Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox < 50.1.

Versions of Mozilla Firefox prior to 50.1 are unpatched for the following vulnerabilities :

 - A flaw exists in 'layout/style/nsRuleNode.cpp' that is triggered when handling style contexts. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'GrResourceProvider::createBuffer()' function in 'gfx/skia/skia/src/gpu/GrResourceProvider.cpp'. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling clamped gradients. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A flaw exists in the 'GetNPObjectWrapper()' function in 'dom/plugins/base/nsJSNPRuntime.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ObjectGroup::defaultNewGroup()' function in 'js/src/vm/ObjectGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling HTML5 content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsDocShell::RestoreFromHistory()' function in 'docshell/base/nsDocShell.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'Factory::CreateDrawTargetForData()' function in 'gfx/2d/Factory.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaRecorder.cpp' that is triggered when handling a document's activity state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHttpChunkedDecoder::ParseChunkRemaining()' function in 'network/protocol/http/nsHttpChunkedDecoder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling media content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/BindingUtils.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists because 'addon-sdk/source/lib/sdk/ui/frame/view.html' and 'addon-sdk/source/lib/sdk/ui/frame/view.js' within the Add-ons SDK do not properly validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and an add-on.
 - A use-after-free error exists in the handling of navigator objects within WebVR. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling DOM subtrees. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'VaryingPacking::packVarying()' function in 'libANGLE/renderer/d3d/hlsl/VaryingPacking.cpp'. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling failing node adoption. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as event handlers for marquee elements are executed despite restrictions against inline JavaScript. This may allow a context-dependent attacker to bypass the Content Security Policy (CSP).
 - A flaw exists in the 'nsDataDocumentContentPolicy::ShouldLoad()' function in 'dom/base/nsDataDocumentContentPolicy.cpp', as external resources may be inappropriately loaded by SVG images by utilizing 'data: URLs'. This may allow a context-dependent to disclose potentially sensitive cross-domain information.
 - A flaw exists that is triggered as HTML tags from the Pocket server are not properly sanitized before use. This may allow a context-dependent attacker to inject content and gain access to the Pocket Messaging API.
 - A flaw exists in 'browser/extensions/pocket/content/main.js' related to the Pocket toolbar button, as it fails to properly verify the origin of events. This may potentially allow a context-dependent attacker to execute commands from other contexts.
 - A flaw exists that is triggered as atom information may be exposed. This may allow a context-dependent attacker to use a JavaScript Map/Set timing attack to determine if atoms are used by other compartments or zones, potentially disclosing cross-domain information.

This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities :

  - CVE-2016-9894: Buffer overflow in SkiaGL

  - CVE-2016-9899: Use-after-free while manipulating DOM     events and audio elements

  - CVE-2016-9895: CSP bypass using marquee tag

  - CVE-2016-9896: Use-after-free with WebVR

  - CVE-2016-9897: Memory corruption in libGLES

  - CVE-2016-9898: Use-after-free in Editor while     manipulating DOM subtrees

  - CVE-2016-9900: Restricted external resources can be     loaded by SVG images through data URLs

  - CVE-2016-9904: Cross-origin information leak in shared     atoms

  - CVE-2016-9901: Data from Pocket server improperly     sanitized before execution

  - CVE-2016-9902: Pocket extension does not validate the     origin of events

  - CVE-2016-9903: XSS injection vulnerability in add-ons     SDK

  - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

  - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1     and Firefox ESR 45.6

    The following bugs were fixed :

  - boo#1011922: fix crash after a few seconds of usage on     AArch64

This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities :

  - CVE-2016-9894: Buffer overflow in SkiaGL

  - CVE-2016-9899: Use-after-free while manipulating DOM     events and audio elements

  - CVE-2016-9895: CSP bypass using marquee tag

  - CVE-2016-9896: Use-after-free with WebVR

  - CVE-2016-9897: Memory corruption in libGLES

  - CVE-2016-9898: Use-after-free in Editor while     manipulating DOM subtrees

  - CVE-2016-9900: Restricted external resources can be     loaded by SVG images through data URLs

  - CVE-2016-9904: Cross-origin information leak in shared     atoms

  - CVE-2016-9901: Data from Pocket server improperly     sanitized before execution

