The maintenance service in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows does not prevent MAR extracted-file modification during updater execution, which might allow local users to gain privileges via a Trojan horse file.

Versions of Mozilla Firefox earlier than 47.0 are unpatched for the following vulnerabilities :

 - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-2815, CVE-2016-2818)
 - An overflow condition exists that is triggered when handling HTML5 fragments in foreign contexts (e.g., under <svg> nodes).  An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-2819)
 - A use-after-free error exists that is triggered when deleting DOM table elements in 'contenteditable' mode.  An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2821)
 - A spoofing vulnerability exists due to improper handling of SELECT elements.  An unauthenticated, remote attacker can exploit this to spoof the contents of the address bar. (CVE-2016-2822)
 - A same-origin bypass vulnerability exists that is triggered when handling 'location.host' property values set after the creation of invalid 'data:' URIs.  An unauthenticated, remote attacker can exploit this to partially bypass same-origin policy protections. (CVE-2016-2825)
 - A use-after-free error exists that is triggered when destroying the recycle pool of a texture used during the processing of WebGL content.  An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2828)
 - A flaw exists in 'browser/modules/webrtcUI.jsm' that is triggered when handling a large number of permission requests over a small period of time.  An unauthenticated, remote attacker can exploit this to cause the incorrect icon to be displayed in a given permission request, potentially resulting in a user approving unintended permission requests. (CVE-2016-2829)
 - A flaw exists that is triggered when handling paired fullscreen and pointerlock requests in combination with closing windows.  An unauthenticated, remote attacker can exploit this to create an unauthorized pointerlock, resulting in a denial of service condition.  Additionally, an attacker can exploit this to conduct spoofing and clickjacking attacks. (CVE-2016-2831)
 - An information disclosure vulnerability exists that is triggered when handling CSS pseudo-classes.  An unauthenticated, remote attacker can exploit this disclose a list of installed plugins. (CVE-2016-2832)
 - A Content Security Policy (CSP) bypass exists that is triggered when handling specially crafted cross-domain Java applets.  An unauthenticated, remote attacker can exploit this to bypass the CSP and conduct cross-site scripting attacks. (CVE-2016-2833)
 - Multiple unspecified flaws exist in the Mozilla Network Security Services (NSS) component that allow an attacker to have an unspecified impact. (CVE-2016-2834)

Versions of Mozilla Firefox earlier than 45.2 are unpatched for the following vulnerabilities :

 - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-2815, CVE-2016-2818)
 - An overflow condition exists that is triggered when handling HTML5 fragments in foreign contexts (e.g., under <svg> nodes).  An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-2819)
 - A use-after-free error exists that is triggered when deleting DOM table elements in 'contenteditable' mode.  An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2821)
 - A spoofing vulnerability exists due to improper handling of SELECT elements.  An unauthenticated, remote attacker can exploit this to spoof the contents of the address bar. (CVE-2016-2822)
 - An out-of-bounds write flaw in 'TSymbolTableLevel' is triggered when size values for array writes are not properly checked during WebGL shader operations. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2824)
 - A flaw exists in the Windows updater utility's 'toolkit/mozapps/update/updater/updater.cpp' extraction of files from MAR archives.  These files are not properly locked for writing, which may allow a local attacker to replace these files and potentially leverage them to gain elevated privileges. (CVE-2016-2826)
 - A use-after-free error exists that is triggered when destroying the recycle pool of a texture used during the processing of WebGL content.  An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2828)
 - A flaw exists that is triggered when handling paired fullscreen and pointerlock requests in combination with closing windows.  An unauthenticated, remote attacker can exploit this to create an unauthorized pointerlock, resulting in a denial of service condition.  Additionally, an attacker can exploit this to conduct spoofing and clickjacking attacks. (CVE-2016-2831)

The version of Firefox installed on the remote Windows host is prior to 47. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-2815, CVE-2016-2818)

  - An overflow condition exists that is triggered when     handling HTML5 fragments in foreign contexts (e.g.,     under <svg> nodes). An unauthenticated, remote attacker     can exploit this to cause a heap-based buffer overflow,     resulting in the execution of arbitrary code.
    (CVE-2016-2819)

