Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan horse DLL in (1) the current working directory or (2) a temporary directory, as demonstrated by bcrypt.dll.

Versions of Mozilla Firefox ESR prior to 31.5 are unpatched for the following vulnerabilities : 

 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)


NOTE : The following vulnerabilities exist only within the stable release, and do not affect any Firefox ESR releases :

 - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832)
 - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830)
 - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in plaintext connections. (CVE-2015-0834)
 - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829)
 - A double-free issue exists when sending a zero-length 'XmlHttpRequest' (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828)
 - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825)
 - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826)
 - An issue exists in the 'DrawTarget()' function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824)
 - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823)
 - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821)

The version of Firefox installed on the remote Windows host is prior to 38.0. It is, therefore, affected by the following vulnerabilities :

  - A privilege escalation vulnerability exists in the     Inter-process Communications (IPC) implementation due     to a failure to validate the identity of a listener     process. (CVE-2011-3079)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. (CVE-2015-0833 /     CVE-2015-2720)

  - Multiple memory corruption issues exist within the     browser engine. A remote attacker can exploit these to     corrupt memory and execute arbitrary code.
    (CVE-2015-2708, CVE-2015-2709)

  - A buffer overflow condition exists in SVGTextFrame.cpp     when rendering SVG graphics that are combined with     certain CSS properties due to improper validation of     user-supplied input. A remote attacker can exploit this     to cause a heap-based buffer overflow, resulting in the     execution of arbitrary code. (CVE-2015-2710)     
  - A security bypass vulnerability exists due to the     referrer policy not being enforced in certain situations     when opening links (e.g. using the context menu or a     middle-clicks by mouse). A remote attacker can exploit     this to bypass intended policy settings. (CVE-2015-2711)     
  - An out-of-bounds read and write issue exists in the     CheckHeapLengthCondition() function due to improper     JavaScript validation of heap lengths. A remote attacker     can exploit this, via a specially crafted web page, to     disclose memory contents. (CVE-2015-2712)

  - A use-after-free error exists due to improper processing     of text when vertical text is enabled. A remote attacker     can exploit this to dereference already freed memory.
    (CVE-2015-2713)

  - A use-after-free error exists in the     RegisterCurrentThread() function in nsThreadManager.cpp     due to a race condition related to media decoder threads     created during the shutdown process. A remote attacker     can exploit this to dereference already freed memory.
    (CVE-2015-2715)

  - A buffer overflow condition exists in the     XML_GetBuffer() function in xmlparse.c due to improper     validation of user-supplied input when handling     compressed XML content. An attacker can exploit this to     cause a buffer overflow, resulting in the execution of     arbitrary code. (CVE-2015-2716)

  - An integer overflow condition exists in the parseChunk()     function in MPEG4Extractor.cpp due to improper handling     of MP4 video metadata in chunks. A remote attacker can     exploit this, via specially crafted media content, to     cause a heap-based buffer overflow, resulting in the     execution of arbitrary code. (CVE-2015-2717)

  - A security bypass vulnerability exists in WebChannel.jsm     due to improper handling of message traffic. An     untrusted page hosting a trusted page within an iframe     can intercept webchannel responses for the trusted page.
    This allows a remote attacker, via a specially crafted     web page, to bypass origin restrictions, resulting in     the disclosure of sensitive information. (CVE-2015-2718)

  - Multiple integer overflow conditions exist in the     bundled libstagefright component due to improper     validation of user-supplied input when processing MPEG4     sample metadata. A remote attacker can exploit this, via     specially crafted media content, to execute arbitrary     code. (CVE-2015-4496)

The Mozilla Project reports :

MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)

MFSA-2015-47 Buffer overflow parsing H.264 video with Linux Gstreamer

MFSA-2015-48 Buffer overflow with SVG content and CSS

MFSA-2015-49 Referrer policy ignored when links opened by middle-click and context menu

MFSA-2015-50 Out-of-bounds read and write in asm.js validation

MFSA-2015-51 Use-after-free during text processing with vertical text enabled

MFSA-2015-52 Sensitive URL encoded information written to Android logcat

MFSA-2015-53 Use-after-free due to Media Decoder Thread creation during shutdown

MFSA-2015-54 Buffer overflow when parsing compressed XML

MFSA-2015-55 Buffer overflow and out-of-bounds read while parsing MP4 video metadata

MFSA-2015-56 Untrusted site hosting trusted page can intercept webchannel responses

MFSA-2015-57 Privilege escalation through IPC channel messages

MFSA-2015-58 Mozilla Windows updater can be run outside of application directory

MFSA 2015-93 Integer overflows in libstagefright while processing MP4 video metadata

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

Versions of Mozilla Thunderbird prior to 31.5 are prone to the following vulnerabilities : 

 - Multiple unspecified memory safety issues exist within the engine. (CVE-2015-0835, CVE-2015-0836)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)

SeaMonkey was updated to 2.33 (bnc#917597)

  - MFSA 2015-11/CVE-2015-0835/CVE-2015-0836 Miscellaneous     memory safety hazards