  - CVE-2016-9902: Pocket extension does not validate the     origin of events

  - CVE-2016-9903: XSS injection vulnerability in add-ons     SDK

  - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

  - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1     and Firefox ESR 45.6

The following bugs were fixed :

  - boo#1011922: fix crash after a few seconds of usage on     AArch64

The version of Mozilla Firefox installed on the remote Windows host is prior to 50.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exists when handling     style contexts, regular expressions, and clamped     gradients that allow an unauthenticated, remote attacker     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2016-9080)

  - Multiple memory corruption issues exists, such as when     handling document state changes or HTML5 content, or     else due to dereferencing already freed memory or     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-9893)

  - A buffer overflow condition exists in SkiaGl, within the     GrResourceProvider::createBuffer() function in file     gfx/skia/skia/src/gpu/GrResourceProvider.cpp, due to a     GrGLBuffer being truncated during allocation. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-9894)

  - A security bypass vulnerability exists due to event     handlers for marquee elements being executed despite a     Content Security Policy (CSP) that disallowed inline     JavaScript. An unauthenticated, remote attacker can     exploit this to impact integrity. (CVE-2016-9895)

  - A use-after-free error exists within WebVR when handling     the navigator object. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2016-9896)

  - A memory corruption issue exists in libGLES when WebGL     functions use a vector constructor with a varying array     within libGLES. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-9897)

  - A use-after-free error exists in Editor, specifically     within file editor/libeditor/HTMLEditor.cpp, when     handling DOM subtrees. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-9898)

  - A use-after-free error exists in the     nsNodeUtils::CloneAndAdopt() function within file     dom/base/nsNodeUtils.cpp, while manipulating DOM events     and removing audio elements, due to improper handling of     failing node adoption. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-9899)

  - A security bypass vulnerability exists in the     nsDataDocumentContentPolicy::ShouldLoad() function     within file dom/base/nsDataDocumentContentPolicy.cpp     that allows external resources to be inappropriately     loaded by SVG images by utilizing 'data:' URLs. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-domain information.
    (CVE-2016-9900)

  - A flaw exists due to improper sanitization of HTML tags     received from the Pocket server. An unauthenticated,     remote attacker can exploit this to run JavaScript code     in the about:pocket-saved (unprivileged) page, giving it     access to Pocket's messaging API through HTML injection.
    (CVE-2016-9901)

  - A flaw exists in the Pocket toolbar button, specifically     in browser/extensions/pocket/content/main.js, due to     improper verification of the origin of events fired from     its own pages. An unauthenticated, remote attacker can     exploit this to inject content and commands from other     origins into the Pocket context. Note that this issue     does not affect users with e10s enabled. (CVE-2016-9902)

  - A universal cross-site scripting (XSS) vulnerability     exists in the Add-ons SDK, specifically within files     addon-sdk/source/lib/sdk/ui/frame/view.html and     addon-sdk/source/lib/sdk/ui/frame/view.js, due to     improper validation of input before returning it to     users. An unauthenticated, remote attacker can exploit     this, via a specially crafted request, to execute     arbitrary script code in a user's browser session.
    (CVE-2016-9903)

  - An information disclosure vulnerability exists that     allows an unauthenticated, remote attacker to determine     whether an atom is used by another compartment or zone     in specific contexts, by utilizing a JavaScript Map/Set     timing attack. (CVE-2016-9904)

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 50.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exists when handling     style contexts, regular expressions, and clamped     gradients that allow an unauthenticated, remote attacker     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2016-9080)

  - Multiple memory corruption issues exists, such as when     handling document state changes or HTML5 content, or     else due to dereferencing already freed memory or     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-9893)

  - A buffer overflow condition exists in SkiaGl, within the     GrResourceProvider::createBuffer() function in file     gfx/skia/skia/src/gpu/GrResourceProvider.cpp, due to a     GrGLBuffer being truncated during allocation. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-9894)

  - A security bypass vulnerability exists due to event     handlers for marquee elements being executed despite a     Content Security Policy (CSP) that disallowed inline     JavaScript. An unauthenticated, remote attacker can     exploit this to impact integrity. (CVE-2016-9895)

