      );
      script_bugtraq_id(
        72044,
        72046,
        72047,
        72049,
        72050
      );
    
      script_name(english:"Firefox ESR 31.x < 31.4 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Firefox.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a web browser that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Firefox ESR 31.x installed on the remote Windows host
    is prior to 31.4. It is, therefore, affected by the following
    vulnerabilities :
    
      - Multiple unspecified memory safety issues exist within
        the browser engine. (CVE-2014-8634, CVE-2014-8635)
    
      - A flaw exists in 'navigator.sendBeacon()' in which it
        does not follow the cross-origin resource sharing
        specification. This results in requests from
        'sendBeacon()' lacking an 'origin' header, which allows
        malicious sites to perform XSRF attacks. (CVE-2014-8638)
    
      - A flaw exists when receiving 407 Proxy Authentication
        responses with a 'set-cookie' header. This can allow
        a session-fixation attack. (CVE-2014-8639)
    
      - A read-after-free flaw exists in WebRTC due to the way
        tracks are handled, which can result in a potentially
        exploitable crash or incorrect WebRTC behavior.
        (CVE-2014-8641)");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Firefox ESR 31.4 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-8641");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/01/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox_esr");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Firefox/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    
    port = get_kb_item("SMB/transport");
    if (!port) port = 445;
    
    installs = get_kb_list("SMB/Mozilla/Firefox/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Firefox");
    
    mozilla_check_version(installs:installs, product:'firefox', esr:TRUE, fix:'31.4', min:'31.0', severity:SECURITY_HOLE, xss:FALSE, xsrf:TRUE);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2458-3.NASL
    descriptionUSN-2458-1 fixed vulnerabilities in Firefox. This update introduced a regression which could make websites that use CSP fail to load under some circumstances. This update fixes the problem. We apologize for the inconvenience. Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8634, CVE-2014-8635) Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-8636) Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a canvas element. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to steal confidential information. (CVE-2014-8637) Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638) Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2014-8639) Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-8640) Mitchell Harper discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8641) Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with a revoked certificate. (CVE-2014-8642). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id81041
    published2015-01-28
    reporterUbuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81041
    titleUbuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox regression (USN-2458-3)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-2458-3. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81041);
      script_version("1.13");
      script_cvs_date("Date: 2019/09/19 12:54:31");
    
      script_cve_id("CVE-2014-8634", "CVE-2014-8635", "CVE-2014-8636", "CVE-2014-8637", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8640", "CVE-2014-8641", "CVE-2014-8642");
      script_bugtraq_id(72041, 72042, 72044, 72045, 72046, 72047, 72048, 72049, 72050);
      script_xref(name:"USN", value:"2458-3");
    
      script_name(english:"Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox regression (USN-2458-3)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "USN-2458-1 fixed vulnerabilities in Firefox. This update introduced a
    regression which could make websites that use CSP fail to load under
    some circumstances. This update fixes the problem.
    
    We apologize for the inconvenience.
    
    Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse
    Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered
    multiple memory safety issues in Firefox. If a user were tricked in to
    opening a specially crafted website, an attacker could potentially
    exploit these to cause a denial of service via application crash, or
    execute arbitrary code with the privileges of the user invoking
    Firefox. (CVE-2014-8634, CVE-2014-8635)
    
    Bobby Holley discovered that some DOM objects with certain
    properties can bypass XrayWrappers in some circumstances. If
    a user were tricked in to opening a specially crafted
    website, an attacker could potentially exploit this to
    bypass security restrictions. (CVE-2014-8636)
    
    Michal Zalewski discovered a use of uninitialized memory
    when rendering malformed bitmap images on a canvas element.
    If a user were tricked in to opening a specially crafted
    website, an attacker could potentially exploit this to steal
    confidential information. (CVE-2014-8637)
    
    Muneaki Nishimura discovered that requests from
    navigator.sendBeacon() lack an origin header. If a user were
    tricked in to opening a specially crafted website, an
    attacker could potentially exploit this to conduct
    cross-site request forgery (XSRF) attacks. (CVE-2014-8638)
    
