The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.

Versions of Mozilla Firefox ESR earlier than 52.7.2 are unpatched for an out-of-bounds write flaw exists in the 'vorbis_book_decodevs_add()', 'vorbis_book_decodev_add()', and 'vorbis_book_decodevv_add()' functions in 'codebook.c' that is triggered when decoding codebooks from Vorbis audio data. This may allow a context-dependent attacker to corrupt memory and execute arbitrary code.

Versions of Mozilla Firefox ESR earlier than 52.7 are unpatched for the following vulnerabilities :

 - An overflow condition exists that is triggered when handling SVG animatedPathSegList attributes. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as local copies of resources that were sent with a no-store or no-cache header may be returned by the 'fetch()' API. This allows a local attacker to gain access to potentially sensitive information.
 - An out-of-bounds write flaw exists that is triggered when handling plane widths and stride constraints in IPC messages. This may allow a context-dependent attacker to bypass sandbox restrictions.
 - A flaw exists in the 'JsepTrack::NegotiateCodecs()' function in 'media/webrtc/signaling/src/jsep/JsepTrack.cpp' that is triggered when handling RTP payload types in WebRTC connections. With specially crafted packets, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An integer overflow condition exists that is triggered as certain length parameters are not properly validated during conversion of text to unicode character sets. This may allow a context-dependent attacker to have an unspecified impact.
 - A use-after-free condition exists in 'layout/base/nsDocumentViewer.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when handling HTTP/2 streams. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'EventStateManager::NotifyMouseOver()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouseover events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readHeader()' function in 'vm/StructuredClone.cpp' that is triggered when handling structured clone data. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::MakeMRegExpHoistable()' function in 'jit/IonAnalysis.cpp' that is triggered when optimization for regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'JSObject::setFlags()' function in 'vm/Shape.cpp' that is triggered when checking for dictionary mode. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'vpx_codec_enc_init_multi_ver()' function in 'vpx_encoder.c' that is triggered when handling memory during early exits. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is related to document renderer handling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An arithmetic flaw exists in the 'nsTextFrame::GetRenderedText()' function in 'layout/generic/nsTextFrame.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the EditorBase destructor in 'editor/libeditor/EditorBase.cpp' that is triggered when unlinking cycle collectors. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in 'vp9/encoder/x86/vp9_quantize_ssse3_x86_64.asm' that is triggered when handling memory 'pointers.This' may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocumentEncoder::SerializeToStringRecursive()' function in 'dom/base/nsDocumentEncoder.cpp' that is triggered when serializing DOM nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in the 'vorbis_book_decodevs_add()', 'vorbis_book_decodev_add()', and 'vorbis_book_decodevv_add()' functions in 'codebook.c' that is triggered when decoding codebooks from Vorbis audio data. This may allow a context-dependent attacker to corrupt memory and execute arbitrary code.

The version of Mozilla Firefox installed on the remote Windows host is prior to 59.0.1. It is, therefore, affected by multiple code execution vulnerabilities. A out-of-bounds write flaw exists in multiple functions of the codebook.c script when decoding Vorbis audio data. A context-dependent attacker could corrupt memory and potentially execute arbitrary code. (CVE-2018-5146, CVE-2018-5147)

Versions of Mozilla Firefox earlier than 59 are unpatched for the following vulnerabilities :

 - An overflow condition exists that is triggered when handling SVG animatedPathSegList attributes. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in 'dom/html/nsTextEditorState.cpp' that is triggered when handling elements, events, and selection ranges during editor operations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as local copies of resources that were sent with a no-store or no-cache header may be returned by the 'fetch()' API. This allows a local attacker to gain access to potentially sensitive information.
 - An out-of-bounds write flaw exists that is triggered when handling plane widths and stride constraints in IPC messages. This may allow a context-dependent attacker to bypass sandbox restrictions.
 - A flaw exists in the 'JsepTrack::NegotiateCodecs()' function in 'media/webrtc/signaling/src/jsep/JsepTrack.cpp' that is triggered when handling RTP payload types in WebRTC connections. With specially crafted packets, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'runFindOperation()' function in 'browser/components/extensions/ext-find.js' that that is triggered as it permits using the Find API for WebExtensions to access privileged pages in open tabs. By tricking a user into installing a malicious web extension, a context-dependent attacker can gain access to potentially sensitive information.
 - A flaw exists that is triggered as input to the ''app.support'.baseURL' preference is not properly sanitized. This may allow a local attacker to create specially crafted script code that is executed in user's browser session within the context of the preferences tab.
 - A flaw exists in 'netwerk/protocol/viewsource/nsViewSourceHandler.cpp' that is triggered when handling view-source: URLs. By tricking a user into installing a malicious web extension, a context-dependent attacker can bypass content restrictions and view local 'file:' URL content or content stored in 'about:cache'.
 - A flaw exists that is triggered when handling access restrictions for web extensions. By tricking a user into installing a malicious web extension, a context-dependent attacker can inject script code into pages from other web extensions or unprivileged 'about:' pages.
 - A flaw exists in 'dom/workers/RuntimeService.cpp' that is triggered as a shared worker created from a data: URL can be shared by another tab with a different origin. This may allow a context-dependent attacker to bypass the same-origin policy.
 - A flaw exists in the 'nsChromeRegistry::Canonify()' function in 'chrome/nsChromeRegistry.cpp' that is triggered as access to a legacy extension's 'non-contentaccessible' resource is not properly restricted. With a specially crafted web page, a context-dependent attacker to gain unauthorized access.
 - A flaw exists in the 'ActionBarPresenter::updateCustomView()' function in 'customtabs/ActionBarPresenter.java' that is triggered when handling overly long domain names in an Android Custom Tab. This allows a context-dependent attacker to spoof the address bar.
 - A flaw exists in the 'nsMozIconURI::SetSpec()' function in 'image/decoders/icon/nsIconURI.cpp' that is triggered as access to moz-images is not properly restricted when using the 'moz-icon:' protocol. With a specially crafted web page, a context-dependent attacker can gain information about application associations for certain MIME types.
 - A flaw exists in the 'SendNotificationEventRunnable::WorkerRun()' function in 'dom/workers/ServiceWorkerPrivate.cpp' related to the Notifications Push API. This may allow a context-dependent attacker to open new tabs and display unwanted content from arbitrary URLs.
 - A flaw exists that is due to the in the Media Capture and Streams API not properly displaying the originating domain when requested via 'data:' or 'blob:' URLs. This may result in user confusion about which site is asking for this permission.
 - A flaw exists in the 'stripUnsafeProtocolOnPaste()' function in 'content/browser.js' that allows a cross-site scripting (Self-XSS) attack. This flaw exists exists because the application does not properly sanitize input to the address bar. This may allow a context-dependent attacker to create a specially crafted 'javascript:' URL containing an embedded tab character that executes arbitrary script code in their own browser.
 - An unspecified flaw exists that is triggered as certain input is not properly validated when handling typed arrays. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the AccessiblCaret (Copy & Paste) feature that is triggered when handling flushing of pending notifications. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'jit/CacheIR.cpp' that is triggered when attaching argument stubs. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSCompartment::getOrCreateIterResultTemplateObject()' function in 'jsiter.cpp' that is triggered when updating type information of iter result object templates. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A signednes flaw exists in the StoreBuffer class that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MediaPipelineTransmit::SetDescription()' function in 'mediapipeline/MediaPipeline.cpp' that is triggered when handling media descriptions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHTMLDocument::Open()' function in 'dom/html/nsHTMLDocument.cpp' that is triggered when handling unload events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCSSFrameConstructor::ContentRemoved()' function in 'layout/base/nsCSSFrameConstructor.cpp' that is triggered when handling frames for content nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'internal_ClearHistogramById()' function in 'toolkit/components/telemetry/TelemetryHistogram.cpp' that is triggered when handling expired histograms. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CanAttachAddElement()' function in 'jit/CacheIR.cpp' that is triggered when handling shadowing indexed properties. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'mozglue/android/NSSBridge.cpp' that is triggered as certain input is not properly validated when decoding base64 data. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when handling HTTP/2 streams. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'EventStateManager::NotifyMouseOver()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouseover events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readHeader()' function in 'vm/StructuredClone.cpp' that is triggered when handling structured clone data. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::MakeMRegExpHoistable()' function in 'jit/IonAnalysis.cpp' that is triggered when optimization for regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'JSObject::setFlags()' function in 'vm/Shape.cpp' that is triggered when checking for dictionary mode. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'vpx_codec_enc_init_multi_ver()' function in 'vpx_encoder.c' that is triggered when handling memory during early exits. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is related to document renderer handling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An arithmetic flaw exists in the 'nsTextFrame::GetRenderedText()' function in 'layout/generic/nsTextFrame.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the EditorBase destructor in 'editor/libeditor/EditorBase.cpp' that is triggered when unlinking cycle collectors. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in 'vp9/encoder/x86/vp9_quantize_ssse3_x86_64.asm' that is triggered when handling memory 'pointers.This' may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocumentEncoder::SerializeToStringRecursive()' function in 'dom/base/nsDocumentEncoder.cpp' that is triggered when serializing DOM nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in the 'vorbis_book_decodevs_add()', 'vorbis_book_decodev_add()', and 'vorbis_book_decodevv_add()' functions in 'codebook.c' that is triggered when decoding codebooks from Vorbis audio data. This may allow a context-dependent attacker to corrupt memory and execute arbitrary code.

This update for MozillaFirefox fixes the following issues: Security issues fixed in Firefox ESR 52.7.3 (bsc#1085130) :

  - CVE-2018-5125: Memory safety bugs fixed in Firefox 59     and Firefox ESR 52.7

  - CVE-2018-5127: Buffer overflow manipulating SVG     animatedPathSegList

  - CVE-2018-5129: Out-of-bounds write with malformed IPC     messages

  - CVE-2018-5130: Mismatched RTP payload type can trigger     memory corruption

  - CVE-2018-5131: Fetch API improperly returns cached     copies of no-store/no-cache resources

  - CVE-2018-5144: Integer overflow during Unicode     conversion

  - CVE-2018-5145: Memory safety bugs fixed in Firefox ESR     52.7

  - CVE-2018-5146: Out of bounds memory write in libvorbis     (bsc#1085671)

  - CVE-2018-5147: Out of bounds memory write in libtremor     (bsc#1085671)

  - CVE-2018-5148: Use-after-free in compositor (MFSA     2018-10) (bsc#1087059)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Richard Zhu and Huzaifa Sidhpurwala discovered that an out-of-bounds memory write when playing Vorbis media files could result in the execution of arbitrary code.

For Debian 7 'Wheezy', these problems have been fixed in version 52.7.2esr-1~deb7u1.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox installed on the remote Windows host is prior to 59.0.1. It is, therefore, affected by multiple code execution vulnerabilities. A out-of-bounds write flaw exists in multiple functions of the codebook.c script when decoding Vorbis audio data. A context-dependent attacker could corrupt memory and potentially execute arbitrary code.

The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 52.7.2. It is, therefore, affected by multiple code execution vulnerabilities. A out-of-bounds write flaw exists in multiple functions of the codebook.c script when decoding Vorbis audio data. A context-dependent attacker could corrupt memory and potentially execute arbitrary code.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 59.0.1. It is, therefore, affected by multiple code execution vulnerabilities. A out-of-bounds write flaw exists in multiple functions of the codebook.c script when decoding Vorbis audio data. A context-dependent attacker could corrupt memory and potentially execute arbitrary code.

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.7.2. It is, therefore, affected by multiple code execution vulnerabilities. A out-of-bounds write flaw exists in multiple functions of the codebook.c script when decoding Vorbis audio data. A context-dependent attacker could corrupt memory and potentially execute arbitrary code.

Huzaifa Sidhpurwala discovered that an out-of-bounds memory write in the codebook parsing code of the Libtremor multimedia library could result in the execution of arbitrary code if a malformed Vorbis file is opened.

For Debian 7 'Wheezy', these problems have been fixed in version 1.0.2+svn18153-0.2+deb7u1.

We recommend that you upgrade your libvorbisidec packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for Mozilla Firefox to version 52.7.2esr fixes security issues and bugs.

Security issues fixed :

  - CVE-2018-5146: Specially crafted vorbis files could have     been used to execute arbitrary code via an Out of bounds     memory write (bsc#1085671, MFSA 2018-08)

  - CVE-2018-5147: Specially crafted vorbis files could have     been used to execute arbitrary code via an Out of bounds     memory write - used on ARM platforms (bsc#1085671, MFSA     2018-08) The following bug fixes are included :

  - Stability improvements in the Italian locale

The Mozilla Foundation reports : CVE-2018-5146: Out of bounds memory write in libvorbis An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.
CVE-2018-5147: Out of bounds memory write in libtremor The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms.

Richard Zhu and Huzaifa Sidhpurwala discovered that an out-of-bounds memory write when playing Vorbis media files could result in the execution of arbitrary code.

Huzaifa Sidhpurwala discovered that an out-of-bounds memory write in the codebook parsing code of the Libtremor multimedia library could result in the execution of arbitrary code if a malformed Vorbis file is opened.

ID	Name	Product	Family	Severity
700336	Mozilla Firefox ESR < 52.7.2 RCE	Nessus Network Monitor	Web Clients	high
700335	Mozilla Firefox ESR < 52.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
700329	Mozilla Firefox < 59.0.1 Multiple RCE	Nessus Network Monitor	Web Clients	high
700328	Mozilla Firefox < 59 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
109000	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2018:0907-1)	Nessus	SuSE Local Security Checks	critical
108749	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:0850-1)	Nessus	SuSE Local Security Checks	critical
108609	Debian DLA-1319-1 : firefox-esr security update	Nessus	Debian Local Security Checks	critical
108587	Mozilla Firefox < 59.0.1 Multiple Code Execution Vulnerabilities	Nessus	Windows	critical
108586	Mozilla Firefox ESR < 52.7.2 Multiple Code Execution Vulnerabilities	Nessus	Windows	critical
108585	Mozilla Firefox < 59.0.1 Multiple Code Execution Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
108584	Mozilla Firefox ESR < 52.7.2 Multiple Code Execution Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
108568	Debian DLA-1312-1 : libvorbisidec security update	Nessus	Debian Local Security Checks	critical
108442	openSUSE Security Update : MozillaFirefox (openSUSE-2018-278)	Nessus	SuSE Local Security Checks	critical
108430	FreeBSD : mozilla -- multiple vulnerabilities (7943794f-707f-4e31-9fea-3bbf1ddcedc1)	Nessus	FreeBSD Local Security Checks	critical
108420	Debian DSA-4143-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
108418	Debian DSA-4141-1 : libvorbisidec - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-5147

critical

Tenable Plugins

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical