The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not limit the size of read operations, which might allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.

The remote host is affected by the vulnerability described in GLSA-201605-06 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, NSS, NSPR, and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms, or have other unspecified       impacts.
  Workaround :

    There is no known workaround at this time.

The version of Firefox is prior to 44.0 and is affected by multiple vulnerabilities : 

 - Multiple unspecified memory corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-1930, CVE-2016-1931)
 - An integer overflow condition exists due to improper parsing of GIF images during deinterlacing. A remote attacker can exploit this, via a specially crafted GIF image, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1933)
 - A buffer overflow condition exists in WebGL that is triggered when handling cache out-of-memory error conditions. A remote attacker can exploit this to execute arbitrary code. (CVE-2016-1935)
 - A content spoofing vulnerability exists due to the protocol handler dialog treating double click events as two single click events. A remote attacker can exploit this to spoof content, allowing the attacker to trick a user into performing malicious actions. (CVE-2016-1937)
 - A cryptographic weakness exists in Network Security Services (NSS) due to incorrect calculations with 'mp_div' and 'mp_exptmod'. (CVE-2016-1938)
 - A cookie injection vulnerability exists due to illegal control characters being permitted in cookie names. A remote attacker can exploit this to inject cookies. (CVE-2016-1939)
 - A flaw exists that is triggered as the delay between the download dialog getting focus and the button getting enabled is too short. If a context-dependent attacker can trick a user into double clicking in a specific location, they can pass the second click through to a dialog below that location. This will allow the attacker to cause the user to perform unintentional actions. (CVE-2016-1941)
 - An URL spoofing vulnerability exists due to a flaw that is triggered during the handling of a URL that invalid for the internal protocol, causing the URL to be pasted into the address bar. A remote attacker can exploit this spoof URLs, allowing the attacker to trick a user into visiting a malicious website. (CVE-2016-1942)
 - An unspecified memory corruption issue exists in the ANGLE graphics library implementation. A remote attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2016-1944)
 - A wild pointer flaw exists due to improper handling of ZIP files. A remote attacker can exploit this, via a crafted ZIP file, to have an unspecified impact. (CVE-2016-1945)
 - An integer overflow condition exists in the bundled version of libstagefright due to improper handling of MP4 file metadata. A remote attacker can exploit this to execute arbitrary code. (CVE-2016-1946)
 - A flaw exists in the safe browsing feature due to the Application Reputation service being unreachable. A remote attacker can exploit this to convince a user into downloading a malicious executable without being warned. (CVE-2016-1947)

This update fixes the following security related issues by updating packages to a more recent version :

Update of NSPR to 4.11 Update of NSS to 3.21 Update of Firefox to 44.0

  - MFSA 2016-01/CVE-2016-1930/CVE-2016-1931 Miscellaneous     memory safety hazards

  - MFSA 2016-02/CVE-2016-1933 (bmo#1231761) Out of Memory     crash when parsing GIF format images

  - MFSA 2016-03/CVE-2016-1935 (bmo#1220450) Buffer overflow     in WebGL after out of memory allocation

  - MFSA 2016-04/CVE-2015-7208/CVE-2016-1939 (bmo#1191423,     bmo#1233784) Firefox allows for control characters to be     set in cookie names

  - MFSA 2016-06/CVE-2016-1937 (bmo#724353) Missing delay     following user click events in protocol handler dialog

  - MFSA 2016-07/CVE-2016-1938 (bmo#1190248) Errors in     mp_div and mp_exptmod cryptographic functions in NSS     (fixed by requiring NSS 3.21)

  - MFSA 2016-09/CVE-2016-1942/CVE-2016-1943 (bmo#1189082,     bmo#1228590) Addressbar spoofing attacks

  - MFSA 2016-10/CVE-2016-1944/CVE-2016-1945/CVE-2016-1946     (bmo#1186621, bmo#1214782, bmo#1232096) Unsafe memory     manipulation found through code inspection

  - MFSA 2016-11/CVE-2016-1947 (bmo#1237103) Application     Reputation service disabled in Firefox 43

This update to MozillaFirefox fixes several security issues and bugs.

Mozilla Firefox was updated to 44.0. Mozilla NSS was updated to 3.21 Mozilla NSPR was updated to 4.11.