    Xiaofeng Zheng discovered that a web proxy returning a 407
    response could inject cookies in to the originally requested
    domain. If a user connected to a malicious web proxy, an
    attacker could potentially exploit this to conduct
    session-fixation attacks. (CVE-2014-8639)
    
    Holger Fuhrmannek discovered a crash in Web Audio while
    manipulating timelines. If a user were tricked in to opening
    a specially crafted website, an attacker could potentially
    exploit this to cause a denial of service. (CVE-2014-8640)
    
    Mitchell Harper discovered a use-after-free in WebRTC. If a
    user were tricked in to opening a specially crafted website,
    an attacker could potentially exploit this to cause a denial
    of service via application crash, or execute arbitrary code
    with the privileges of the user invoking Firefox.
    (CVE-2014-8641)
    
    Brian Smith discovered that OCSP responses would fail to
    verify if signed by a delegated OCSP responder certificate
    with the id-pkix-ocsp-nocheck extension, potentially
    allowing a user to connect to a site with a revoked
    certificate. (CVE-2014-8642).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/2458-3/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected firefox package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/28");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(12\.04|14\.04|14\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 14.04 / 14.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"12.04", pkgname:"firefox", pkgver:"35.0.1+build1-0ubuntu0.12.04.1")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"firefox", pkgver:"35.0.1+build1-0ubuntu0.14.04.1")) flag++;
    if (ubuntu_check(osver:"14.10", pkgname:"firefox", pkgver:"35.0.1+build1-0ubuntu0.14.10.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-0046.NASL
    descriptionUpdated firefox packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641) It was found that the Beacon interface implementation in Firefox did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, Xiaofeng Zheng, and Mitchell Harper as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. This update also fixes the following bug : * The default dictionary for Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id80526
    published2015-01-15
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80526
    titleCentOS 5 / 6 / 7 : firefox / xulrunner (CESA-2015:0046)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2015:0046 and 
    # CentOS Errata and Security Advisory 2015:0046 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(80526);
      script_version("1.18");
      script_cvs_date("Date: 2020/02/18");
    
      script_cve_id("CVE-2014-8634", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8641");
      script_bugtraq_id(72044, 72046, 72047, 72049);
      script_xref(name:"RHSA", value:"2015:0046");
    
      script_name(english:"CentOS 5 / 6 / 7 : firefox / xulrunner (CESA-2015:0046)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated firefox packages that fix multiple security issues and one bug
    are now available for Red Hat Enterprise Linux 5, 6, and 7.
    
    Red Hat Product Security has rated this update as having Critical
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    Mozilla Firefox is an open source web browser. XULRunner provides the
    XUL Runtime environment for Mozilla Firefox.
    
    Several flaws were found in the processing of malformed web content. A
    web page containing malicious content could cause Firefox to crash or,
    potentially, execute arbitrary code with the privileges of the user
    running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641)
    
    It was found that the Beacon interface implementation in Firefox did
    not follow the Cross-Origin Resource Sharing (CORS) specification. A
    web page containing malicious content could allow a remote attacker to
    conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638)
    
    Red Hat would like to thank the Mozilla project for reporting these
    issues. Upstream acknowledges Christian Holler, Patrick McManus,
    Muneaki Nishimura, Xiaofeng Zheng, and Mitchell Harper as the original
    reporters of these issues.
    
    For technical details regarding these flaws, refer to the Mozilla
    security advisories for Firefox 31.4.0 ESR. You can find a link to the
    Mozilla advisories in the References section of this erratum.
    
    This update also fixes the following bug :
    
    * The default dictionary for Firefox's spell checker is now correctly
    set to the system's locale language. (BZ#643954, BZ#1150572)
    
