远程 Windows 主机上安装的 Firefox ESR 版本低于 38.1。因此，它受到多种漏洞的影响：

- 存在由网络安全服务 (NSS) 缺陷导致的安全降级漏洞。在客户端已允许 ECDHE_ECDSA 交换而服务器却未发送 ServerKeyExchange 消息的情况下，NSS 客户端将会从 ECDSA 证书中获取 EC 密钥。远程攻击者能够利用此问题在用户不知情的情况下，使交换降级为非前向密码混合 ECDH 交换。
 (CVE-2015-2721)

- 在配合共享线程或专用线程使用 XMLHttpRequest 对象时，存在多个释放后使用错误。远程攻击者可利用此缺陷造成拒绝服务。（CVE-2015-2722、CVE-2015-2733）

- 存在多种内存损坏问题，攻击者可利用此类问题造成拒绝服务或执行任意代码。（CVE-2015-2724、CVE-2015-2725）

- 由于未能保留上下文限制，存在一个安全绕过漏洞。远程攻击者可利用此问题，通过构建的使用不明鼠标和键盘操作访问的网站读取任意文件或执行任意 JavaScript 代码。
 (CVE-2015-2727)

- 在索引数据库管理器处理 IDBDatabase 的过程中存在类型混淆缺陷。远程攻击者可利用此问题造成拒绝服务或执行任意代码。(CVE-2015-2728)

- 在计算振荡器渲染范围时 AudioParamTimeline::AudioNodeInputValue() 函数中存在越界读取缺陷。攻击者可利用此缺陷，泄漏内存中四个字节的内容或造成拒绝服务的情况。
 (CVE-2015-2729)

- 网络安全服务 (NSS) 的椭圆曲线数字签名算法 (ECDSA) 签名验证中存在缺陷，导致签名欺骗漏洞。远程攻击者可利用此漏洞伪造签名。(CVE-2015-2730)

- 在修改文档对象模型以移除 DOM 对象时，CSPService::ShouldLoad() 函数中存在一个释放后使用错误。攻击者可利用此问题取消引用已释放内存，进而导致执行任意代码。(CVE-2015-2731)

- 未初始化内存使用问题，存在于 CairoTextureClientD3D9::BorrowDrawTarget() 函数、::d3d11::SetBufferData() 函数以及 YCbCrImageDataDeserializer::ToDataSourceSurface() 函数中。所造成的影响不明。（CVE-2015-2734、CVE-2015-2737、CVE-2015-2738）

- 由于未正确检查字符串长度，nsZipArchive::GetDataOffset() 函数中存在一个内存损坏问题。攻击者可利用此问题，通过构建的 ZIP 存档执行任意代码。(CVE-2015-2735)

- nsZipArchive::BuildFileList() 函数中存在因未正确验证用户提供的输入而导致的内存损坏问题。攻击者可利用此问题，通过构建的 ZIP 存档执行任意代码。(CVE-2015-2736)

- ArrayBufferBuilder::append() 函数中存在因未正确验证用户提供的输入而导致的不明内存损坏问题。攻击者可利用此问题，执行任意代码。
 (CVE-2015-2739)

- nsXMLHttpRequest::AppendToResponseText() 函数中存在因未正确验证用户提供的输入而导致的缓冲区溢出情况。攻击者可利用此问题，执行任意代码。
 (CVE-2015-2740)

- 存在证书锁定检查缺陷所导致的安全绕过漏洞。如果出现生成用户对话的 X.509 证书问题，则不强制执行密钥锁定。中间人攻击者可利用此问题绕过预期访问限制。
 (CVE-2015-2741)

- PDF 查看器 (PDF.js) 中存在因不安全执行内部线程而导致的权限升级漏洞。攻击者可利用此问题，绕过同源策略，执行任意代码。
 (CVE-2015-2743)

- 由于 SSL/TLS 协议中的缺陷，存在中间人漏洞，也称为 Logjam。远程攻击者可利用此缺陷，使用临时 Diffie-Hellman 密钥交换将连接降级至 512 位出口级加密。(CVE-2015-4000)

Karthikeyan Bhargavan 发现，NSS 对 TLS 状态机的状态转换处理不正确。如果远程攻击者能够执行中间人攻击，则可利用此缺陷跳过 ServerKeyExchange 消息，并移除前向保密性属性。(CVE-2015-2721)

Looben Yan 在使用 XMLHttpRequest 的某些情况下发现了两个释放后使用问题。如果用户受到诱骗打开特别构建的网站，攻击者可能利用这些漏洞，通过应用程序崩溃造成拒绝服务，或者调用 Firefox 的用户的权限执行任意代码。（CVE-2015-2722、CVE-2015-2733）

Bob Clary、Christian Holler、Bobby Holley、Andrew McCreight、Terrence Cole、Steve Fink、Mats Palmgren、Wes Kocher、Andreas Pehrson、Tooru Fujisawa、Andrew Sutherland 和 Gary Kwong 在 Firefox 中发现多个内存安全问题。如果用户受到诱骗打开特别构建的网站，攻击者可能利用这些漏洞，通过应用程序崩溃造成拒绝服务，或者以调用 Firefox 的用户的权限执行任意代码。
（CVE-2015-2724、CVE-2015-2725、CVE-2015-2726）

Armin Razmdjou 发现，使用特定的鼠标和按键组合打开超链接时，可能会允许在不保留上下文限制的情况下打开 Chrome 特权 URL。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此问题绕过安全限制。
(CVE-2015-2727)

Paul Bandha 在索引数据库管理器中发现一个类型混淆缺陷。
如果用户受到诱骗打开特别构建的网站，攻击者可能利用此漏洞，通过应用程序崩溃造成拒绝服务，或者以调用 Firefox 的用户的权限执行任意代码。(CVE-2015-2728)

Holger Fuhrmannek 发现 Web 音频中存在越界读取。如果用户受到诱骗打开特制的网站，攻击者可能利用此问题获取敏感信息。(CVE-2015-2729)

Watson Ladd 发现，NSS 对椭圆曲线加密 (ECC) 乘法的处理不正确。远程攻击者可能利用此问题假冒 ECDSA 签名。(CVE-2015-2730)

当内容策略修改 DOM 以删除 DOM 对象时，发现一个释放后使用。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此漏洞，通过应用程序崩溃造成拒绝服务，或者以调用 Firefox 的用户的权限执行任意代码。
(CVE-2015-2731)

Ronald Crane 发现多种安全漏洞。如果用户受到诱骗打开特别构建的网站，攻击者可能利用这些漏洞，通过应用程序崩溃造成拒绝服务，或者调用 Firefox 的用户的权限执行任意代码。（CVE-2015-2734、CVE-2015-2735、CVE-2015-2736、CVE-2015-2737、CVE-2015-2738、CVE-2015-2739、CVE-2015-2740）

David Keeler 发现，发生可覆盖证书错误时密钥锁定检查会被跳过。这会允许用户手动替代伪造证书的错误，但无法自行利用。(CVE-2015-2741)

Jonas Jenwald 发现某些内部线程以较高的权限错误地执行。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此漏洞与其他安全漏洞结合，在特权范围内执行任意代码。(CVE-2015-2743)

Matthew Green 发现 NSS 中的一个 DHE 密钥处理问题，其中 MITM 可强制服务器将 TLS 连接降级为 512 位导出级加密。攻击者可能利用此漏洞冒充服务器。(CVE-2015-4000)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

Mozilla 项目报告：

MFSA 2015-59 各种内存安全危害 (rv:39.0 / rv:31.8 / rv:38.1)

MFSA 2015-60 可在新选项卡中打开页面中的本地文件或特权 URL

MFSA 2015-61 索引数据库管理器中的类型混淆

MFSA 2015-62 计算 Web 音频中的振荡器渲染范围时的越界读取

MFSA 2015-63 内容策略中因微任务执行错误而造成的释放后使用

MFSA 2015-64 ECDSA 签名验证无法正确处理某些签名

MFSA 2015-65 使用 XMLHttpRequest 时工作线程中的释放后使用

MFSA 2015-66 通过代码检查发现了多种漏洞

MFSA 2015-67 遇到可覆盖的错误时忽略密钥锁定

MFSA 2015-68 OS X 崩溃报告可能包含输入的按键信息

MFSA 2015-69 通过内部工作线程造成的权限升级

MFSA 2015-70 NSS 接受具有常规 DHE 加密套件的出口级长度 DHE 密钥

MFSA 2015-71 NSS 错误地允许跳过 ServerKeyExchange

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service. This update also addresses a vulnerability in DHE key processing commonly known as the 'LogJam' vulnerability.

The version of Firefox ESR installed on the remote Mac OS X host is\ prior to 38.1. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A security bypass vulnerability exists due to a failure     to preserve context restrictions. A remote attacker can     exploit this, via a crafted web site that is accessed     with unspecified mouse and keyboard actions, to read     arbitrary files or execute arbitrary JavaScript code.
    (CVE-2015-2727)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - An out-of-bounds read flaw exists in the     AudioParamTimeline::AudioNodeInputValue() function when     computing oscillator rending ranges. An attacker can     exploit this to disclose the contents of four bytes of     memory or cause a denial of service condition.
    (CVE-2015-2729)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Firefox installed on the remote Mac OS X host is prior to 39.0. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A security bypass vulnerability exists due to a failure     to preserve context restrictions. A remote attacker can     exploit this, via a crafted web site that is accessed     with unspecified mouse and keyboard actions, to read     arbitrary files or execute arbitrary JavaScript code.
    (CVE-2015-2727)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - An out-of-bounds read flaw exists in the     AudioParamTimeline::AudioNodeInputValue() function when     computing oscillator rending ranges. An attacker can     exploit this to disclose the contents of four bytes of     memory or cause a denial of service condition.
    (CVE-2015-2729)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - An information disclosure vulnerability exists due to     crash reports containing key press information.
    (CVE-2015-2742)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Thunderbird installed on the remote Mac OS X host is prior to 38.1. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Firefox ESR installed on the remote Windows host is prior to 31.8. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Firefox ESR installed on the remote Windows host is prior to 38.1. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A security bypass vulnerability exists due to a failure     to preserve context restrictions. A remote attacker can     exploit this, via a crafted web site that is accessed     with unspecified mouse and keyboard actions, to read     arbitrary files or execute arbitrary JavaScript code.
    (CVE-2015-2727)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - An out-of-bounds read flaw exists in the     AudioParamTimeline::AudioNodeInputValue() function when     computing oscillator rending ranges. An attacker can     exploit this to disclose the contents of four bytes of     memory or cause a denial of service condition.
    (CVE-2015-2729)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2656-1 advisory.

    Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine.
    If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to     skip the ServerKeyExchange message and remove the forward-secrecy property. (CVE-2015-2721)

    Looben Yan discovered 2 use-after-free issues when using XMLHttpRequest in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit these to     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-2722, CVE-2015-2733)

    Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes     Kocher, Andreas Pehrson, Tooru Fujisawa, Andrew Sutherland, and Gary Kwong discovered multiple memory     safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker     could potentially exploit these to cause a denial of service via application crash, or execute arbitrary     code with the privileges of the user invoking Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2726)

    Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a     Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to bypass security     restrictions. (CVE-2015-2727)

    Paul Bandha discovered a type confusion bug in the Indexed DB Manager. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox.
    (CVE-2015-2728)

    Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to obtain sensitive information.
    (CVE-2015-2729)

    Watson Ladd discovered that NSS incorrectly handled Elliptical Curve Cryptography (ECC) multiplication. A     remote attacker could possibly use this issue to spoof ECDSA signatures. (CVE-2015-2730)

    A use-after-free was discovered when a Content Policy modifies the DOM to remove a DOM object. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash or execute arbitrary code with the priviliges of the user     invoking Firefox. (CVE-2015-2731)

    Ronald Crane discovered multiple security vulnerabilities. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

    David Keeler discovered that key pinning checks can be skipped when an overridable certificate error     occurs. This allows a user to manually override an error for a fake certificate, but cannot be exploited     on its own. (CVE-2015-2741)

    Jonas Jenwald discovered that some internal workers were incorrectly executed with a high privilege. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in     combination with another security vulnerability, to execute arbitrary code in a privileged scope.
    (CVE-2015-2743)

    Matthew Green discovered a DHE key processing issue in NSS where a MITM could force a server to downgrade     TLS connections to 512-bit export-grade cryptography. An attacker could potentially exploit this to     impersonate the server. (CVE-2015-4000)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Mozilla Project reports :

MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)

MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs

MFSA 2015-61 Type confusion in Indexed Database Manager

MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio

MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error

MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly

MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest

MFSA 2015-66 Vulnerabilities found through code inspection

MFSA 2015-67 Key pinning is ignored when overridable errors are encountered

MFSA 2015-68 OS X crash reports may contain entered key press information

MFSA 2015-69 Privilege escalation through internal workers

MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites

MFSA 2015-71 NSS incorrectly permits skipping of ServerKeyExchange

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2722, CVE-2015-2727, CVE-2015-2728, CVE-2015-2729, CVE-2015-2731, CVE-2015-2733, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

It was found that Firefox skipped key-pinning checks when handling an error that could be overridden by the user (for example an expired certificate error). This flaw allowed a user to override a pinned certificate, which is an action the user should not be able to perform. (CVE-2015-2741)

A flaw was discovered in Mozilla's PDF.js PDF file viewer. When combined with another vulnerability, it could allow execution of arbitrary code with the privileges of the user running Firefox.
(CVE-2015-2743)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes Kocher, Andreas Pehrson, Jann Horn, Paul Bandha, Holger Fuhrmannek, Herre, Looben Yan, Ronald Crane, and Jonas Jenwald as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.1 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The version of Firefox is prior to 39.0 and is affected by multiple vulnerabilities : 

 - A security downgrade vulnerability exists due to a flaw in Network Security Services (NSS). When a client allows for a ECDHE_ECDSA exchange, but the server does not send a ServerKeyExchange message, the the NSS client will take the EC key from the ECDSA certificate. A remote attacker can exploit this to silently downgrade the exchange to a non-forward secret mixed-ECDH exchange. (CVE-2015-2721) 
 - Multiple user-after-free errors exist when using an XMLHttpRequest object in concert with either shared or dedicated workers. A remote attacker can exploit this to cause a denial of service condition. (CVE-2015-2722, CVE-2015-2733) 
 - Multiple memory corruption issues exist that allow an attacker to cause a denial of service condition or potentially execute arbitrary code. (CVE-2015-2724, CVE-2015-2725) 
 - A security bypass vulnerability exists due to a failure to preserve context restrictions. A remote attacker can exploit this, via a crafted web site that is accessed with unspecified mouse and keyboard actions, to read arbitrary files or execute arbitrary JavaScript code. (CVE-2015-2727) 
 - A type confusion flaw exists in the Indexed Database Manager's handling of IDBDatabase. A remote attacker can exploit this to cause a denial of service condition or to execute arbitrary code. (CVE-2015-2728) 
 - An out-of-bounds read flaw exists in the 'AudioParamTimeline::AudioNodeInputValue()' function when computing oscillator rending ranges. An attacker can exploit this to disclose the contents of four bytes of memory or cause a denial of service condition. (CVE-2015-2729) 
 - A signature spoofing vulnerability exists due to a flaw in Network Security Services (NSS) in its Elliptic Curve Digital Signature Algorithm (ECDSA) signature validation. A remote attacker can exploit this to forge signatures. (CVE-2015-2730) 
 - A use-after-free error exists in the 'CSPService::ShouldLoad()' function when modifying the Document Object Model to remove a DOM object. An attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code. (CVE-2015-2731) 
 - An uninitialized memory use issue exists in the 'CairoTextureClientD3D9::BorrowDrawTarget()' function, the '::d3d11::SetBufferData()' function, and the 'YCbCrImageDataDeserializer::ToDataSourceSurface()' function. The impact is unspecified. (CVE-2015-2734, CVE-2015-2737, CVE-2015-2738) 
 - A memory corruption issue exists in the 'nsZipArchive::GetDataOffset()' function due to improper string length checks. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2735) 
 - A memory corruption issue exists in the 'nsZipArchive::BuildFileList()' function due to improper validation of user-supplied input. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2736) 
 - An unspecified memory corruption issue exists in the 'ArrayBufferBuilder::append()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2739) 
 - A buffer overflow condition exists in the 'nsXMLHttpRequest::AppendToResponseText()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2740) 
 - A security bypass vulnerability exists due to a flaw in certificate pinning checks. Key pinning is not enforced upon encountering an X.509 certificate problem that generates a user dialog. A man-in-the-middle attacker can exploit this to bypass intended access restrictions. (CVE-2015-2741) 
 - A privilege escalation vulnerability exists in the PDF viewer (PDF.js) due to internal workers being executed insecurely. An attacker can exploit this, by leveraging a Same Origin Policy bypass, to execute arbitrary code. (CVE-2015-2743) 
 - A man-in-the-middle vulnerability, known as Logjam, exists due to a flaw in the SSL/TLS protocol. A remote attacker can exploit this flaw to downgrade connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. (CVE-2015-4000)

Versions of Mozilla Thunderbird prior to 38.1 are outdated and thus unpatched for the following vulnerabilities : 

 - A security downgrade vulnerability exists due to a flaw in Network Security Services (NSS). When a client allows for a ECDHE_ECDSA exchange, but the server does not send a ServerKeyExchange message, then the NSS client will take the EC key from the ECDSA certificate. A remote attacker can exploit this to silently downgrade the exchange to a non-forward secret mixed-ECDH exchange. (CVE-2015-2721)
 - Multiple memory corruption issues exist that allow an attacker to cause a denial of service condition or potentially execute arbitrary code. (CVE-2015-2724, CVE-2015-2725)
 - A use-after-free error exists in the 'CSPService::ShouldLoad()' function when modifying the Document Object Model to remove a DOM object. An attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code. (CVE-2015-2731)
 - An uninitialized memory use issue exists in the 'CairoTextureClientD3D9::BorrowDrawTarget()' function, the '::d3d11::SetBufferData()' function, and the 'YCbCrImageDataDeserializer::ToDataSourceSurface()' function. The impact is unspecified. (CVE-2015-2734, CVE-2015-2737, CVE-2015-2738)
 - A memory corruption issue exists in the 'nsZipArchive::GetDataOffset()' function due to improper string length checks. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2735)
 - A memory corruption issue exists in the 'nsZipArchive::BuildFileList()' function due to improper validation of user-supplied input. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2736)
 - An unspecified memory corruption issue exists in the 'ArrayBufferBuilder::append()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2739)
 - A buffer overflow condition exists in the 'nsXMLHttpRequest::AppendToResponseText()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2740)
 - A security bypass vulnerability exists due to a flaw in certificate pinning checks. Key pinning is not enforced upon encountering an X.509 certificate problem that generates a user dialog. A man-in-the-middle attacker can exploit this to bypass intended access restrictions. (CVE-2015-2741)
 - A man-in-the-middle vulnerability, known as Logjam, exists due to a flaw in the SSL/TLS protocol. A remote attacker can exploit this flaw to downgrade connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. (CVE-2015-4000)

ID	名稱	產品	系列	已發布	已更新	嚴重性
84580	Firefox ESR < 38.1 多种漏洞 (Logjam)	Nessus	Windows	2015/7/7	2022/12/5	critical
84664	Ubuntu 14.04 LTS：Firefox 漏洞 (USN-2656-1)	Nessus	Ubuntu Local Security Checks	2015/7/13	2025/2/18	medium
84780	FreeBSD : mozilla -- 多种漏洞 (44d9daee-940c-4179-86bb-6e3ffd617869) (Logjam)	Nessus	FreeBSD Local Security Checks	2015/7/16	2022/12/5	low
84510	Debian DSA-3300-1 : iceweasel - security update (Logjam)	Nessus	Debian Local Security Checks	2015/7/6	2022/12/5	low
84576	Firefox ESR < 38.1 Multiple Vulnerabilities (Mac OS X) (Logjam)	Nessus	MacOS X Local Security Checks	2015/7/7	2022/12/5	critical
84577	Firefox < 39.0 Multiple Vulnerabilities (Mac OS X) (Logjam)	Nessus	MacOS X Local Security Checks	2015/7/7	2022/12/5	critical
84578	Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Mac OS X) (Logjam)	Nessus	MacOS X Local Security Checks	2015/7/7	2022/12/5	critical
84579	Firefox ESR < 31.8 Multiple Vulnerabilities (Logjam)	Nessus	Windows	2015/7/7	2022/12/5	critical
84580	Firefox ESR < 38.1 Multiple Vulnerabilities (Logjam)	Nessus	Windows	2015/7/7	2022/12/5	critical
84664	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2656-1)	Nessus	Ubuntu Local Security Checks	2015/7/13	2025/2/18	medium
84780	FreeBSD : mozilla -- multiple vulnerabilities (44d9daee-940c-4179-86bb-6e3ffd617869) (Logjam)	Nessus	FreeBSD Local Security Checks	2015/7/16	2022/12/5	low
84550	CentOS 5 / 6 / 7 : firefox (CESA-2015:1207)	Nessus	CentOS Local Security Checks	2015/7/7	2021/1/4	critical
8855	Mozilla Firefox < 39.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/9/9	2019/3/6	critical
8879	Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Logjam)	Nessus Network Monitor	SMTP Clients	2015/9/22	2019/3/6	critical

偵測

搜尋 Plugin

critical

medium

low

low

critical

critical

critical

critical

critical

medium

low

critical

critical

critical