The Mozilla Project reports :

MFSA 2014-34 Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)

MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer

MFSA 2014-36 Web Audio memory corruption issues

MFSA 2014-37 Out of bounds read while decoding JPG images

MFSA 2014-38 Buffer overflow when using non-XBL object as XBL

MFSA 2014-39 Use-after-free in the Text Track Manager for HTML video

MFSA 2014-41 Out-of-bounds write in Cairo

MFSA 2014-42 Privilege escalation through Web Notification API

MFSA 2014-43 Cross-site scripting (XSS) using history navigations

MFSA 2014-44 Use-after-free in imgLoader while resizing images

MFSA 2014-45 Incorrect IDNA domain name matching for wildcard certificates

MFSA 2014-46 Use-after-free in nsHostResolve

MFSA 2014-47 Debugger can bypass XrayWrappers with JavaScript

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0917 advisory.

    nspr     [4.10.6-1]
    - Rebase to nspr-4.10.6
    - Resolves: rhbz#1112135

    nss     [3.16.1-4.0.1.el6_5]
    - Added nss-vendor.patch to change vendor

    [3.16.1-4]
    - Update some patches on account of the rebase
    - Resolves: Bug 1099619

    [3.16.1-3]
    - Backport nss-3.12.6 upstream fix required by Firefox 31
    - Resolves: Bug 1099619

    [3.16.1-2]
    - Remove two unused patches and apply a needed one that was missed
    - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1

    [3.16.1-1]
    - Update to nss-3.16.1
    - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1

    nss-util     [3.15.6-1]
    - Update to nss-3.16.1
    - Resolves: rhbz#1112136

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated nss, nss-util, and nss-softokn packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSLv3, TLS, and other security standards.

It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid.
(CVE-2014-1492)

In addition, the nss, nss-util, and nss-softokn packages have been upgraded to upstream version 3.16.2, which provides a number of bug fixes and enhancements over the previous versions. (BZ#1124659)

Users of NSS are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, applications using NSS must be restarted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1246 advisory.

    [3.16.1-2]
    - Backport nss-3.12.6 upstream fix required by Firefox 31 ESR
    - Resolves: Bug 1110860

    [3.16.1-1]
    - Rebase to nss-3.16.1 for FF31
    - Resolves: Bug 1110860 - Rebase nss in RHEL 5.11 to NSS 3.16.1, required for FF 31

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740)

A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application.
(CVE-2014-1490)

It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491)

An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545)

It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid.
(CVE-2014-1492)

The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions.

This update also fixes the following bugs :

  - Previously, when the output.log file was not present on     the system, the shell in the Network Security Services     (NSS) specification handled test failures incorrectly as     false positive test results. Consequently, certain     utilities, such as 'grep', could not handle failures     properly. This update improves error detection in the     specification file, and 'grep' and other utilities now     handle missing files or crashes as intended.

  - Prior to this update, a subordinate Certificate     Authority (CA) of the ANSSI agency incorrectly issued an     intermediate certificate installed on a network     monitoring device. As a consequence, the monitoring     device was enabled to act as an MITM (Man in the Middle)     proxy performing traffic management of domain names or     IP addresses that the certificate holder did not own or     control. The trust in the intermediate certificate to     issue the certificate for an MITM device has been     revoked, and such a device can no longer be used for     MITM attacks.

  - Due to a regression, MD5 certificates were rejected by     default because Network Security Services (NSS) did not     trust MD5 certificates. With this update, MD5     certificates are supported in Scientific Linux 5.

This Mozilla Firefox update provides several security and non-security fixes.

Mozilla Firefox has been updated to the 24.5.0esr version, which fixes the following issues :

  - MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety     hazards

  - MFSA 2014-37/CVE-2014-1523 Out of bounds read while     decoding JPG images

  - MFSA 2014-38/CVE-2014-1524 Buffer overflow when using     non-XBL object as XBL

  - MFSA 2014-42/CVE-2014-1529 Privilege escalation through     Web Notification API

  - MFSA 2014-43/CVE-2014-1530 Cross-site scripting (XSS)     using history navigations

  - MFSA 2014-44/CVE-2014-1531 Use-after-free in imgLoader     while resizing images

  - MFSA 2014-46/CVE-2014-1532 Use-after-free in     nsHostResolver

Mozilla NSS has been updated to version 3.16

  - required for Firefox 29

  - CVE-2014-1492_ In a wildcard certificate, the wildcard     character should not be embedded within the U-label of     an internationalized domain name. See the last bullet     point in RFC 6125, Section 7.2.

  - Update of root certificates.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
73779	FreeBSD : mozilla -- multiple vulnerabilities (985d4d6c-cfbd-11e3-a003-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	2014/4/30	2021/1/6	critical
76694	Oracle Linux 6 : nss / and / nspr (ELSA-2014-0917)	Nessus	Oracle Linux Local Security Checks	2014/7/23	2024/10/23	critical
77239	CentOS 7 : nss / nss-softokn / nss-util (CESA-2014:1073)	Nessus	CentOS Local Security Checks	2014/8/19	2021/1/4	medium
77243	RHEL 7 : nss, nss-util, nss-softokn (RHSA-2014:1073)	Nessus	Red Hat Local Security Checks	2014/8/19	2021/1/14	medium
77739	Oracle Linux 5 : nss / and / nspr (ELSA-2014-1246)	Nessus	Oracle Linux Local Security Checks	2014/9/18	2024/10/22	critical
77955	Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64 (20140916)	Nessus	Scientific Linux Local Security Checks	2014/9/29	2021/1/14	critical
83622	SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2014:0665-2)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	critical

検出

プラグインの検索

critical

critical

medium

medium

critical

critical

critical