    All Firefox users should upgrade to these updated packages, which
    contain Firefox version 31.4.0 ESR, which corrects these issues. After
    installing the update, Firefox must be restarted for the changes to
    take effect."
      );
      # https://lists.centos.org/pipermail/centos-announce/2015-January/020873.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4eefc3a1"
      );
      # https://lists.centos.org/pipermail/centos-announce/2015-January/020875.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?c6664375"
      );
      # https://lists.centos.org/pipermail/centos-announce/2015-January/020876.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?191ba3f2"
      );
      # https://lists.centos.org/pipermail/centos-announce/2015-January/020877.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?62a34e7e"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected firefox and / or xulrunner packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-8634");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/15");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x / 6.x / 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-5", reference:"firefox-31.4.0-1.el5.centos", allowmaj:TRUE)) flag++;
    
    if (rpm_check(release:"CentOS-6", reference:"firefox-31.4.0-1.el6.centos", allowmaj:TRUE)) flag++;
    
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"firefox-31.4.0-1.el7.centos", allowmaj:TRUE)) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"xulrunner-31.4.0-1.el7.centos", allowmaj:TRUE)) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"xulrunner-devel-31.4.0-1.el7.centos", allowmaj:TRUE)) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox / xulrunner / xulrunner-devel");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-0171-1.NASL
    descriptionMozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/ Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id83676
    published2015-05-20
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83676
    titleSUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2015:0171-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2015:0171-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(83676);
      script_version("2.11");
      script_cvs_date("Date: 2019/09/11 11:22:11");
    
      script_cve_id("CVE-2014-1569", "CVE-2014-8634", "CVE-2014-8636", "CVE-2014-8637", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8640", "CVE-2014-8641");
      script_bugtraq_id(71675, 72041, 72044, 72045, 72046, 72047, 72048, 72049);
    
      script_name(english:"SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2015:0171-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs
    and security issues.
    
    Mozilla NSS has been updated to 3.17.3, fixing a security issue and
    updating the root certificate list.
    
    For more information, please see
    https://www.mozilla.org/en-US/security/advisories/
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=909563"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=910647"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=910669"
      );
      # https://download.suse.com/patch/finder/?keywords=b6b2353659cdca6dc3d8d5d591e00851
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?8ad6a431"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-1569/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8634/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8636/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8637/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8638/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8639/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8640/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8641/"
      );
      # https://www.suse.com/support/update/announcement/2015/suse-su-20150171-1.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?51e5995f"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected Mozilla Firefox packages"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:MozillaFirefox-translations");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mozilla-nss-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mozilla-nss-tools");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLES10)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES10", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES10" && (! preg(pattern:"^(4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES10 SP4", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES10", sp:"4", cpu:"x86_64", reference:"mozilla-nss-32bit-3.17.3-0.5.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", cpu:"s390x", reference:"mozilla-nss-32bit-3.17.3-0.5.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"mozilla-nss-3.17.3-0.5.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"mozilla-nss-devel-3.17.3-0.5.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"mozilla-nss-tools-3.17.3-0.5.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"MozillaFirefox-31.4.0esr-0.5.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"MozillaFirefox-translations-31.4.0esr-0.5.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Mozilla Firefox");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2458-1.NASL
    descriptionChristian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8634, CVE-2014-8635) Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-8636) Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a canvas element. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to steal confidential information. (CVE-2014-8637) Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638) Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2014-8639) Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-8640) Mitchell Harper discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8641) Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with a revoked certificate. (CVE-2014-8642). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id80548
    published2015-01-15
    reporterUbuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80548
    titleUbuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox vulnerabilities (USN-2458-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-2458-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(80548);
      script_version("1.18");
      script_cvs_date("Date: 2019/09/19 12:54:31");
    
      script_cve_id("CVE-2014-8634", "CVE-2014-8635", "CVE-2014-8636", "CVE-2014-8637", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8640", "CVE-2014-8641", "CVE-2014-8642");
      script_bugtraq_id(72041, 72042, 72044, 72045, 72046, 72047, 72048, 72049, 72050);
      script_xref(name:"USN", value:"2458-1");
    
      script_name(english:"Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox vulnerabilities (USN-2458-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse
    Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered
    multiple memory safety issues in Firefox. If a user were tricked in to
    opening a specially crafted website, an attacker could potentially
    exploit these to cause a denial of service via application crash, or
    execute arbitrary code with the privileges of the user invoking
    Firefox. (CVE-2014-8634, CVE-2014-8635)
    
