KLA10120 Multiple vulnerabilities in Mozilla

Multiple critical vulnerabilities have been found in Mozilla products. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code, bypass security restrictions or gain privileges. Below is a complete list of vulnerabilities

1. Vectors related to the SVG filter can be exploited remotely via timing attacks;
2. Multiple unknown vulnerabilities can be exploited remotely via unknown vectors;
3. Vectors related to unknown applications can be exploited locally via update content manipulations;
4. Vectors related to DecodeAudioData can be exploited remotely via a specially designed WAV file;
5. Vectors related to MathML polygon rendering can be exploited remotely via unknown applications;
6. A buffer overflow can be exploited remotely via a specially designed extension.

Original advisories

MFSA

Related products

Mozilla-Firefox

Mozilla-Thunderbird

Mozilla-SeaMonkey

Mozilla-Firefox-ESR

CVE list

CVE-2014-1508 high

CVE-2014-1497 high

CVE-2014-1496 warning

CVE-2014-1494 critical

CVE-2014-1509 high

CVE-2014-1505 warning

CVE-2014-1493 critical

Solution

Update to latest versionSeamonkeyFirefox

Thunderbird

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Mozilla Firefox versions 27.0.1 and earlierWaterfox Firefox versions 27.0.1 and earlierMozilla Firefox ESR versions 24.3 and earlierMozilla Thunderbird versions 24.3 and earlierMozilla Seamonkey versions 2.24 and earlierCometBird all versions