  - A use-after-free error exists that is triggered when     deleting DOM table elements in 'contenteditable' mode.
    An unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-2821)

  - A spoofing vulnerability exists due to improper handling     of SELECT elements. An unauthenticated, remote attacker     can exploit this to spoof the contents of the address     bar. (CVE-2016-2822)

  - An out-of-bounds write error exists in the ANGLE     graphics library due to improper size checking while     writing to an array during WebGL shader operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-2824)

  - A same-origin bypass vulnerability exists that is     triggered when handling location.host property values     set after the creation of invalid 'data:' URIs. An     unauthenticated, remote attacker can exploit this to     partially bypass same-origin policy protections.
    (CVE-2016-2825)

  - A privilege escalation vulnerability exists in the     Windows updater utility due to improper extraction of     files from MAR archives. A local attacker can exploit     this to replace the extracted files, allowing the     attacker to gain elevated privileges. (CVE-2016-2826)

  - A use-after-free error exists that is triggered when     destroying the recycle pool of a texture used during the     processing of WebGL content. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2016-2828)

  - A flaw exists in browser/modules/webrtcUI.jsm that is     triggered when handling a large number of permission     requests over a small period of time. An     unauthenticated, remote attacker can exploit this to     cause the incorrect icon to be displayed in a given     permission request, potentially resulting in a user     approving unintended permission requests.
    (CVE-2016-2829)

  - A flaw exists that is triggered when handling paired     fullscreen and pointerlock requests in combination with     closing windows. An unauthenticated, remote attacker can     exploit this to create an unauthorized pointerlock,     resulting in a denial of service condition.
    Additionally, an attacker can exploit this to conduct     spoofing and clickjacking attacks. (CVE-2016-2831)

  - An information disclosure vulnerability exists that is     triggered when handling CSS pseudo-classes. An     unauthenticated, remote attacker can exploit this     disclose a list of installed plugins. (CVE-2016-2832)

  - A Content Security Policy (CSP) bypass exists that is     triggered when handling specially crafted cross-domain     Java applets. An unauthenticated, remote attacker can     exploit this to bypass the CSP and conduct cross-site     scripting attacks. (CVE-2016-2833)

  - Multiple unspecified flaws exist in the Mozilla Network     Security Services (NSS) component that allow an attacker     to have an unspecified impact. (CVE-2016-2834)

The version of Firefox ESR installed on the remote Windows host is 45.x prior to 45.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-2818)

  - An overflow condition exists that is triggered when     handling HTML5 fragments in foreign contexts (e.g.,     under <svg> nodes). An unauthenticated, remote attacker     can exploit this to cause a heap-based buffer overflow,     resulting in the execution of arbitrary code.
    (CVE-2016-2819)

  - A use-after-free error exists that is triggered when     deleting DOM table elements in 'contenteditable' mode.
    An unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-2821)

  - A spoofing vulnerability exists due to improper handling     of SELECT elements. An unauthenticated, remote attacker     can exploit this to spoof the contents of the address     bar. (CVE-2016-2822)

  - An out-of-bounds write error exists in the ANGLE     graphics library due to improper size checking while     writing to an array during WebGL shader operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-2824)

  - A privilege escalation vulnerability exists in the     Windows updater utility due to improper extraction of     files from MAR archives. A local attacker can exploit     this to replace the extracted files, allowing the     attacker to gain elevated privileges. (CVE-2016-2826)

  - A use-after-free error exists that is triggered when     destroying the recycle pool of a texture used during the     processing of WebGL content. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2016-2828)

  - A flaw exists that is triggered when handling paired     fullscreen and pointerlock requests in combination with     closing windows. An unauthenticated, remote attacker can     exploit this to create an unauthorized pointerlock,     resulting in a denial of service condition.
    Additionally, an attacker can exploit this to conduct     spoofing and clickjacking attacks. (CVE-2016-2831)

ID	Name	Product	Family	Type	Severity
9383	Mozilla Firefox < 47.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
9382	Mozilla Firefox ESR < 45.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
91547	Firefox < 47 Multiple Vulnerabilities	Nessus	Windows	Local	high
91546	Firefox ESR 45.x < 45.2 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2016-2826

high

Tenable Plugins

high

high

high

high