Test ID:	1.3.6.1.4.1.25623.1.1.12.2014.2424.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2424-1)
Summary:	The remote host is missing an update for the 'firefox' package(s) announced via the USN-2424-1 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the USN-2424-1 advisory. Vulnerability Insight: Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Christian Holler, Jon Coppeard, Eric Rahm, Byron Campen, Eric Rescorla, and Xidorn Quan discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1587, CVE-2014-1588) Cody Crews discovered a way to trigger chrome-level XBL bindings from web content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-1589) Joe Vennix discovered a crash when using XMLHttpRequest in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-1590) Muneaki Nishimura discovered that CSP violation reports did not remove path information in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2014-1591) Berend-Jan Wever discovered a use-after-free during HTML parsing. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1592) Abhishek Arya discovered a buffer overflow when parsing media content. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1593) Byoungyoung Lee, Chengyu Song, and Taesoo Kim discovered a bad cast in the compositor. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause undefined behaviour, a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1594) Affected Software/OS: 'firefox' package(s) on Ubuntu 12.04, Ubuntu 14.04, Ubuntu 14.10. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-1587 BugTraq ID: 71391 http://www.securityfocus.com/bid/71391 Debian Security Information: DSA-3090 (Google Search) http://www.debian.org/security/2014/dsa-3090 Debian Security Information: DSA-3092 (Google Search) http://www.debian.org/security/2014/dsa-3092 https://security.gentoo.org/glsa/201504-01 SuSE Security Announcement: openSUSE-SU-2015:0138 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html SuSE Security Announcement: openSUSE-SU-2015:1266 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html Common Vulnerability Exposure (CVE) ID: CVE-2014-1588 Common Vulnerability Exposure (CVE) ID: CVE-2014-1589 Common Vulnerability Exposure (CVE) ID: CVE-2014-1590 BugTraq ID: 71397 http://www.securityfocus.com/bid/71397 Common Vulnerability Exposure (CVE) ID: CVE-2014-1591 Common Vulnerability Exposure (CVE) ID: CVE-2014-1592 BugTraq ID: 71398 http://www.securityfocus.com/bid/71398 Common Vulnerability Exposure (CVE) ID: CVE-2014-1593 BugTraq ID: 71395 http://www.securityfocus.com/bid/71395 Common Vulnerability Exposure (CVE) ID: CVE-2014-1594 BugTraq ID: 71396 http://www.securityfocus.com/bid/71396
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.