Test ID:	1.3.6.1.4.1.25623.1.0.881902
Category:	CentOS Local Security Checks
Title:	CentOS Update for firefox CESA-2014:0310 centos6
Summary:	The remote host is missing an update for the 'firefox'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the referenced advisory. Vulnerability Insight: Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O'Callahan, Mariusz Mlynski, Juri Aedla, George Hotz, and the security research firm VUPEN as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 24.4.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. Affected Software/OS: firefox on CentOS 6 Solution: Please install the updated packages. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-1493 BugTraq ID: 66412 http://www.securityfocus.com/bid/66412 Debian Security Information: DSA-2881 (Google Search) http://www.debian.org/security/2014/dsa-2881 Debian Security Information: DSA-2911 (Google Search) http://www.debian.org/security/2014/dsa-2911 https://security.gentoo.org/glsa/201504-01 RedHat Security Advisories: RHSA-2014:0310 http://rhn.redhat.com/errata/RHSA-2014-0310.html RedHat Security Advisories: RHSA-2014:0316 http://rhn.redhat.com/errata/RHSA-2014-0316.html SuSE Security Announcement: SUSE-SU-2014:0418 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html SuSE Security Announcement: openSUSE-SU-2014:0419 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html SuSE Security Announcement: openSUSE-SU-2014:0448 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html SuSE Security Announcement: openSUSE-SU-2014:0584 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.html http://www.ubuntu.com/usn/USN-2151-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-1497 BugTraq ID: 66423 http://www.securityfocus.com/bid/66423 Common Vulnerability Exposure (CVE) ID: CVE-2014-1505 BugTraq ID: 66418 http://www.securityfocus.com/bid/66418 Common Vulnerability Exposure (CVE) ID: CVE-2014-1508 BugTraq ID: 66426 http://www.securityfocus.com/bid/66426 Common Vulnerability Exposure (CVE) ID: CVE-2014-1509 BugTraq ID: 66425 http://www.securityfocus.com/bid/66425 Common Vulnerability Exposure (CVE) ID: CVE-2014-1510 BugTraq ID: 66206 http://www.securityfocus.com/bid/66206 Common Vulnerability Exposure (CVE) ID: CVE-2014-1511 BugTraq ID: 66207 http://www.securityfocus.com/bid/66207 Common Vulnerability Exposure (CVE) ID: CVE-2014-1512 BugTraq ID: 66209 http://www.securityfocus.com/bid/66209 Bugtraq: 20140326 VUPEN Security Research - Mozilla Firefox "BumpChunk" Object Processing Use-after-free (Pwn2Own) (Google Search) http://archives.neohapsis.com/archives/bugtraq/2014-03/0145.html Common Vulnerability Exposure (CVE) ID: CVE-2014-1513 BugTraq ID: 66203 http://www.securityfocus.com/bid/66203 Common Vulnerability Exposure (CVE) ID: CVE-2014-1514 BugTraq ID: 66240 http://www.securityfocus.com/bid/66240
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.