    Bobby Holley discovered that some DOM objects with certain properties
    can bypass XrayWrappers in some circumstances. If a user were tricked
    in to opening a specially crafted website, an attacker could
    potentially exploit this to bypass security restrictions.
    (CVE-2014-8636)
    
    Michal Zalewski discovered a use of uninitialized memory when
    rendering malformed bitmap images on a canvas element. If a user were
    tricked in to opening a specially crafted website, an attacker could
    potentially exploit this to steal confidential information.
    (CVE-2014-8637)
    
    Muneaki Nishimura discovered that requests from navigator.sendBeacon()
    lack an origin header. If a user were tricked in to opening a
    specially crafted website, an attacker could potentially exploit this
    to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638)
    
    Xiaofeng Zheng discovered that a web proxy returning a 407 response
    could inject cookies in to the originally requested domain. If a user
    connected to a malicious web proxy, an attacker could potentially
    exploit this to conduct session-fixation attacks. (CVE-2014-8639)
    
    Holger Fuhrmannek discovered a crash in Web Audio while manipulating
    timelines. If a user were tricked in to opening a specially crafted
    website, an attacker could potentially exploit this to cause a denial
    of service. (CVE-2014-8640)
    
    Mitchell Harper discovered a use-after-free in WebRTC. If a user were
    tricked in to opening a specially crafted website, an attacker could
    potentially exploit this to cause a denial of service via application
    crash, or execute arbitrary code with the privileges of the user
    invoking Firefox. (CVE-2014-8641)
    
    Brian Smith discovered that OCSP responses would fail to verify if
    signed by a delegated OCSP responder certificate with the
    id-pkix-ocsp-nocheck extension, potentially allowing a user to connect
    to a site with a revoked certificate. (CVE-2014-8642).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/2458-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected firefox package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/15");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(12\.04|14\.04|14\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 14.04 / 14.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"12.04", pkgname:"firefox", pkgver:"35.0+build3-0ubuntu0.12.04.2")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"firefox", pkgver:"35.0+build3-0ubuntu0.14.04.2")) flag++;
    if (ubuntu_check(osver:"14.10", pkgname:"firefox", pkgver:"35.0+build3-0ubuntu0.14.10.2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FIREFOX-201501-150126.NASL
    descriptionMozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/
    last seen2020-06-01
    modified2020-06-02
    plugin id81122
    published2015-02-02
    reporterThis script is Copyright (C) 2015-2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/81122
    titleSuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81122);
      script_version("$Revision: 1.6 $");
      script_cvs_date("$Date: 2016/08/22 14:13:37 $");
    
      script_cve_id("CVE-2014-1569", "CVE-2014-8634", "CVE-2014-8636", "CVE-2014-8637", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8640", "CVE-2014-8641");
    
      script_name(english:"SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs
    and security issues.
    
    Mozilla NSS has been updated to 3.17.3, fixing a security issue and
    updating the root certificate list.
    
    For more information, please see
    https://www.mozilla.org/en-US/security/advisories/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=910647"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=910669"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=913064"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=913066"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=913067"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=913068"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=913102"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=913103"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=913104"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-1569.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-8634.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-8636.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-8637.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-8638.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-8639.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-8640.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-8641.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 10225.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox-translations");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libfreebl3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libfreebl3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libsoftokn3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libsoftokn3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss-tools");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/02/02");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 3) audit(AUDIT_OS_NOT, "SuSE 11.3");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"MozillaFirefox-31.4.0esr-0.8.7")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"MozillaFirefox-translations-31.4.0esr-0.8.7")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"libfreebl3-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"libsoftokn3-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"mozilla-nss-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"mozilla-nss-tools-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"MozillaFirefox-31.4.0esr-0.8.7")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"MozillaFirefox-translations-31.4.0esr-0.8.7")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"libfreebl3-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"libfreebl3-32bit-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"libsoftokn3-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"libsoftokn3-32bit-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"mozilla-nss-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"mozilla-nss-32bit-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"mozilla-nss-tools-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"i586", reference:"MozillaFirefox-31.4.0esr-0.8.7")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"i586", reference:"MozillaFirefox-translations-31.4.0esr-0.8.7")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"i586", reference:"libfreebl3-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"i586", reference:"libsoftokn3-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"i586", reference:"mozilla-nss-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"i586", reference:"mozilla-nss-tools-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"MozillaFirefox-31.4.0esr-0.8.7")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"MozillaFirefox-translations-31.4.0esr-0.8.7")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"libfreebl3-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"libfreebl3-32bit-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"libsoftokn3-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"libsoftokn3-32bit-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"mozilla-nss-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"mozilla-nss-32bit-3.17.3-0.8.11")) flag++;
    if (rpm_check(release:"SLES11", sp:3, cpu:"x86_64", reference:"mozilla-nss-tools-3.17.3-0.8.11")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-92.NASL
    descriptionMozilla seamonkey was updated to SeaMonkey 2.32 (bnc#910669) - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - use GStreamer 1.0 from 13.2 on
    last seen2020-06-05
    modified2015-02-03
    plugin id81142
    published2015-02-03
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81142
    titleopenSUSE Security Update : seamonkey (openSUSE-SU-2015:0192-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2015-92.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81142);
      script_version("1.9");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2014-8634", "CVE-2014-8635", "CVE-2014-8636", "CVE-2014-8637", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8640", "CVE-2014-8641", "CVE-2014-8642", "CVE-2014-8643");
    
