远程 Windows 主机上安装的 Thunderbird 版本低于 31.3。因此，它受到以下漏洞的影响：

- 由于在 ASN.1 DER 解码期间处理 PKCS#1 签名时触发了“quickder.c”中的缺陷，而在 Mozilla 网络安全服务 (NSS) 中存在远程代码执行漏洞。
 (CVE-2014-1569)

- 浏览器引擎中存在多种内存安全缺陷。攻击者可利用这些缺陷造成拒绝服务或执行任意代码。（CVE-2014-1587、CVE-2014-1588）

- 因为将 JavaScript 对象错误解析到 XMLHttpRequest API 而产生拒绝服务漏洞，该漏洞可能导致崩溃。
 (CVE-2014-1590)

- 解析写入使用“document.open()”函数创建的文档的 HTML 时，由于创建第二个 XML 根元素而造成释放后使用错误，该错误可导致执行任意代码。(CVE-2014-1592)

- 解析媒体时，“mozilla::FileBlockCache::Read”函数中存在缓冲区溢出漏洞，该漏洞可能导致执行任意代码。
 (CVE-2014-1593)

- 从“BasicThebesLayer”层转换到“BasicContainerLayer”层时存在转换错误，该错误可导致执行任意代码。
 (CVE-2014-1594)

远程 Ubuntu 14.04 LTS 主机上安装的多个程序包受到 USN-2424-1 公告中提及的多个漏洞影响。

    Gary Kwong、Randell Jesup、Nils Ohlmeier、Jesse Ruderman、Max Jonas Werner、Christian Holler、Jon Coppeard、Eric Rahm、Byron Campen、Eric Rescorla 和 Xidorn Quan 发现 Firefox 中的多个内存安全问题。如果用户受到诱骗打开特别构建的网站，攻击者可能利用这些漏洞，通过应用程序崩溃造成拒绝服务，或者调用 Firefox 的用户的权限执行任意代码。（CVE-2014-1587、CVE-2014-1588）

    Cody Crews 发现了在某些情况下从 Web 内容中触发 chrome 级别的 XBL 绑定的一种方法。
    如果用户受到诱骗打开特别构建的网站，攻击者可能利用此问题绕过安全限制。(CVE-2014-1589)

    Joe Vennix 发现在某些情况下使用 XMLHttpRequest 时会发生崩溃。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此漏洞造成拒绝服务。(CVE-2014-1590)

    Muneaki Nishimura 发现，在某些情况下 CSP 冲突报告没有删除路径信息。如果用户受到诱骗打开特制的网站，攻击者可能利用此问题获取敏感信息。(CVE-2014-1591)

    Berend-Jan Wever 发现 HTML 解析过程中存在释放后使用情况。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此漏洞，通过使应用程序崩溃造成拒绝服务，或以调用 Firefox 的用户的权限执行任意代码。
    (CVE-2014-1592)

    Abhishek Arya 发现解析媒体内容时存在缓冲区溢出。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此漏洞，通过使应用程序崩溃造成拒绝服务，或以调用 Firefox 的用户的权限执行任意代码。
    (CVE-2014-1593)

    Byoungyoung Lee、Chengyu Song 和 Taesoo Kim 发现合成程序中存在转换错误。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此漏洞导致不明行为、通过使应用程序崩溃造成拒绝服务，或以调用 Firefox 的用户的权限执行任意代码。(CVE-2014-1594)

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Versions of Mozilla Firefox earlier than 34.0 are unpatched for the following vulnerabilities :

 - Security Bypass that can be leveraged when processing specially crafted Chrome-based CSS stylesheets with improperly declared namespaces. (CVE-2014-1589)
 - Information Disclosure due to the way Content Security Policy leaks data through violation reports. (CVE-2014-1591)
 - Multiple Unspecified Memory Corruption Vulnerabilities. (CVE-2014-1587)(CVE-2014-1588)
 - Multiple Local Information Disclosure Vulnerabilities requiring interactive access to exploit. (CVE-2014-1595)
 - Security Vulnerability due to bad casting from 'BasicThebesLayer' to 'BasicContainerLayer'. (CVE-2014-1594)
 - Denial of Service Vulnerability can occur when passing a js object to 'XMLHttpRequest' that mimics an input stream. (CVE-2014-1590)
 - Use After Free Memory Corruption Vulnerability when creating a second root element during the parsing of an HTML5 document which contains 'document.open()'. (CVE-2014-1592)
 - Buffer Overflow Vulnerability when handling specially crafted media content. (CVE-2014-1593)
 - A flaw exists and is triggered as 'XrayWrappers' filter objects are not properly validated when stored in the program. This may allow a context-dependent attacker to bypass security protection mechanisms. (CVE-2014-8632)

Versions of Mozilla Firefox ESR earlier than 31.3 are unpatched for the following vulnerabilities :

 - Security Bypass that can be leveraged when processing specially crafted Chrome-based CSS stylesheets with improperly declared namespaces. (CVE-2014-1589)
 - Information Disclosure due to the way Content Security Policy leaks data through violation reports. (CVE-2014-1591)
 - Multiple Unspecified Memory Corruption Vulnerabilities. (CVE-2014-1587)(CVE-2014-1588)
 - Multiple Local Information Disclosure Vulnerabilities requiring interactive access to exploit. (CVE-2014-1595)
 - Security Vulnerability due to bad casting from 'BasicThebesLayer' to 'BasicContainerLayer'. (CVE-2014-1594)
 - Denial of Service Vulnerability can occur when passing a js object to 'XMLHttpRequest' that mimics an input stream. (CVE-2014-1590)
 - Use After Free Memory Corruption Vulnerability when creating a second root element during the parsing of an HTML5 document which contains 'document.open()'. (CVE-2014-1592)
 - Buffer Overflow Vulnerability when handling specially crafted media content. (CVE-2014-1593)
 - A flaw exists and is triggered as 'XrayWrappers' filter objects are not properly validated when stored in the program. This may allow a context-dependent attacker to bypass security protection mechanisms. (CVE-2014-8632)

Versions of Mozilla Thunderbird prior to 31.3 are prone to the following vulnerabilities :

 - Multiple Unspecified Memory Corruption Vulnerabilities.(CVE-2014-1587)(CVE-2014-1588)
 - Multiple Local Information Disclosure Vulnerabilities requiring interactive access to exploit.(CVE-2014-1595)
 - Security Vulnerability due to bad casting from BasicThebesLayer to BasicContainerLayer.(CVE-2014-1594)
 - Denial of Service Vulnerability can occur when passing a js object to XMLHttpRequest that mimics an input stream.(CVE-2014-1590)
 - Use After Free Memory Corruption Vulnerability when creating a second root element during the parsing of an HTML5 document which contains 'document.open()'.(CVE-2014-1592)
 - Buffer Overflow Vulnerability when handling specially crafted media content.(CVE-2014-1593)

ID	名稱	產品	系列	已發布	已更新	嚴重性
79666	Mozilla Thunderbird < 31.3 多种漏洞	Nessus	Windows	2014/12/2	2019/11/25	high
79688	Ubuntu 14.04 LTS：Firefox 漏洞 (USN-2424-1)	Nessus	Ubuntu Local Security Checks	2014/12/3	2024/8/27	critical
8588	Mozilla Firefox < 34.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2014/12/4	2019/11/6	medium
701249	Mozilla Firefox ESR < 31.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2019/11/6	2019/11/6	medium
8589	Mozilla Thunderbird < 31.3 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2014/12/4	2019/3/6	medium

偵測

搜尋 Plugin

high

critical

medium

medium

medium