Hash: SHA1

                         AUSCERT Security Bulletin

         Numerous vulnerabilities have been identified in Mozilla
                   Firefox, Firefox ESR and Thunderbird.
                              15 October 2014


        AusCERT Security Bulletin Summary

Product:              Mozilla Firefox
                      Mozilla Firefox ESR
                      Mozilla Thunderbird
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Provide Misleading Information  -- Remote with User Interaction
                      Access Confidential Data        -- Remote with User Interaction
                      Unauthorised Access             -- Remote with User Interaction
                      Reduced Security                -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2014-1586 CVE-2014-1585 CVE-2014-1584
                      CVE-2014-1583 CVE-2014-1582 CVE-2014-1581
                      CVE-2014-1580 CVE-2014-1578 CVE-2014-1577
                      CVE-2014-1576 CVE-2014-1575 CVE-2014-1574
Member content until: Friday, November 14 2014


        Numerous vulnerabilities have been identified in Mozilla Firefox,
        Firefox ESR and Thunderbird. [1]


        The vendor has provided the following details regarding these 
        (CVE-2014-1574), (CVE-2014-1575): "Mozilla developers and community
        identified and fixed several memory safety bugs in the browser 
        engine used in Firefox and other Mozilla-based products. Some of 
        these bugs showed evidence of memory corruption under certain 
        circumstances, and we presume that with enough effort at least some
        of these could be exploited to run arbitrary code." [1]
        (CVE-2014-1576): "Using the Address Sanitizer tool, security 
        researcher Atte Kettunen from OUSPG discovered a buffer overflow 
        when making capitalization style changes during CSS parsing. This 
        can cause a crash that is potentially exploitable." [2]
        (CVE-2014-1577): "Security researcher Holger Fuhrmannek used the 
        Address Sanitizer tool to discover an out-of-bounds read issue with
        Web Audio when interacting with custom waveforms with invalid 
        values. This results in a crash and could allow for the reading of 
        random memory which may contain sensitive data, or of memory 
        addresses that could be used in combination with another bug." [3]
        (CVE-2014-1578): "Using the Address Sanitizer tool, security 
        researcher Abhishek Arya (Inferno) of the Google Chrome Security 
        Team found an out-of-bounds write when buffering WebM format video 
        containing frames with invalid tile sizes. This can lead to a 
        potentially exploitable crash during WebM video playback." [4]
        (CVE-2014-1580): "Google security researcher Michal Zalewski 
        reported that when a malformed GIF image is repeatedly rendered 
        within a <canvas> element, memory may not always be properly 
        initialized. The resulting series of images then uses this 
        uninitialized memory during rendering, allowing data to potentially
        leak to web content." [5]
        (CVE-2014-1581): "Security researcher regenrecht reported, via 
        TippingPoint's Zero Day Initiative, a use-after-free during text 
        layout when interacting with text direction. This results in a crash
        which can lead to arbitrary code execution." [6]
        (CVE-2014-1582), (CVE-2014-1584): "Mozilla developer Patrick McManus
        reported a method to use SPDY or HTTP/2 connection coalescing to 
        bypass key pinning on different sites that resolve to the same IP 
        address.This could allow the use of a fraudulent certificate when a
        saved pin for that subdomain should have prevented the connection. 
        This leads to possible man-in-the-middle attacks if an attacker has
        control of the DNS connection and the ability to obtain a fraudulent
        certificate that browsers would accept in the absence of the pin.
        Mozilla security engineer David Keeler discovered that when there 
        are specific problems verifying the issuer of an SSL certificate, 
        the checks necessary for key pinning would not be run. As a result,
        the user is then presented with the "Untrusted Connection" error 
        page, which they can use to bypass the key pinning process on a site
        that should be pinned. This error message is always shown to the 
        user and cannot be used to silently bypass key pinning on affected 
        sites." [7]
        (CVE-2014-1585), (CVE-2014-1586): "Mozilla developers Eric Shepherd
        and Jan-Ivar Bruaroey reported issues with privacy and video sharing
        using WebRTC. Once video sharing has started within a WebRTC session
        running within an <iframe>, video will continue to be shared even if
        the user selects the "e;Stop Sharing" button in the controls. The 
        camera will also remain on even if the user navigates to another 
        site and will begin streaming again if the user returns to the 
        original site. This is a privacy problem and can lead to inadvertent
        video streaming. This does not affect implementations that are not 
        within an <iframe>." [8]
        (CVE-2014-1583): "Mozilla developer Boris Zbarsky reported that a 
        malicious app could use the AlarmAPI to read the values of 
        cross-origin references, such as an iframe's location object, as 
        part of an alarm's JSON data. This allows a malicious app to bypass
        same-origin policy." [9]


        The vendor recommends updating to the latest version of the affected
        products to correct this issue. [1]


        [1] Mozilla Foundation Security Advisory 2014-74

        [2] Mozilla Foundation Security Advisory 2014-75

        [3] Mozilla Foundation Security Advisory 2014-76

        [4] Mozilla Foundation Security Advisory 2014-77

        [5] Mozilla Foundation Security Advisory 2014-78

        [6] Mozilla Foundation Security Advisory 2014-79

        [7] Mozilla Foundation Security Advisory 2014-80

        [8] Mozilla Foundation Security Advisory 2014-81

        [9] Mozilla Foundation Security Advisory 2014-82

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967