      script_name(english:"openSUSE Security Update : seamonkey (openSUSE-SU-2015:0192-1)");
      script_summary(english:"Check for the openSUSE-2015-92 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla seamonkey was updated to SeaMonkey 2.32 (bnc#910669)
    
      - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous
        memory safety hazards
    
      - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized
        memory use during bitmap rendering
    
      - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon
        requests lack an Origin header
    
      - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie
        injection through Proxy Authenticate responses
    
      - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of
        uninitialized memory in Web Audio
    
      - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free
        in WebRTC
    
      - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only)
        Gecko Media Plugin sandbox escape
    
      - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP
        responder certificates failure with id-pkix-ocsp-nocheck
        extension
    
      - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper
        bypass through DOM objects
    
      - use GStreamer 1.0 from 13.2 on"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=910669"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2015-02/msg00008.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected seamonkey packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-dom-inspector");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-irc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-translations-other");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/02/03");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.1|SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.1 / 13.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.1", reference:"seamonkey-2.32-44.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"seamonkey-debuginfo-2.32-44.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"seamonkey-debugsource-2.32-44.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"seamonkey-dom-inspector-2.32-44.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"seamonkey-irc-2.32-44.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"seamonkey-translations-common-2.32-44.2") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"seamonkey-translations-other-2.32-44.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"seamonkey-2.32-8.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"seamonkey-debuginfo-2.32-8.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"seamonkey-debugsource-2.32-8.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"seamonkey-dom-inspector-2.32-8.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"seamonkey-irc-2.32-8.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"seamonkey-translations-common-2.32-8.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"seamonkey-translations-other-2.32-8.2") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "seamonkey / seamonkey-debuginfo / seamonkey-debugsource / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-0173-1.NASL
    descriptionMozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificates list. For more information, please refer to https://www.mozilla.org/en-US/security/advisories/ . Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id83677
    published2015-05-20
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83677
    titleSUSE SLES11 Security Update : Mozilla Firefox (SUSE-SU-2015:0173-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2015:0173-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(83677);
      script_version("2.11");
      script_cvs_date("Date: 2019/09/11 11:22:11");
    
      script_cve_id("CVE-2014-1569", "CVE-2014-8634", "CVE-2014-8636", "CVE-2014-8637", "CVE-2014-8638", "CVE-2014-8639", "CVE-2014-8640", "CVE-2014-8641");
      script_bugtraq_id(71675, 72041, 72044, 72045, 72046, 72047, 72048, 72049);
    
      script_name(english:"SUSE SLES11 Security Update : Mozilla Firefox (SUSE-SU-2015:0173-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs
    and security issues.
    
    Mozilla NSS has been updated to 3.17.3, fixing a security issue and
    updating the root certificates list.
    