  - MFSA 2015-12/CVE-2015-0833 (bmo#945192) Invoking Mozilla     updater will load locally stored DLL files (Windows     only)

  - MFSA 2015-13/CVE-2015-0832 (bmo#1065909) Appended period     to hostnames can bypass HPKP and HSTS protections

  - MFSA 2015-14/CVE-2015-0830 (bmo#1110488) Malicious WebGL     content crash when writing strings

  - MFSA 2015-15/CVE-2015-0834 (bmo#1098314) TLS TURN and     STUN connections silently fail to simple TCP connections

  - MFSA 2015-16/CVE-2015-0831 (bmo#1130514) Use-after-free     in IndexedDB

  - MFSA 2015-17/CVE-2015-0829 (bmo#1128939) Buffer overflow     in libstagefright during MP4 video playback

  - MFSA 2015-18/CVE-2015-0828 (bmo#1030667, bmo#988675)     Double-free when using non-default memory allocators     with a zero-length XHR

  - MFSA 2015-19/CVE-2015-0827 (bmo#1117304) Out-of-bounds     read and write while rendering SVG content

  - MFSA 2015-20/CVE-2015-0826 (bmo#1092363) Buffer overflow     during CSS restyling

  - MFSA 2015-21/CVE-2015-0825 (bmo#1092370) Buffer     underflow during MP3 playback

  - MFSA 2015-22/CVE-2015-0824 (bmo#1095925) Crash using     DrawTarget in Cairo graphics library

  - MFSA 2015-23/CVE-2015-0823 (bmo#1098497) Use-after-free     in Developer Console date with OpenType Sanitiser

  - MFSA 2015-24/CVE-2015-0822 (bmo#1110557) Reading of     local files through manipulation of form autocomplete

  - MFSA 2015-25/CVE-2015-0821 (bmo#1111960) Local files or     privileged URLs in pages can be opened into new tabs

  - MFSA 2015-26/CVE-2015-0819 (bmo#1079554) UI Tour     whitelisted sites in background tab can spoof foreground     tabs

  - MFSA 2015-27CVE-2015-0820 (bmo#1125398) Caja Compiler     JavaScript sandbox bypass

Update to SeaMonkey 2.32.1

  - fixed MailNews feeds not updating

  - fixed selected profile in Profile Manager not remembered

  - fixed opening a bookmark folder in tabs on Linux

  - fixed Troubleshooting Information (about:support) with     the Modern theme

Versions of Mozilla Firefox earlier than 36.0 are unpatched for the following vulnerabilities : 

 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)


NOTE : The following vulnerabilities exist only within the stable release, and do not affect any Firefox ESR releases :

 - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832)
 - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830)
 - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in plaintext connections. (CVE-2015-0834)
 - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829)
 - A double-free issue exists when sending a zero-length 'XmlHttpRequest' (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828)
 - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825)
 - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826)
 - An issue exists in the 'DrawTarget()' function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824)
 - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823)
 - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821)

The Mozilla Project reports :

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)

MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files

MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections

MFSA-2015-14 Malicious WebGL content crash when writing strings

MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections

MFSA-2015-16 Use-after-free in IndexedDB

MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback

MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR

MFSA-2015-19 Out-of-bounds read and write while rendering SVG content

MFSA-2015-20 Buffer overflow during CSS restyling

MFSA-2015-21 Buffer underflow during MP3 playback

MFSA-2015-22 Crash using DrawTarget in Cairo graphics library

MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser

MFSA-2015-24 Reading of local files through manipulation of form autocomplete

MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs

MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass

The version of Thunderbird installed on the remote Windows host is prior to 31.5. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. Note that hosts are only     affected if the updater is not run by the Mozilla     Maintenance Service. (CVE-2015-0833)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

The version of Firefox installed on the remote Windows host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. Note that hosts are only     affected if the updater is not run by the Mozilla     Maintenance Service. (CVE-2015-0833)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.5. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. Note that hosts are only     affected if the updater is not run by the Mozilla     Maintenance Service. (CVE-2015-0833)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

ID	Name	Product	Family	Severity
701251	Mozilla Firefox ESR < 31.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
83439	Firefox < 38.0 Multiple Vulnerabilities	Nessus	Windows	critical
83389	FreeBSD : mozilla -- multiple vulnerabilities (d9b43004-f5fd-4807-b1d7-dbf66455b244)	Nessus	FreeBSD Local Security Checks	critical
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
8676	Mozilla Thunderbird < 31.5 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
82013	openSUSE Security Update : seamonkey (openSUSE-2015-250)	Nessus	SuSE Local Security Checks	high
8653	Mozilla Firefox < 36.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
81588	FreeBSD : mozilla -- multiple vulnerabilities (99029172-8253-407d-9d8b-2cfeab9abf81)	Nessus	FreeBSD Local Security Checks	high
81522	Mozilla Thunderbird < 31.5 Multiple Vulnerabilities	Nessus	Windows	high
81521	Firefox < 36 Multiple Vulnerabilities	Nessus	Windows	high
81520	Firefox ESR 31.x < 31.5 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-0833

high

Tenable Plugins

high

critical

critical

critical

high

high

high

high

high

high

high