Firefox < 44 Multiple Vulnerabilities

critical Log Correlation Engine Plugin ID 802019

Synopsis

The specific version of Firefox that the system is running is reportedly affected by multiple vulnerabilities.

Description

The specific version of Firefox that the system is running is reportedly affected by the following vulnerabilities:

- Brotli contains a flaw in the DecodeVarLenUint8() function in dec/decode.c related to use of uninitialized memory. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1930)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains a flaw in the Downscaler::ClearRow() function in image/Downscaler.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the nsComputedDOMStyle::GetStyleContextForElement() and nsComputedDOMStyle::GetStyleContextForElementNoFlush() functions in layout/style/nsComputedDOMStyle.cpp. The issue is triggered when using a frame that is not in the composed document. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw that is triggered when handling fuctions accepting rest parameters. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the CodeGeneratorShared::allocateData() function in js/src/jit/shared/CodeGenerator-shared.h that is triggered when handling out-of-memory error conditions. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the VCMGenericEncoder::Release() function in media/webrtc/trunk/webrtc/modules/video_coding/main/source/generic_encoder.cc. The issue is triggered as the encoded-frame callback is not unregistered when releasing codec databases. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains an unspecified flaw in js/src/vm/HelperThreads.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the JSRuntime::createJitRuntime() function in js/src/jscompartment.cpp that is triggered when handling out-of-memory error conditions. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains an unspecified flaw that is triggered when handling attribute changes. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the HTMLMediaElement::NotifyAddedSource() function in dom/html/HTMLMediaElement.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the nsGIFDecoder2::WriteInternal() function in image/decoders/nsGIFDecoder2.cpp that is triggered when handling GIF image frame bounds. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1931)

- Mozilla Firefox contains a flaw that is triggered when handling WebAudio content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a use-after-free condition in the nsLayoutUtils::SurfaceFromElement() function in dom/html/HTMLMediaElement.cpp. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the Evaluate() function in js/src/shell/js.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1931)

- Mozilla Firefox contains an overflow condition in the WebGLContext::BufferData() function in dom/canvas/WebGLContextBuffers.cpp that is triggered when handling cache out-of-memory error conditions. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code. (CVE-2016-1935)

- Mozilla Firefox contains a flaw in the BrowserApp::onTabChanged() function in mobile/android/base/java/org/mozilla/gecko/BrowserApp.java. The issue is triggered when handling page scrolling. This may allow a context-dependent attacker to spoof the location. (CVE-2016-1943)

- Mozilla Firefox contains an integer overflow condition that is triggered when handling GIF images. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided by the vendor. (CVE-2016-1933)

- Mozilla Firefox contains a flaw in the Buffer11::NativeBuffer11::map() function within the ANGLE implementation. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1944)

- Mozilla Firefox for Android contains a flaw in mobile/android/chrome/content/browser.js that is triggered when handling data: URLs. This may allow a context-dependent attacker to spoof the location. (CVE-2016-1940)

- Mozilla Firefox contains a flaw in the safe browsing feature as the Application Reputation service was unreachable. This may allow a context-dependent attacker to trick a user into downloading a malicious executable without the user being warned. (CVE-2016-1947)

- Mozilla Firefox contains an integer overflow condition in the MoofParser::Metadata() function in media/libstagefright/binding/MoofParser.cpp. The issue is triggered when handling MP4 file metadata. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1946)

- Mozilla Firefox contains a flaw in modules/libjar/nsZipArchive.cpp that is triggered when handling ZIP files. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1945)

- Mozilla Firefox contains a flaw in the nsCookieService::SetCookieInternal() function in netwerk/cookie/nsCookieService.cpp as control characters are permitted in cookie names. This may allow a context-dependent attacker to inject cookies. (CVE-2016-1939)

- Mozilla Network Security Services (NSS) contains an unspecified cryptographical issue when handling calculations that contain mp_div or mp_exptmod. This may allow an attacker to trigger potential cryptographic weaknesses. (CVE-2016-1938)

- Mozilla Firefox for Android contains a flaw in mobile/android/chrome/content/browser.js that is triggered as lightweight themes fail to properly secure connections when installing themes. This may allow a remote man-in-the-middle attacker to make changes to the theme.
(CVE-2016-1948)

- Mozilla Firefox contains a flaw in the protocol handler in toolkit/mozapps/handling/content/dialog.js that is due to the handler treating double click events as two single click events. This may allow a context-dependent attacker to spoof content to cause a user to potentially perform malicious actions, such as downloading attacker controlled software. (CVE-2016-1937)

- Mozilla Firefox for Mac OS X contains a flaw that is triggered as the delay between the download dialog getting focus and the button getting enabled is too short. If a context-dependent attacker can trick a user into double clicking in a specific location, they can pass the second click through to a dialog below that location. This will allow the attacker to cause the user to perform unintentional actions. (CVE-2016-1941)

- Mozilla Firefox contains a flaw in browser/base/content/urlbarBindings.xml that is triggered during the handling of a URL that is invalid for the internal protocol, which will cause the URL to be pasted into the address bar. This may allow a context-dependent attacker to spoof URLs. (CVE-2016-1942)

- Mozilla Network Security Services (NSS) contains a use-after-free error in the ssl3_HandleECDHServerKeyExchange() function. The issue is triggered when handling failed allocations during DHE and ECDHE handshakes. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1978)

Solution

It has been reported that this has been fixed. Please refer to the product listing for upgraded versions that address this vulnerability.

See Also

https://www.suse.com/support/update/announcement/2016/suse-su-20160334-1.html

https://www.suse.com/support/update/announcement/2016/suse-su-20160777-1.html

https://www.mozilla.org/

https://github.com/google/brotli

https://bugzilla.mozilla.org/show_bug.cgi?id=1209368

https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/

http://www.ubuntu.com/usn/usn-2880-1/

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html

http://www.ubuntu.com/usn/usn-2880-2/

https://bugzilla.mozilla.org/show_bug.cgi?id=1233346

https://www.debian.org/security/2016/dsa-3457

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.html

https://www.suse.com/support/update/announcement/2016/suse-su-20160338-1.html

https://www.suse.com/support/update/announcement/2016/suse-su-20160584-1.html

http://www.ubuntu.com/usn/usn-2904-1/

http://seclists.org/bugtraq/2016/Jan/151

http://seclists.org/bugtraq/2016/Feb/178

https://bugzilla.mozilla.org/show_bug.cgi?id=1231121

https://bugzilla.mozilla.org/show_bug.cgi?id=1180064

https://bugzilla.mozilla.org/show_bug.cgi?id=1206675

https://bugzilla.mozilla.org/show_bug.cgi?id=1209546

https://bugzilla.mozilla.org/show_bug.cgi?id=1209366

https://bugzilla.mozilla.org/show_bug.cgi?id=1209365

https://bugzilla.mozilla.org/show_bug.cgi?id=1209358

https://bugzilla.mozilla.org/show_bug.cgi?id=1222015

https://bugzilla.mozilla.org/show_bug.cgi?id=1224200

https://bugzilla.mozilla.org/show_bug.cgi?id=1230668

https://bugzilla.mozilla.org/show_bug.cgi?id=1233925

https://bugzilla.mozilla.org/show_bug.cgi?id=1234280

https://bugzilla.mozilla.org/show_bug.cgi?id=1234571

https://bugzilla.mozilla.org/show_bug.cgi?id=1233152

https://bugzilla.mozilla.org/show_bug.cgi?id=1221385

https://bugzilla.mozilla.org/show_bug.cgi?id=1230639

https://bugzilla.mozilla.org/show_bug.cgi?id=1230483

https://bugzilla.mozilla.org/show_bug.cgi?id=1229825

https://bugzilla.mozilla.org/show_bug.cgi?id=1223670

https://bugzilla.mozilla.org/show_bug.cgi?id=1230686

https://bugzilla.mozilla.org/show_bug.cgi?id=1186973

https://bugzilla.mozilla.org/show_bug.cgi?id=1220450

https://www.mozilla.org/en-US/security/advisories/mfsa2016-03/

https://bugzilla.mozilla.org/show_bug.cgi?id=1228590

https://www.mozilla.org/en-US/security/advisories/mfsa2016-09/

https://bugzilla.mozilla.org/show_bug.cgi?id=1231761

https://www.mozilla.org/en-US/security/advisories/mfsa2016-02/

https://bugzilla.mozilla.org/show_bug.cgi?id=1186621

https://www.mozilla.org/en-US/security/advisories/mfsa2016-10/

https://bugzilla.mozilla.org/show_bug.cgi?id=1208525

https://www.mozilla.org/en-US/security/advisories/mfsa2016-05/

https://bugzilla.mozilla.org/show_bug.cgi?id=1237103

https://www.mozilla.org/en-US/security/advisories/mfsa2016-11/

https://bugzilla.mozilla.org/show_bug.cgi?id=1232069

https://bugzilla.mozilla.org/show_bug.cgi?id=1214782

https://bugzilla.mozilla.org/show_bug.cgi?id=1233784

https://www.mozilla.org/en-US/security/advisories/mfsa2016-04/

https://bugzilla.mozilla.org/show_bug.cgi?id=1190248

https://download.novell.com/Download?buildid=MVAFl0oMTck~

https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/

http://www.ubuntu.com/usn/usn-2903-1/

http://www.ubuntu.com/usn/usn-2903-2/

http://www.ubuntu.com/usn/usn-2973-1/

https://bugzilla.mozilla.org/show_bug.cgi?id=1235876

https://www.mozilla.org/en-US/security/advisories/mfsa2016-12/

https://bugzilla.mozilla.org/show_bug.cgi?id=724353

https://www.mozilla.org/en-US/security/advisories/mfsa2016-06/

https://bugzilla.mozilla.org/show_bug.cgi?id=1116385

https://www.mozilla.org/en-US/security/advisories/mfsa2016-08/

https://bugzilla.mozilla.org/show_bug.cgi?id=1189082

https://download.novell.com/Download?buildid=W46YTfqEGiQ~

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005811

https://www-304.ibm.com/support/docview.wss?uid=ssg1S1005812

http://www-01.ibm.com/support/docview.wss?uid=isg3T1023778

http://www-01.ibm.com/support/docview.wss?uid=swg21982583

https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html

https://www.suse.com/support/update/announcement/2016/suse-su-20160727-1.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html

https://www.suse.com/support/update/announcement/2016/suse-su-20160820-1.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html

https://www.suse.com/support/update/announcement/2016/suse-su-20160909-1.html

https://bto.bluecoat.com/security-advisory/sa124

Plugin Details

Severity: Critical

ID: 802019

Family: Web Clients

Published: 9/6/2016

Risk Information

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Patch Publication Date: 1/20/2016

Vulnerability Publication Date: 3/8/2016

Reference Information

CVE: CVE-2016-1930, CVE-2016-1931, CVE-2016-1933, CVE-2016-1935, CVE-2016-1937, CVE-2016-1938, CVE-2016-1939, CVE-2016-1940, CVE-2016-1941, CVE-2016-1942, CVE-2016-1943, CVE-2016-1944, CVE-2016-1945, CVE-2016-1946, CVE-2016-1947, CVE-2016-1948, CVE-2016-1978