The remote Oracle Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2014-0316 advisory.

    [24.4.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [24.4.0-1]
    - Update to 24.4.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Firefox was updated to version 28.0, receiving enhancements, bug and security fixes. Mozilla NSPR was updated to 4.10.4 receiving enhancements, bug and security fixes. Mozilla NSS was updated to 3.15.5 receiving enhancements, bug and security fixes.

Changes in MozillaFirefox :

  - update to Firefox 28.0 (bnc#868603)

  - MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous     memory safety hazards

  - MFSA 2014-17/CVE-2014-1497 (bmo#966311) Out of bounds     read during WAV file decoding

  - MFSA 2014-18/CVE-2014-1498 (bmo#935618)     crypto.generateCRMFRequest does not validate type of key

  - MFSA 2014-19/CVE-2014-1499 (bmo#961512) Spoofing attack     on WebRTC permission prompt

  - MFSA 2014-20/CVE-2014-1500 (bmo#956524) onbeforeunload     and JavaScript navigation DOS

  - MFSA 2014-22/CVE-2014-1502 (bmo#972622) WebGL content     injection from one domain to rendering in another

  - MFSA 2014-23/CVE-2014-1504 (bmo#911547) Content Security     Policy for data: documents not preserved by session     restore

  - MFSA 2014-26/CVE-2014-1508 (bmo#963198) Information     disclosure through polygon rendering in MathML

  - MFSA 2014-27/CVE-2014-1509 (bmo#966021) Memory     corruption in Cairo during PDF font rendering

  - MFSA 2014-28/CVE-2014-1505 (bmo#941887) SVG filters     information disclosure through feDisplacementMap

  - MFSA 2014-29/CVE-2014-1510/CVE-2014-1511 (bmo#982906,     bmo#982909) Privilege escalation using     WebIDL-implemented APIs

  - MFSA 2014-30/CVE-2014-1512 (bmo#982957) Use-after-free     in TypeObject

  - MFSA 2014-31/CVE-2014-1513 (bmo#982974) Out-of-bounds     read/write through neutering ArrayBuffer objects

  - MFSA 2014-32/CVE-2014-1514 (bmo#983344) Out-of-bounds     write through TypedArrayObject after neutering

  - requires NSPR 4.10.3 and NSS 3.15.5

  - new build dependency (and recommends) :

  - libpulse

  - JS math correctness issue (bmo#941381)

Changes in mozilla-nspr :

  - update to version 4.10.4

  - bmo#767759: Add support for new x32 abi

  - bmo#844784: Thread data race in PR_EnterMonitor

  - bmo#939786: data race     nsprpub/pr/src/pthreads/ptthread.c:137 _pt_root

  - bmo#958796: Users of _beginthreadex that set a custom     stack size may not be getting the behavior they want

  - bmo#963033: AArch64 support update for NSPR

  - bmo#969061:&#9;Incorrect end-of-list test when iterating     over a PRCList in prcountr.c and prtrace.c

  - bmo#971152: IPv6 detection on linux depends on     availability of /proc/net/if_inet6

  - update to version 4.10.3

  - bmo#749849: ensure we'll free the thread-specific data     key.

  - bmo#941461: don't compile android with unaligned memory     access.

  - bmo#932398: Add PR_SyncMemMap, a portable version of     msync/FlushViewOfFile.

  - bmo#952621: Fix a thread-unsafe access to lock->owner in     PR_Lock.

  - bmo#957458: Fix several bugs in the lock rank checking     code.

  - bmo#936320: Use an alternative test for IPv6 support on     Linux to avoid opening a socket.

Changes in mozilla-nss :

  - update to 3.15.5

  - required for Firefox 28

  - export FREEBL_LOWHASH to get the correct default headers     (bnc#865539) New functionality

  - Added support for the TLS application layer protocol     negotiation (ALPN) extension. Two SSL socket options,     SSL_ENABLE_NPN and SSL_ENABLE_ALPN, can be used to     control whether NPN or ALPN (or both) should be used for     application layer protocol negotiation.

  - Added the TLS padding extension. The extension type     value is 35655, which may change when an official     extension type value is assigned by IANA. NSS     automatically adds the padding extension to ClientHello     when necessary.

  - Added a new macro CERT_LIST_TAIL, defined in certt.h,     for getting the tail of a CERTCertList. Notable Changes

  - bmo#950129: Improve the OCSP fetching policy when     verifying OCSP responses

  - bmo#949060: Validate the iov input argument (an array of     PRIOVec structures) of ssl_WriteV (called via     PR_Writev). Applications should still take care when     converting struct iov to PRIOVec because the iov_len     members of the two structures have different types     (size_t vs. int). size_t is unsigned and may be larger     than int.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514)

Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505)

A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1509)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

After installing the update, Thunderbird must be restarted for the changes to take effect.

Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman and Christoph Diehl discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1493)

Atte Kettunen discovered an out-of-bounds read during WAV file decoding. If a user had enabled audio, an attacker could potentially exploit this to cause a denial of service via application crash.
(CVE-2014-1497)

Robert O'Callahan discovered a mechanism for timing attacks involving SVG filters and displacements input to feDisplacementMap. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential information across domains. (CVE-2014-1505)

Tyson Smith and Jesse Schwartzentruber discovered an out-of-bounds read during polygon rendering in MathML. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential information across domains. (CVE-2014-1508)

John Thomson discovered a memory corruption bug in the Cairo graphics library. If a user had a malicious extension installed, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1509)

Mariusz Mlynski discovered that web content could open a chrome privileged page and bypass the popup blocker in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1510, CVE-2014-1511)

It was discovered that memory pressure during garbage collection resulted in memory corruption in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1512)

Juri Aedla discovered out-of-bounds reads and writes with TypedArrayObject in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1513)

George Hotz discovered an out-of-bounds write with TypedArrayObject.
If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2014-1514).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2014-0310 advisory.

    [24.4.0-1.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one
    - Build with nspr-devel >= 4.10.0 to fix build failure

    [24.4.0-1]
    - Update to 24.4.0 ESR

    [24.3.0-4]
    - Fixed rhbz#1070467 - Enable Add Ons by default in Firefox

    [24.3.0-3]
    - Fixed rhbz#1054832 - Firefox does not support Camellia cipher

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Firefox was updated to 24.4.0ESR release, fixing various security issues and bugs :

  - Mozilla developers and community identified identified     and fixed several memory safety bugs in the browser     engine used in Firefox and other Mozilla-based products.
    Some of these bugs showed evidence of memory corruption     under certain circumstances, and we presume that with     enough effort at least some of these could be exploited     to run arbitrary code. (MFSA 2014-15)

  - Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij,     Jesse Ruderman, Dan Gohman, and Christoph Diehl reported     memory safety problems and crashes that affect Firefox     ESR 24.3 and Firefox 27. (CVE-2014-1493)

  - Gregor Wagner, Olli Pettay, Gary Kwong, Jesse Ruderman,     Luke Wagner, Rob Fletcher, and Makoto Kato reported     memory safety problems and crashes that affect Firefox     27. (CVE-2014-1494)

  - Security researcher Ash reported an issue where the     extracted files for updates to existing files are not     read only during the update process. This allows for the     potential replacement or modification of these files     during the update process if a malicious application is     present on the local system. (MFSA 2014-16 /     CVE-2014-1496)

  - Security researcher Atte Kettunen from OUSPG reported an     out of bounds read during the decoding of WAV format     audio files for playback. This could allow web content     access to heap data as well as causing a crash. (MFSA     2014-17 / CVE-2014-1497)

  - Mozilla developer David Keeler reported that the     crypto.generateCRFMRequest method did not correctly     validate the key type of the KeyParams argument when     generating ec-dual-use requests. This could lead to a     crash and a denial of service (DOS) attack. (MFSA     2014-18 / CVE-2014-1498)

  - Mozilla developer Ehsan Akhgari reported a spoofing     attack where the permission prompt for a WebRTC session     can appear to be from a different site than its actual     originating site if a timed navigation occurs during the     prompt generation. This allows an attacker to     potentially gain access to the webcam or microphone by     masquerading as another site and gaining user permission     through spoofing. (MFSA 2014-19 / CVE-2014-1499)

  - Security researchers Tim Philipp Schaefers and Sebastian     Neef, the team of Internetwache.org, reported a     mechanism using JavaScript onbeforeunload events with     page navigation to prevent users from closing a     malicious page's tab and causing the browser to become     unresponsive. This allows for a denial of service (DOS)     attack due to resource consumption and blocks the     ability of users to exit the application. (MFSA 2014-20     / CVE-2014-1500)

  - Security researcher Alex Infuehr reported that on     Firefox for Android it is possible to open links to     local files from web content by selecting 'Open Link in     New Tab' from the context menu using the file: protocol.
    The web content would have to know the precise location     of a malicious local file in order to exploit this     issue. This issue does not affect Firefox on non-Android     systems. (MFSA 2014-21 / CVE-2014-1501)

