MozillaThunderbird 已更新至 Thunderbird 31.4.0 版 (bnc#910669)

- MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 其他記憶體安全危險

- MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon 要求缺少 Origin 標頭

- MFSA 2015-04/CVE-2014-8639 (bmo#1095859) 透過 Proxy 驗證回應的 Cookie 插入

遠端 Mac OS X 主機上安裝的 Firefox 版本比 35.0 版舊。因此受到以下弱點影響：

- 瀏覽器引擎中存在多個不明記憶體安全性問題。(CVE-2014-8634、CVE-2014-8635)

- 存在一個瑕疵，會導致含有部分特定內容的 DOM 物件可繞過 XrayWrapper。這可能允許 web 內容混淆具權限的程式碼，可能導致權限提升。(CVE-2014-8636)

- 在點陣圖影像轉譯過程中存在一個瑕疵。轉譯格式錯誤的點陣圖影像時，系統不一定會正確初始化記憶體，可能會導致將資料洩漏到 web 內容。(CVE-2014-8637)

- 在「navigator.sendBeacon()」中存在一個瑕疵，其會造成不遵循跨來源資源共用規格。這會導致來自「sendBeacon()」的要求缺少「原始」標頭，進而造成惡意網站發動 XSRF 攻擊。(CVE-2014-8638)

- 收到含有「et-cookie」標頭的 407 Proxy 驗證回應時存在一個瑕疵。這可能允許工作階段固定攻擊。(CVE-2014-8639)

- 在 Web Audio 中存在一個瑕疵，會導致 cam 允許讀取記憶體的小區塊。(CVE-2014-8640)

- WebRTC 中存在一個釋放後讀取瑕疵，這是因為處理追蹤的方式所導致，該瑕疵可能會導致遭惡意利用而當機或錯誤的 WebRTC 行為。
 (CVE-2014-8641)

- 存在一個瑕疵，會導致委派的線上憑證狀態通訊協定回應程式憑證無法識別 id-pkix-ocsp-nocheck 延伸模組。這可能導致使用者連線至具有已撤銷憑證的網站。
 (CVE-2014-8642)

遠端主機受到 GLSA-201504-01 中所述的弱點影響 (Mozilla 產品：多個弱點)

    在 Firefox、Thunderbird 和 SeaMonkey 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    遠端攻擊者可能引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者還可能發動攔截式攻擊、取得敏感資訊、偽造位址列、發動點擊劫持攻擊、繞過安全性限制和保護機制，或造成其他不明影響。
  因應措施：

    目前尚無任何已知的因應措施。

远程 Mac OS X 主机上安装的 Firefox 版本低于 35.0。因此，它受到以下漏洞的影响：

- 浏览器引擎中存在多种不明内存安全问题。（CVE-2014-8634、CVE-2014-8635）

- 具有某些特定属性且可绕过 XrayWrapper 的 DOM 对象存在缺陷。这可允许 Web 内容混淆特权代码，从而实现权限升级。(CVE-2014-8636)

- 对位图图像的渲染中存在缺陷。渲染畸形的位图图像时，内存可能无法始终得到正确的初始化，这可将数据泄漏到 Web 内容。(CVE-2014-8637)

-“navigator.sendBeacon()”中存在不遵守跨源资源共享规范的缺陷。这可导致来自“sendBeacon()”的请求缺少“origin”标头，从而允许恶意站点执行 XSRF 攻击。(CVE-2014-8638)

- 接收包含“set-cookie”标头的 407 代理认证响应时存在缺陷。这可允许会话固定攻击。(CVE-2014-8639)

- Web 音频中存在可允许读取小块内存的缺陷。(CVE-2014-8640)

- WebRTC 中存在因处理跟踪的方式造成的释放后读取缺陷，该缺陷可导致潜在的可利用崩溃或错误的 WebRTC 行为。
 (CVE-2014-8641)

- 存在委托的在线证书状态协议响应器证书无法识别 id-pkix-ocsp-nocheck 扩展的缺陷。这可导致用户通过已撤销的证书连接到站点。
 (CVE-2014-8642)

MozillaThunderbird 已更新到 Thunderbird 31.4.0 (bnc#910669)

- MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 各种内存安全危害

- MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon 请求缺少 Origin 标头

- MFSA 2015-04/CVE-2014-8639 (bmo#1095859) 通过代理认证响应注入 Cookie

远程主机受到 GLSA-201504-01 中所述漏洞的影响（Mozilla 产品：多个漏洞）

    在 Firefox、Thunderbird 和 SeaMonkey 中发现多种漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、欺骗地址栏、执行点击劫持攻击、绕过安全限制和保护机制，或造成其他不明影响。
  变通方案：

    目前尚无已知的变通方案。

Versions of SeaMonkey earlier than 2.32 are unpatched against the following vulnerabilities : 

  - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636)

  - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637)

  - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)

  - A flaw exists in Web Audio that cam allow a small block of memory to be read. (CVE-2014-8640)

  - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641)

  - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642)

Versions of Mozilla Thunderbird prior to 31.4 are prone to the following vulnerabilities : 

 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)
 - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header. This allows malicious sites to perform XSRF attacks. (CVE-2014-8638)
 - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)

Versions of Mozilla Firefox ESR prior to 31.4 are unpatched for the following vulnerabilities : 

 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)
 - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636)
 - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637)
 - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638)
 - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)
 - A flaw exists in Web Audio that can allow a small block of memory to be read. (CVE-2014-8640)
 - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641)
 - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642)
 - A flaw exists in the Gecko Media Plugin which can allow an attacker to break out of the sandbox. (CVE-2014-8643)

Versions of Mozilla Firefox earlier than 35.0 are unpatched for the following vulnerabilities : 

 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)
 - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636)
 - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637)
 - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638)
 - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)
 - A flaw exists in Web Audio that can allow a small block of memory to be read. (CVE-2014-8640)
 - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641)
 - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642)
 - A flaw exists in the Gecko Media Plugin which can allow an attacker to break out of the sandbox. (CVE-2014-8643)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
80993	openSUSE 安全性更新：MozillaThunderbird (openSUSE-SU-2015:0133-1)	Nessus	SuSE Local Security Checks	2015/1/26	2021/1/19	high
80520	Firefox < 35.0 多個弱點 (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/1/14	2019/11/25	high
82632	GLSA-201504-01：Mozilla 產品：多個弱點	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical
80520	Firefox < 35.0 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/1/14	2019/11/25	high
80993	openSUSE 安全更新：MozillaThunderbird (openSUSE-SU-2015:0133-1)	Nessus	SuSE Local Security Checks	2015/1/26	2021/1/19	high
82632	GLSA-201504-01 ：Mozilla 产品：多个漏洞	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical
8626	SeaMonkey < 2.32 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/1/16	2019/3/6	high
8625	Mozilla Thunderbird < 31.4 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2015/1/16	2019/3/6	high
701250	Mozilla Firefox ESR < 31.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2019/11/6	2019/11/6	high
8624	Mozilla Firefox < 35.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/1/16	2019/11/6	high

検出

プラグインの検索

high

high

critical

high

high

critical

high

high

high

high