    For more information, please refer to
    https://www.mozilla.org/en-US/security/advisories/ .
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=906111"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=909563"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=910647"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=910669"
      );
      # https://download.suse.com/patch/finder/?keywords=962d0b7b7ca9d1110cf2d237780cdab1
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?42f36f07"
      );
      # https://download.suse.com/patch/finder/?keywords=f7933e6a871816421d62da119130434e
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?3bb7c027"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-1569/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8634/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8636/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8637/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8638/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8639/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8640/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8641/"
      );
      # https://www.suse.com/support/update/announcement/2015/suse-su-20150173-1.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?dea0d08a"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Server 11 SP2 LTSS :
    
    zypper in -t patch slessp2-firefox-201501-10167
    
    SUSE Linux Enterprise Server 11 SP1 LTSS :
    
    zypper in -t patch slessp1-firefox-201501-10168
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox Proxy Prototype Privileged Javascript Injection');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:MozillaFirefox-translations");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libfreebl3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mozilla-nss-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mozilla-nss-tools");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/01/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLES11)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES11", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES11" && (! preg(pattern:"^(1|2)$", string:sp))) audit(AUDIT_OS_NOT, "SLES11 SP1/2", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES11", sp:"1", cpu:"x86_64", reference:"libfreebl3-32bit-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"1", cpu:"x86_64", reference:"mozilla-nss-32bit-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"1", cpu:"s390x", reference:"libfreebl3-32bit-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"1", cpu:"s390x", reference:"mozilla-nss-32bit-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"1", reference:"MozillaFirefox-31.4.0esr-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"1", reference:"MozillaFirefox-translations-31.4.0esr-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"1", reference:"libfreebl3-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"1", reference:"mozilla-nss-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"1", reference:"mozilla-nss-tools-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", cpu:"x86_64", reference:"libfreebl3-32bit-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", cpu:"x86_64", reference:"mozilla-nss-32bit-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", cpu:"s390x", reference:"libfreebl3-32bit-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", cpu:"s390x", reference:"mozilla-nss-32bit-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", reference:"MozillaFirefox-31.4.0esr-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", reference:"MozillaFirefox-translations-31.4.0esr-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", reference:"libfreebl3-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", reference:"mozilla-nss-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", reference:"mozilla-nss-devel-3.17.3-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"2", reference:"mozilla-nss-tools-3.17.3-0.3.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Mozilla Firefox");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-0076-1.NASL
    descriptionThis update fixes the following security issues in MozillaFirefox : - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 (bmo#1109889, bmo#1111737, bmo#1026774, bmo#1027300, bmo#1054538, bmo#1067473, bmo#1070962, bmo#1072130, bmo#1072871, bmo#1098583) Miscellaneous memory safety hazards (rv:35.0 / rv:31.4) - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC Also Mozilla NSS was updated to 3.17.3 to fix : - The QuickDER decoder now decodes lengths robustly (bmo#1064670/CVE-2014-1569) - Support for TLS_FALLBACK_SCSV has been added to the ssltap and tstclnt utilities - Changes in CA certificates Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id83666
    published2015-05-20
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83666
    titleSUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0076-1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_35.NASL
    descriptionThe version of Firefox installed on the remote Mac OS X host is prior to 35.0. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636) - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637) - A flaw exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id80520
    published2015-01-14
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80520
    titleFirefox < 35.0 Multiple Vulnerabilities (Mac OS X)
  • NASL familyWindows
    NASL idSEAMONKEY_2_32.NASL
    descriptionThe version of SeaMonkey installed on the remote host is prior to 2.32. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636) - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637) - A flaw exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id80525
    published2015-01-14
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80525
    titleSeaMonkey < 2.32 Vulnerability
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2458-2.NASL
    descriptionUSN-2458-1 fixed vulnerabilities in Firefox. This update provides the corresponding version of Ubufox. Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8634, CVE-2014-8635) Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-8636) Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a canvas element. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to steal confidential information. (CVE-2014-8637) Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638) Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2014-8639) Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-8640) Mitchell Harper discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8641) Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with a revoked certificate. (CVE-2014-8642). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id80549
    published2015-01-15
    reporterUbuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80549
    titleUbuntu 12.04 LTS / 14.04 LTS / 14.10 : ubufox update (USN-2458-2)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_BD62C6409BB911E4A5AD000C297FB80F.NASL
    descriptionThe Mozilla Project reports : MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4) MFSA-2015-02 Uninitialized memory use during bitmap rendering MFSA-2015-03 sendBeacon requests lack an Origin header MFSA-2015-04 Cookie injection through Proxy Authenticate responses MFSA-2015-05 Read of uninitialized memory in Web Audio MFSA-2015-06 Read-after-free in WebRTC MFSA-2015-07 Gecko Media Plugin sandbox escape MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension MFSA-2015-09 XrayWrapper bypass through DOM objects
    last seen2020-06-01
    modified2020-06-02
    plugin id80538
    published2015-01-15
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80538
    titleFreeBSD : mozilla -- multiple vulnerabilities (bd62c640-9bb9-11e4-a5ad-000c297fb80f)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FIREFOX-201501-150127.NASL
    descriptionMozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/
    last seen2020-06-01
    modified2020-06-02
    plugin id81123
    published2015-02-02
    reporterThis script is Copyright (C) 2015-2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/81123
    titleSuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_31_4_ESR.NASL
    descriptionThe version of Firefox ESR 31.x installed on the remote Mac OS X host is prior to 31.4. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id80519
    published2015-01-14
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80519
    titleFirefox ESR 31.x < 31.4 Multiple Vulnerabilities (Mac OS X)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-0046.NASL
    descriptionFrom Red Hat Security Advisory 2015:0046 : Updated firefox packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641) It was found that the Beacon interface implementation in Firefox did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, Xiaofeng Zheng, and Mitchell Harper as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. This update also fixes the following bug : * The default dictionary for Firefox
    last seen2020-05-31
    modified2015-01-14
    plugin id80503
    published2015-01-14
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80503
    titleOracle Linux 5 / 6 / 7 : firefox (ELSA-2015-0046)

