FreeBSD : mozilla -- multiple vulnerabilities (2225c5b4-1e5a-44fc-9920-b3201c384a15)

critical Nessus Plugin ID 89765
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 8.9

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Mozilla Foundation reports :

MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)

MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports

MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages

MFSA 2016-19 Linux video memory DOS with Intel drivers

MFSA 2016-20 Memory leak in libstagefright when deleting an array during MP4 processing

MFSA 2016-21 Displayed page address can be overridden

MFSA 2016-22 Service Worker Manager out-of-bounds read in Service Worker Manager

MFSA 2016-23 Use-after-free in HTML5 string parser

MFSA 2016-24 Use-after-free in SetBody

MFSA 2016-25 Use-after-free when using multiple WebRTC data channels

MFSA 2016-26 Memory corruption when modifying a file being read by FileReader

MFSA 2016-27 Use-after-free during XML transformations

MFSA 2016-28 Addressbar spoofing though history navigation and Location protocol property

MFSA 2016-29 Same-origin policy violation using perfomance.getEntries and history navigation with session restore

MFSA 2016-31 Memory corruption with malicious NPAPI plugin

MFSA 2016-32 WebRTC and LibVPX vulnerabilities found through code inspection

MFSA 2016-33 Use-after-free in GetStaticInstance in WebRTC

MFSA 2016-34 Out-of-bounds read in HTML parser following a failed allocation

Solution

Update the affected packages.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2016-16/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-17/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-18/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-19/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-20/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-21/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-22/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-23/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-24/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-25/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-26/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-27/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-28/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-29/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-31/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-32/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-33/

https://www.mozilla.org/en-US/security/advisories/mfsa2016-34/

http://www.nessus.org/u?6acefea3

Plugin Details

Severity: Critical

ID: 89765

File Name: freebsd_pkg_2225c5b41e5a44fc9920b3201c384a15.nasl

Version: 2.13

Type: local

Published: 3/9/2016

Updated: 1/4/2021

Dependencies: 12634

Risk Information

Risk Factor: Critical

VPR Score: 8.9

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:H/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:firefox, p-cpe:/a:freebsd:freebsd:firefox-esr, p-cpe:/a:freebsd:freebsd:libxul, p-cpe:/a:freebsd:freebsd:linux-firefox, p-cpe:/a:freebsd:freebsd:linux-seamonkey, p-cpe:/a:freebsd:freebsd:linux-thunderbird, p-cpe:/a:freebsd:freebsd:seamonkey, p-cpe:/a:freebsd:freebsd:thunderbird, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/8/2016

Vulnerability Publication Date: 3/8/2016

Reference Information

CVE: CVE-2016-1952, CVE-2016-1953, CVE-2016-1954, CVE-2016-1955, CVE-2016-1956, CVE-2016-1957, CVE-2016-1958, CVE-2016-1959, CVE-2016-1960, CVE-2016-1961, CVE-2016-1962, CVE-2016-1963, CVE-2016-1964, CVE-2016-1965, CVE-2016-1966, CVE-2016-1967, CVE-2016-1970, CVE-2016-1971, CVE-2016-1972, CVE-2016-1973, CVE-2016-1974, CVE-2016-1975, CVE-2016-1976