The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging certain local file execution.

The remote host is affected by the vulnerability described in GLSA-201701-15 (Mozilla Firefox, Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition via       multiple vectors.
  Workaround :

    There is no known workaround at this time.

Versions of Mozilla Firefox earlier than 46.0 are unpatched for the following vulnerabilities :

 - Multiple memory corruption issues exist that allow an attacker to corrupt memory, resulting in the execution of arbitrary code. (CVE-2016-2804, CVE-2016-2806, CVE-2016-2807)
 - A flaw exists due to improper validation of user-supplied input when handling the 32-bit generation count of the underlying HashMap.  A context-dependent attacker can exploit this to cause a buffer overflow condition, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-2808)
 - A local privilege escalation vulnerability exists in the Maintenance Service updater due to improper handling of long log file paths.  A local attacker can exploit this to delete arbitrary files and gain elevated privileges. (CVE-2016-2809)
 - A remote code execution vulnerability exists due to a use-after-free error in the 'BeginReading()' function.  A context-dependent attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2811)
 - A remote code execution vulnerability exists due to a race condition in 'ServiceWorkerManager' in the 'get()' function.  A context-dependent attacker can exploit this to execute arbitrary code. (CVE-2016-2812)
 - A heap buffer overflow condition exists in the Google Stagefright component due to improper validation of user-supplied input when handling CENC offsets and the sizes table.  A context-dependent attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-2814)
 - A security bypass vulnerability exists due to the Content Security Policy (CSP) not being properly applied to web content sent with the 'multipart/x-mixed-replace' MIME-type.  A context-dependent attacker can exploit this to bypass CSP protection. (CVE-2016-2816)
 - A cross-site scripting (XSS) vulnerability exists due to improper restriction of unprivileged 'javascript: URL' navigation.  A context-dependent attacker can exploit this, via a specially crafted request, to execute arbitrary script code in the context of a user's browser session. (CVE-2016-2817)
 - A flaw exists in the Firefox Health Report that is triggered when it accepts any content document events that are presented in its iframe.  A context-dependent attacker can exploit this to manipulate sharing preferences. (CVE-2016-2820)

This update to Mozilla Firefox 46.0 fixes several security issues and bugs (boo#977333).

The following vulnerabilities were fixed :

  - CVE-2016-2804: Miscellaneous memory safety hazards -     MFSA 2016-39 (boo#977373)

  - CVE-2016-2806: Miscellaneous memory safety hazards -     MFSA 2016-39 (boo#977375)

  - CVE-2016-2807: Miscellaneous memory safety hazards -     MFSA 2016-39 (boo#977376)

  - CVE-2016-2808: Write to invalid HashMap entry through     JavaScript.watch()

  - MFSA 2016-47 (boo#977386)

  - CVE-2016-2811: Use-after-free in Service Worker - MFSA     2016-42 (boo#977379)

  - CVE-2016-2812: Buffer overflow in Service Worker - MFSA     2016-42 (boo#977379)

  - CVE-2016-2814: Buffer overflow in libstagefright with     CENC offsets - MFSA 2016-44 (boo#977381)

  - CVE-2016-2816: CSP not applied to pages sent with     multipart/x-mixed-replace - MFSA 2016-45 (boo#977382)

  - CVE-2016-2817: Elevation of privilege with     chrome.tabs.update API in web extensions - MFSA 2016-46     (boo#977384)

  - CVE-2016-2820: Firefox Health Reports could accept     events from untrusted domains - MFSA 2016-48     (boo#977388)

    The following miscellaneous changes are included :

  - Improved security of the JavaScript Just In Time (JIT)     Compiler

  - WebRTC fixes to improve performance and stability

  - Added support for document.elementsFromPoint

  - Added HKDF support for Web Crypto API

The minimum requirements increased to NSPR 4.12 and NSS 3.22.3.

Mozilla NSS was updated to 3.22.3 as a dependency for Mozilla Firefox 46.0, with the following changes :

  - Increase compatibility of TLS extended master secret,     don't send an empty TLS extension last in the handshake     (bmo#1243641)

  - RSA-PSS signatures are now supported

  - Pseudorandom functions based on hashes other than SHA-1     are now supported

  - Enforce an External Policy on NSS from a config file

The version of Firefox installed on the remote Windows host is prior to 46. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     attacker to corrupt memory, resulting in the execution     of arbitrary code. (CVE-2016-2804, CVE-2016-2806,     CVE-2016-2807)

  - A flaw exists due to improper validation of     user-supplied input when handling the 32-bit generation     count of the underlying HashMap. A context-dependent     attacker can exploit this to cause a buffer overflow     condition, resulting in a denial of service or the     execution of arbitrary code. (CVE-2016-2808)

  - A local privilege escalation vulnerability exists in the     Maintenance Service updater due to improper handling of     long log file paths. A local attacker can exploit this     to delete arbitrary files and gain elevated privileges.
    (CVE-2016-2809)

  - A remote code execution vulnerability exists due to a     use-after-free error in the BeginReading() function. A     context-dependent attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-2811)

  - A remote code execution vulnerability exists due to a     race condition in ServiceWorkerManager in the get()     function. A context-dependent attacker can exploit this     to execute arbitrary code. (CVE-2016-2812)

  - A heap buffer overflow condition exists in the Google     Stagefright component due to improper validation of     user-supplied input when handling CENC offsets and the     sizes table. A context-dependent attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-2814)

  - A security bypass vulnerability exists due to the     Content Security Policy (CSP) not being properly applied     to web content sent with the 'multipart/x-mixed-replace'     MIME-type. A context-dependent attacker can exploit this     to bypass CSP protection. (CVE-2016-2816)

  - A cross-site scripting (XSS) vulnerability exists due to     improper restriction of unprivileged 'javascript: URL'     navigation. A context-dependent attacker can exploit     this, via a specially crafted request, to execute     arbitrary script code in the context of a user's browser     session. (CVE-2016-2817)

  - A flaw exists in the Firefox Health Report that is     triggered when it accepts any content document events     that are presented in its iframe. A context-dependent     attacker can exploit this to manipulate sharing     preferences. (CVE-2016-2820)

ID	Name	Product	Family	Type	Severity
96276	GLSA-201701-15 : Mozilla Firefox, Thunderbird: Multiple vulnerabilities (SWEET32)	Nessus	Gentoo Local Security Checks	Local	critical
9380	Mozilla Firefox < 46.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
91069	openSUSE Security Update : Firefox 46.0 (openSUSE-2016-566) (SWEET32)	Nessus	SuSE Local Security Checks	Local	high
90793	Firefox < 46 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2016-2809

medium

Tenable Plugins

critical

high

high

high