Redhat

advisories
bugzilla
id1180973
titleCVE-2014-8641 Mozilla: Read-after-free in WebRTC (MFSA 2015-06)
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 5 is installed
      ovaloval:com.redhat.rhba:tst:20070331005
    • commentfirefox is earlier than 0:31.4.0-1.el5_11
      ovaloval:com.redhat.rhsa:tst:20150046001
    • commentfirefox is signed with Red Hat redhatrelease key
      ovaloval:com.redhat.rhsa:tst:20070097008
  • AND
    • commentRed Hat Enterprise Linux 6 is installed
      ovaloval:com.redhat.rhba:tst:20111656003
    • commentfirefox is earlier than 0:31.4.0-1.el6_6
      ovaloval:com.redhat.rhsa:tst:20150046004
    • commentfirefox is signed with Red Hat redhatrelease2 key
      ovaloval:com.redhat.rhsa:tst:20100861006
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentxulrunner-devel is earlier than 0:31.4.0-1.el7_0
          ovaloval:com.redhat.rhsa:tst:20150046007
        • commentxulrunner-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100861004
      • AND
        • commentxulrunner is earlier than 0:31.4.0-1.el7_0
          ovaloval:com.redhat.rhsa:tst:20150046009
        • commentxulrunner is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100861002
      • AND
        • commentfirefox is earlier than 0:31.4.0-1.el7_0
          ovaloval:com.redhat.rhsa:tst:20150046011
        • commentfirefox is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100861006
rhsa
idRHSA-2015:0046
released2015-01-13
severityCritical
titleRHSA-2015:0046: firefox security and bug fix update (Critical)
rpms
  • firefox-0:31.4.0-1.el5_11
  • firefox-0:31.4.0-1.el6_6
  • firefox-0:31.4.0-1.el7_0
  • firefox-debuginfo-0:31.4.0-1.el5_11
  • firefox-debuginfo-0:31.4.0-1.el6_6
  • firefox-debuginfo-0:31.4.0-1.el7_0
  • xulrunner-0:31.4.0-1.el7_0
  • xulrunner-debuginfo-0:31.4.0-1.el7_0
  • xulrunner-devel-0:31.4.0-1.el7_0