  - Mozilla developer Jeff Gilbert discovered a mechanism     where a malicious site with WebGL content could inject     content from its context to that of another site's WebGL     context, causing the second site to replace textures and     similar content. This cannot be used to steal data but     could be used to render arbitrary content in these     limited circumstances. (MFSA 2014-22 / CVE-2014-1502)

  - Security researcher Nicolas Golubovic reported that the     Content Security Policy (CSP) of data: documents was not     saved as part of session restore. If an attacker     convinced a victim to open a document from a data: URL     injected onto a page, this can lead to a Cross-Site     Scripting (XSS) attack. The target page may have a     strict CSP that protects against this XSS attack, but if     the attacker induces a browser crash with another bug,     an XSS attack would occur during session restoration,     bypassing the CSP on the site. (MFSA 2014-23 /     CVE-2014-1504)

  - Security researcher Tyson Smith and Jesse     Schwartzentruber of the BlackBerry Security Automated     Analysis Team used the Address Sanitizer tool while     fuzzing to discover an out-of-bounds read during polygon     rendering in MathML. This can allow web content to     potentially read protected memory addresses. In     combination with previous techniques used for SVG timing     attacks, this could allow for text values to be read     across domains, leading to information disclosure. (MFSA     2014-26 / CVE-2014-1508)

  - Security researcher John Thomson discovered a memory     corruption in the Cairo graphics library during font     rendering of a PDF file for display. This memory     corruption leads to a potentially exploitable crash and     to a denial of service (DOS). This issues is not able to     be triggered in a default configuration and would     require a malicious extension to be installed. (MFSA     2014-27 / CVE-2014-1509)

  - Mozilla developer Robert O'Callahan reported a mechanism     for timing attacks involving SVG filters and     displacements input to feDisplacementMap. This allows     displacements to potentially be correlated with values     derived from content. This is similar to the previously     reported techniques used for SVG timing attacks and     could allow for text values to be read across domains,     leading to information disclosure. (MFSA 2014-28 /     CVE-2014-1505)

  - Security researcher Mariusz Mlynski, via TippingPoint's     Pwn2Own contest, reported that it is possible for     untrusted web content to load a chrome-privileged page     by getting JavaScript-implemented WebIDL to call     window.open(). A second bug allowed the bypassing of the     popup-blocker without user interaction. Combined these     two bugs allow an attacker to load a JavaScript URL that     is executed with the full privileges of the browser,     which allows arbitrary code execution. (MFSA 2014-29 /     CVE-2014-1510 / CVE-2014-1511)

  - Security research firm VUPEN, via TippingPoint's Pwn2Own     contest, reported that memory pressure during Garbage     Collection could lead to memory corruption of     TypeObjects in the JS engine, resulting in an     exploitable use-after-free condition. (MFSA 2014-30 /     CVE-2014-1512)

  - Security researcher Jueri Aedla, via TippingPoint's     Pwn2Own contest, reported that TypedArrayObject does not     handle the case where ArrayBuffer objects are neutered,     setting their length to zero while still in use. This     leads to out-of-bounds reads and writes into the     JavaScript heap, allowing for arbitrary code execution.
    (MFSA 2014-31 / CVE-2014-1513)

  - Security researcher George Hotz, via TippingPoint's     Pwn2Own contest, discovered an issue where values are     copied from an array into a second, neutered array. This     allows for an out-of-bounds write into memory, causing     an exploitable crash leading to arbitrary code     execution. (MFSA 2014-32 / CVE-2014-1514)

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client. Multiple memory safety errors, out of bound reads, use-after-frees and other implementation errors may lead to the execution of arbitrary code, information disclosure or denial of service.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
73112	Oracle Linux 5 / 6 : thunderbird (ELSA-2014-0316)	Nessus	Oracle Linux Local Security Checks	2014/3/20	2024/10/23	critical
75307	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:0448-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical
73116	Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20140319)	Nessus	Scientific Linux Local Security Checks	2014/3/20	2021/1/14	high
73148	Ubuntu 12.04 LTS / 12.10 / 13.10 : thunderbird vulnerabilities (USN-2151-1)	Nessus	Ubuntu Local Security Checks	2014/3/22	2021/1/19	high
73088	Oracle Linux 5 / 6 : firefox (ELSA-2014-0310)	Nessus	Oracle Linux Local Security Checks	2014/3/19	2025/4/29	critical
73147	SuSE 11.3 Security Update : MozillaFirefox (SAT Patch Number 9049)	Nessus	SuSE Local Security Checks	2014/3/22	2021/1/19	high
73657	Debian DSA-2911-1 : icedove - security update	Nessus	Debian Local Security Checks	2014/4/23	2021/1/11	high

検出

プラグインの検索

critical

high

critical

high

high

critical

high

high