The following vulnerabilities were fixed :

  - CVE-2016-1930/CVE-2016-1931: Miscellaneous memory safety     hazards (boo#963633)

  - CVE-2016-1933: Out of Memory crash when parsing GIF     format images (boo#963634)

  - CVE-2016-1935: Buffer overflow in WebGL after out of     memory allocation (boo#963635)

  - CVE-2015-7208/CVE-2016-1939: Firefox allows for control     characters to be set in cookie names (boo#963637)

  - CVE-2016-1937: Missing delay following user click events     in protocol handler dialog (boo#963641)

  - CVE-2016-1938: Errors in mp_div and mp_exptmod     cryptographic functions in NSS (boo#963731)

  - CVE-2016-1942/CVE-2016-1943: Addressbar spoofing attacks     (boo#963643)

  - CVE-2016-1944/CVE-2016-1945/CVE-2016-1946: Unsafe memory     manipulation found through code inspection (boo#963644)

  - CVE-2016-1947: Application Reputation service disabled     in Firefox 43 (boo#963645)

The following change from Mozilla Firefox 43.0.4 is included :

  - Re-enable SHA-1 certificates to prevent outdated     man-in-the-middle security devices from interfering with     properly secured SSL/TLS connections

Mozilla Foundation reports :

MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0 / rv:38.6)

MFSA 2016-02 Out of Memory crash when parsing GIF format images

MFSA 2016-03 Buffer overflow in WebGL after out of memory allocation

MFSA 2016-04 Firefox allows for control characters to be set in cookie names

MFSA 2016-06 Missing delay following user click events in protocol handler dialog

MFSA 2016-09 Addressbar spoofing attacks

MFSA 2016-10 Unsafe memory manipulation found through code inspection

MFSA 2016-11 Application Reputation service disabled in Firefox 43

The version of Firefox installed on the remote Windows host is prior to 44. It is, therefore, affected by the following vulnerabilities :

  - A cookie injection vulnerability exists due to illegal     control characters being stored as cookie values in     violation of RFC6265. A remote attacker can exploit this     to inject cookies. (CVE-2015-7208)

  - Multiple unspecified memory corruption issues exist that     allow a remote attacker to execute arbitrary code.
    (CVE-2016-1930, CVE-2016-1931)

  - An integer overflow condition exists due to improper     parsing of GIF images during deinterlacing. A remote     attacker can exploit this, via a specially crafted GIF     image, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1933)

  - A buffer overflow condition exists in WebGL that is     triggered when handling cache out-of-memory error     conditions. A remote attacker can exploit this to     execute arbitrary code. (CVE-2016-1935)

  - A content spoofing vulnerability exists due to the     protocol handler dialog treating double click events as     two single click events. A remote attacker can exploit     this to spoof content, allowing the attacker to trick a     user into performing malicious actions. (CVE-2016-1937)

  - A cryptographic weakness exists in Network Security     Services (NSS) due to incorrect calculations with     'mp_div' and 'mp_exptmod'. (CVE-2016-1938)

  - A cookie injection vulnerability exists due to illegal     control characters being permitted in cookie names. A     remote attacker can exploit this to inject cookies.
    (CVE-2016-1939)

  - An URL spoofing vulnerability exists due to a flaw that     is triggered during the handling of a URL that invalid     for the internal protocol, causing the URL to be pasted     into the address bar. A remote attacker can exploit this     spoof URLs, allowing the attacker to trick a     user into visiting a malicious website. (CVE-2016-1942)

  - An unspecified memory corruption issue exists in the     ANGLE graphics library implementation. A remote attacker     can exploit this to corrupt memory, resulting in the     execution of arbitrary code. (CVE-2016-1944)

  - A wild pointer flaw exists due to improper handling of     ZIP files. A remote attacker can exploit this, via a     crafted ZIP file, to have an unspecified impact.
    (CVE-2016-1945)

  - An integer overflow condition exists in the bundled     version of libstagefright due to improper handling of     MP4 file metadata. A remote attacker can exploit this     to execute arbitrary code. (CVE-2016-1946)

  - A flaw exists in the safe browsing feature due to the     Application Reputation service being unreachable. A     remote attacker can exploit this to convince a user     into downloading a malicious executable without being     warned. (CVE-2016-1947)

  - A use-after-free error exists in Network Security     Services (NSS) due to improper handling of failed     allocations during DHE and ECDHE handshakes. An attacker     can exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-1978)

The version of Firefox installed on the remote Mac OS X host is prior to 44. It is, therefore, affected by the following vulnerabilities :

  - A cookie injection vulnerability exists due to illegal     control characters being stored as cookie values in     violation of RFC6265. A remote attacker can exploit this     to inject cookies. (CVE-2015-7208)

  - Multiple unspecified memory corruption issues exist that     allow a remote attacker to execute arbitrary code.
    (CVE-2016-1930, CVE-2016-1931)