  - A use-after-free error exists within WebVR when handling     the navigator object. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2016-9896)

  - A memory corruption issue exists in libGLES when WebGL     functions use a vector constructor with a varying array     within libGLES. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-9897)

  - A use-after-free error exists in Editor, specifically     within file editor/libeditor/HTMLEditor.cpp, when     handling DOM subtrees. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-9898)

  - A use-after-free error exists in the     nsNodeUtils::CloneAndAdopt() function within file     dom/base/nsNodeUtils.cpp, while manipulating DOM events     and removing audio elements, due to improper handling of     failing node adoption. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-9899)

  - A security bypass vulnerability exists in the     nsDataDocumentContentPolicy::ShouldLoad() function     within file dom/base/nsDataDocumentContentPolicy.cpp     that allows external resources to be inappropriately     loaded by SVG images by utilizing 'data:' URLs. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-domain information.
    (CVE-2016-9900)

  - A flaw exists due to improper sanitization of HTML tags     received from the Pocket server. An unauthenticated,     remote attacker can exploit this to run JavaScript code     in the about:pocket-saved (unprivileged) page, giving it     access to Pocket's messaging API through HTML injection.
    (CVE-2016-9901)

  - A flaw exists in the Pocket toolbar button, specifically     in browser/extensions/pocket/content/main.js, due to     improper verification of the origin of events fired from     its own pages. An unauthenticated, remote attacker can     exploit this to inject content and commands from other     origins into the Pocket context. Note that this issue     does not affect users with e10s enabled. (CVE-2016-9902)

  - A universal cross-site scripting (XSS) vulnerability     exists in the Add-ons SDK, specifically within files     addon-sdk/source/lib/sdk/ui/frame/view.html and     addon-sdk/source/lib/sdk/ui/frame/view.js, due to     improper validation of input before returning it to     users. An unauthenticated, remote attacker can exploit     this, via a specially crafted request, to execute     arbitrary script code in a user's browser session.
    (CVE-2016-9903)

  - An information disclosure vulnerability exists that     allows an unauthenticated, remote attacker to determine     whether an atom is used by another compartment or zone     in specific contexts, by utilizing a JavaScript Map/Set     timing attack. (CVE-2016-9904)

Mozilla Foundation reports :

CVE-2016-9894: Buffer overflow in SkiaGL

CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements

CVE-2016-9895: CSP bypass using marquee tag

CVE-2016-9896: Use-after-free with WebVR

CVE-2016-9897: Memory corruption in libGLES

CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees

CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs

CVE-2016-9904: Cross-origin information leak in shared atoms

CVE-2016-9901: Data from Pocket server improperly sanitized before execution

CVE-2016-9902: Pocket extension does not validate the origin of events

CVE-2016-9903: XSS injection vulnerability in add-ons SDK

CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3155-1 advisory.

    Multiple security vulnerabilities were discovered in Firefox. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit these to conduct cross-site scripting     (XSS) attacks, obtain sensitive information, cause a denial of service via application crash, or execute     arbitrary code. (CVE-2016-9080, CVE-2016-9893, CVE-2016-9894, CVE-2016-9895, CVE-2016-9896, CVE-2016-9897,     CVE-2016-9898, CVE-2016-9899, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9903, CVE-2016-9904)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
9851	Mozilla Firefox < 50.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
96248	openSUSE Security Update : MozillaFirefox (openSUSE-2016-1534)	Nessus	SuSE Local Security Checks	Local	critical
96030	openSUSE Security Update : MozillaFirefox (openSUSE-2016-1490)	Nessus	SuSE Local Security Checks	Local	critical
95886	Mozilla Firefox < 50.1 Multiple Vulnerabilities	Nessus	Windows	Local	critical
95884	Mozilla Firefox < 50.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	critical
95814	FreeBSD : mozilla -- multiple vulnerabilities (512c0ffd-cd39-4da4-b2dc-81ff4ba8e238)	Nessus	FreeBSD Local Security Checks	Local	critical
95807	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3155-1)	Nessus	Ubuntu Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-9903

medium

Tenable Plugins

high

critical

critical

critical

critical

critical

critical