Mozilla Firefox Security Advisory (MFSA2014-23) - Linux

This host is missing a security update for Mozilla Firefox.

Content Security Policy for data: documents not preserved by session restore Security researcher Nicolas Golubovic reported that the Content Security Policy (CSP) of data: documents was not saved as part of session restore. If an attacker convinced a victim to open a document from a data: URL injected onto a page, this can lead to a Cross-Site Scripting (XSS) attack. The target page may have a strict CSP that protects against this XSS attack, but if the attacker induces a browser crash with another bug, an XSS attack would occur during session restoration, bypassing the CSP on the site.

Firefox version(s) below 28.

Checks if a vulnerable package version is present on the target host.

The vendor has released an update. Please see the reference(s) for more information.