  - An integer overflow condition exists due to improper     parsing of GIF images during deinterlacing. A remote     attacker can exploit this, via a specially crafted GIF     image, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1933)

  - A buffer overflow condition exists in WebGL that is     triggered when handling cache out-of-memory error     conditions. A remote attacker can exploit this to     execute arbitrary code. (CVE-2016-1935)

  - A content spoofing vulnerability exists due to the     protocol handler dialog treating double click events as     two single click events. A remote attacker can exploit     this to spoof content, allowing the attacker to trick a     user into performing malicious actions. (CVE-2016-1937)

  - A cryptographic weakness exists in Network Security     Services (NSS) due to incorrect calculations with     'mp_div' and 'mp_exptmod'. (CVE-2016-1938)

  - A cookie injection vulnerability exists due to illegal     control characters being permitted in cookie names. A     remote attacker can exploit this to inject cookies.
    (CVE-2016-1939)

  - An URL spoofing vulnerability exists due to a flaw that     is triggered during the handling of a URL that invalid     for the internal protocol, causing the URL to be pasted     into the address bar. A remote attacker can exploit this     spoof URLs, allowing the attacker to trick a     user into visiting a malicious website. (CVE-2016-1942)

  - An unspecified memory corruption issue exists in the     ANGLE graphics library implementation. A remote attacker     can exploit this to corrupt memory, resulting in the     execution of arbitrary code. (CVE-2016-1944)

  - A wild pointer flaw exists due to improper handling of     ZIP files. A remote attacker can exploit this, via a     crafted ZIP file, to have an unspecified impact.
    (CVE-2016-1945)

  - An integer overflow condition exists in the bundled     version of libstagefright due to improper handling of     MP4 file metadata. A remote attacker can exploit this     to execute arbitrary code. (CVE-2016-1946)

  - A flaw exists in the safe browsing feature due to the     Application Reputation service being unreachable. A     remote attacker can exploit this to convince a user     into downloading a malicious executable without being     warned. (CVE-2016-1947)

  - A use-after-free error exists in Network Security     Services (NSS) due to improper handling of failed     allocations during DHE and ECDHE handshakes. An attacker     can exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-1978)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2880-1 advisory.

    Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman, Carsten Book, Randell Jesup,     Nicolas Pierron, Eric Rescorla, Tyson Smith, and Gabor Krizsanits discovered multiple memory safety issues     in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit these to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Firefox. (CVE-2016-1930, CVE-2016-1931)

    Gustavo Grieco discovered an out-of-memory crash when loading GIF images in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could exploit this to cause a denial     of service. (CVE-2016-1933)

    Aki Helin discovered a buffer overflow when rendering WebGL content in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2016-1935)

    It was discovered that a delay was missing when focusing the protocol handler dialog. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct     clickjacking attacks. (CVE-2016-1937)

    Hanno Bck discovered that calculations with mp_div and mp_exptmod in NSS produce incorrect results in     some circumstances, resulting in cryptographic weaknesses. (CVE-2016-1938)

    Nicholas Hurley discovered that Firefox allows for control characters to be set in cookie names. An     attacker could potentially exploit this to conduct cookie injection attacks on some web servers.
    (CVE-2016-1939)

    It was discovered that when certain invalid URLs are pasted in to the addressbar, the addressbar contents     may be manipulated to show the location of arbitrary websites. An attacker could potentially exploit this     to conduct URL spoofing attacks. (CVE-2016-1942)

    Ronald Crane discovered three vulnerabilities through code inspection. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit these to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2016-1944, CVE-2016-1945, CVE-2016-1946)

    Franois Marier discovered that Application Reputation lookups didn't work correctly, disabling warnings     for potentially malicious downloads. An attacker could potentially exploit this by tricking a user in to     downloading a malicious file. Other parts of the Safe Browsing feature were unaffected by this.
    (CVE-2016-1947)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
91379	GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)	Nessus	Gentoo Local Security Checks	critical
9075	Mozilla Firefox < 44.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
88552	openSUSE Security Update : Mozilla Firefox (openSUSE-2016-131)	Nessus	SuSE Local Security Checks	critical
88549	openSUSE Security Update : the MozillaFirefox / mozilla-nss and mozilla-nspr (openSUSE-2016-128)	Nessus	SuSE Local Security Checks	critical
88512	FreeBSD : mozilla -- multiple vulnerabilities (4f00dac0-1e18-4481-95af-7aaad63fd303)	Nessus	FreeBSD Local Security Checks	critical
88461	Firefox < 44 Multiple Vulnerabilities	Nessus	Windows	critical
88459	Firefox < 44 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
88456	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2880-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2016-1946

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical