Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : firefox vulnerabilities (USN-2993-1)

Ubuntu Security Notice (C) 2016 Canonical, Inc. / NASL script (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing a security-related patch.

Description :

Christian Holler, Gary Kwong, Jesse Ruderman, Tyson Smith, Timothy
Nikkel, Sylvestre Ledru, Julian Seward, Olli Pettay, Karl Tomlinson,
Christoph Diehl, Julian Hector, Jan de Mooij, Mats Palmgren, and Tooru
Fujisawa discovered multiple memory safety issues in Firefox. If a
user were tricked in to opening a specially crafted website, an
attacker could potentially exploit these to cause a denial of service
via application crash, or execute arbitrary code. (CVE-2016-2815,
CVE-2016-2818)

A buffer overflow was discovered when parsing HTML5 fragments in some
circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitrary code.
(CVE-2016-2819)

A use-after-free was discovered in contenteditable mode in some
circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitrary code.
(CVE-2016-2821)

Jordi Chancel discovered a way to use a persistent menu within a
<select> element and place this in an arbitrary location. If a user
were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to spoof the addressbar contents.
(CVE-2016-2822)

Armin Razmdjou that the location.host property can be set to an
arbitrary string after creating an invalid data: URI. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass some same-origin protections.
(CVE-2016-2825)

A use-after-free was discovered when processing WebGL content in some
circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitrary code.
(CVE-2016-2828)

Tim McCormack discovered that the permissions notification can show
the wrong icon when a page requests several permissions in quick
succession. An attacker could potentially exploit this by tricking the
user in to giving consent for access to the wrong resource.
(CVE-2016-2829)

It was discovered that a pointerlock can be created in a fullscreen
window without user consent in some circumstances, and this
pointerlock cannot be cancelled without quitting Firefox. If a user
were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to cause a denial of service or conduct
clickjacking attacks. (CVE-2016-2831)

John Schoenick discovered that CSS pseudo-classes can leak information
about plugins that are installed but disabled. An attacker could
potentially exploit this to fingerprint users. (CVE-2016-2832)

Matt Wobensmith discovered that Content Security Policy (CSP) does not
block the loading of cross-domain Java applets when specified by
policy. An attacker could potentially exploit this to bypass CSP
protections and conduct cross-site scripting (XSS) attacks.
(CVE-2016-2833)

In addition, multiple unspecified security issues were discovered in
NSS. (CVE-2016-2834).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected firefox package.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.3
(CVSS2#E:POC/RL:OF/RC:ND)
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now