Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1562, CVE-2014-1567)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

After installing the update, Thunderbird must be restarted for the changes to take effect.

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service.

The version of Firefox ESR 24.x installed on the remote host is prior to 24.8. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1562)

  - A use-after-free vulnerability exists due to improper     handling of text layout in directionality resolution.
    A remote attacker can exploit this to execute arbitrary     code. (CVE-2014-1567)

The version of Thunderbird 24.x installed on the remote Mac OS X host is a version prior to 24.8. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1562)

  - A use-after-free vulnerability exists due to improper     handling of text layout in directionality resolution.
    A remote attacker can exploit this to execute arbitrary     code. (CVE-2014-1567)

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service.

Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs.

Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream :

  - Security researcher regenrecht reported, via     TippingPoint's Zero Day Initiative, a use-after-free     during text layout when interacting with the setting of     text direction. This results in a use-after-free which     can lead to arbitrary code execution. (MFSA 2014-72 /     CVE-2014-1567)

  - Mozilla developers and community identified and fixed     several memory safety bugs in the browser engine used in     Firefox and other Mozilla-based products. Some of these     bugs showed evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2014-67)

  - Jan de Mooij reported a memory safety problem that     affects Firefox ESR 24.7, ESR 31 and Firefox 31.
    (CVE-2014-1562) More information is referenced on:
    https://www.mozilla.org/security/announce/ .

ID	名稱	產品	系列	已發布	已更新	嚴重性
77554	Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20140903)	Nessus	Scientific Linux Local Security Checks	2014/9/5	2021/1/14	critical
77752	Debian DSA-3028-1 : icedove - security update	Nessus	Debian Local Security Checks	2014/9/19	2021/1/11	critical
77493	Firefox ESR 24.x < 24.8 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2014/9/3	2026/3/3	critical
77496	Mozilla Thunderbird 24.x < 24.8 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2014/9/3	2019/11/25	critical
77511	Debian DSA-3018-1 : iceweasel - security update	Nessus	Debian Local Security Checks	2014/9/4	2021/1/11	critical
77599	SuSE 11.3 Security Update : MozillaFirefox (SAT Patch Number 9687)	Nessus	SuSE Local Security Checks	2014/9/10	2021/1/19	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical