The version of Thunderbird installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is a potential use-after-free issue in     DirectWrite font handling. This may allow an attacker     to potentially execute arbitrary code within the context     of the user running the application. (CVE-2014-1551)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-467:02 advisory.

    Description :
    nss     Network Security Services (NSS) is a set of libraries designed to     support cross-platform development of security-enabled client and     server applications. Applications built with NSS can support SSL v2     and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509     v3 certificates, and other security standards.
    nspr     NSPR provides platform independence for non-GUI operating system     facilities. These facilities include threads, thread synchronization,     normal file and network I/O, interval timing and calendar time, basic     memory management (malloc and free) and shared library linking.
    nss-util     Utilities for Network Security Services and the Softoken module     Security issues fixed with this release:
    CVE-2013-1740     The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before     3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL     servers by using an arbitrary X.509 certificate during certain handshake traffic.
    CVE-2014-1490     Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla     Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and     other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have     unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement     of a session ticket.
    CVE-2014-1491     Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR     24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly     restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to     bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
    CVE-2014-1492     The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in     Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an     internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL     servers via a crafted certificate.
    CVE-2014-1544     Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network     Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird     before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper     removal of an NSSCertificate structure from a trust domain.
    CVE-2014-1545     Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code     or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console     functions.
    enhancement;
    The nss ans nss-util package has been upgraded to upstream version 3.16.1,     and the nspr package has been upgraded to upstream version 4.10.6.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is a potential use-after-free issue in     DirectWrite font handling. This may allow an attacker     to potentially execute arbitrary code within the context     of the user running the application. (CVE-2014-1551)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

  - It may be possible to spoof drag and drop events in     web content. This may allow limited ability to interact     with the UI. (CVE-2014-1561)

A vulnerability has been found and corrected in mozilla NSS :

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).

The updated packages have been upgraded to the latest NSS (3.16.3) versions which is not vulnerable to this issue.

The nss 3.16.1 update done as part of MDVSA-2014:125 introduced a regression because of the upstream change: 'Imposed name constraints on the French government root CA ANSSI (DCISS)' The change wont work as currently implemented as the French government root CA signs more than 'gouv.fr' domains. So for now we revert that change until its properly fixed upstream (mga#13563).

Additionally the rootcerts package has also been updated to the latest version as of 2014-07-03, which adds, removes, and distrusts several certificates.

Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages :

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate (CVE-2014-1492).

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a signature malleability issue (CVE-2014-1568).

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00 (CVE-2014-1569).

Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions (CVE-2014-1545).

The sqlite3 packages have been upgraded to the 3.8.6 version due to an prerequisite to nss-3.17.x.

Additionally the rootcerts package has also been updated to the latest version as of 2014-11-17, which adds, removes, and distrusts several certificates.

The updated packages provides a solution for these security issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0917 advisory.

    nspr     [4.10.6-1]
    - Rebase to nspr-4.10.6
    - Resolves: rhbz#1112135

    nss     [3.16.1-4.0.1.el6_5]
    - Added nss-vendor.patch to change vendor

    [3.16.1-4]
    - Update some patches on account of the rebase
    - Resolves: Bug 1099619

    [3.16.1-3]
    - Backport nss-3.12.6 upstream fix required by Firefox 31
    - Resolves: Bug 1099619

    [3.16.1-2]
    - Remove two unused patches and apply a needed one that was missed
    - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1

    [3.16.1-1]
    - Update to nss-3.16.1
    - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1

    nss-util     [3.15.6-1]
    - Update to nss-3.16.1
    - Resolves: rhbz#1112136

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
76765	Mozilla Thunderbird < 31.0 Multiple Vulnerabilities	Nessus	Windows	2014/7/24	2019/11/26	critical
289418	MiracleLinux 4 : nss-3.16.1-4.AXS4, nss-util-3.16.1-1.AXS4,nspr-4.10.6-1.AXS4 (AXSA:2014-467:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
76763	Firefox < 31.0 Multiple Vulnerabilities	Nessus	Windows	2014/7/24	2026/6/23	critical
76885	Mandriva Linux Security Advisory : nss (MDVSA-2014:139)	Nessus	Mandriva Local Security Checks	2014/7/30	2021/1/6	critical
81942	Mandriva Linux Security Advisory : nss (MDVSA-2015:059)	Nessus	Mandriva Local Security Checks	2015/3/19	2021/1/6	critical
76694	Oracle Linux 6 : nss / and / nspr (ELSA-2014-0917)	Nessus	Oracle Linux Local Security Checks	2014/7/23	2024/10/23	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical