Detections
Analytics
Mozilla Firefox < 56 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 700321
Synopsis
The remote host has a web browser installed that is vulnerable to multiple attack vectors.Description
Versions of Mozilla Firefox earlier than 56 are unpatched for the following vulnerabilities :- An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
- A flaw exists in the 'js::AddPropertyTypesAfterProtoChange()' function in 'js/src/vm/NativeObject.cpp' that is triggered when handling the 'unknown-properties' flag. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in 'layout/style/nsCSSPseudoElements.cpp' that is triggered when handling pseudo-element atoms. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
- A flaw exists in 'dom/base/nsDocument.cpp' that is triggered when handling intersection observers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in the 'LayerTransactionParent::Destroy()' function in 'gfx/layers/ipc/LayerTransactionParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- An overflow condition exists in the 'FPSCounter::PrintHistogram()' function in 'gfx/layers/composite/FPSCounter.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
- A flaw exists in the 'FlagAllOperandsAsHavingRemovedUses()' function in 'js/src/jit/IonAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in 'memory/mozjemalloc/mozjemalloc.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in the 'ReadCompressedIndexDataValuesFromBlob()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
- An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
- A flaw exists in 'js/src/vm/StructuredClone.cpp' that is triggered when handling structured clone reads. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
- A flaw exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling root elements in the editor. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in 'dom/media/GraphDriver.cpp' that is triggered when handling errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- An overflow condition exists in the 'hnj_hyphen_hyphword()' function in 'hyphen.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code within a process linked against the library.
- A flaw exists in the 'EditorBase::FinalizeSelection()' function in 'editor/libeditor/EditorBase.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
- A use-after-free condition exists in the Fetch API related to missing thread safety. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
- A flaw exists that is triggered when pages enter fullscreen mode without user notification. This allows a context-dependent attacker to spoof the address bar.
- A use-after-free error exists in 'accessible/generic/DocAccessible.cpp' that is triggered when manipulating Accessible Rich Internet Applications (ARIA) elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
- A use-after-free error exists in design mode that is triggered when objects are resized. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
- A use-after-free error exists in the 'ssl3_HandleCertificateVerify()' function in 'lib/ssl/ssl3con.c' that is triggered when handling handshake hashes during TLS '1.2' exchanges. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
- A flaw exists that is triggered as the content principal is not properly checked when handling drag and drop actions onto the browser UI. With specially crafted web content including file: URLs, a context-dependent attacker can open local files.
- A flaw exists in the PendingLookup class in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered when handling downloads encoded with data: and blob: URL elements. This may allow a context-dependent attacker to bypass the phishing and malware protection feature.
- An integer truncation flaw exists in the JavaScript parser that may allow a context-dependent attacker to potentially disclose memory contents.
- A flaw exists in the 'MacOSFontEntry::ReadCMAP()' function in 'gfx/thebes/gfxMacPlatformFontList.mm' that is triggered as certain tibetan and arabic unicode characters are displayed as whitespace in combination with macOS fonts. With a specially crafted IDN domain, a context-dependent attacker can spoof a valid URL and conduct phishing attacks.
- A flaw exists that is triggered when creating a modal dialog using the data: protocol via JavaScript. With a specially crafted web page, a context-dependent attacker can spoof the origin of the modal dialog.
- A flaw exists in the WebExtensions component that is triggered when handling popups and panels in the extension UI. This may allow a context-dependent attacker to load an 'about:' URL.
- A flaw exists in the WebExtensions component that is triggered when handling file downloads. This may allow a context-dependent attacker to download and open files without user interaction.
- A flaw exists in the 'nsDocument::InitCSP()' function in 'dom/base/nsDocument.cpp' that is triggered as the sandbox directive does not create unique origin. This may result in incorrect enforcement of the content security policy (CSP).
- A flaw exists in the WebCrypto API that is triggered as the AES-GCM implementation allows a zero-length IV. This may allow a context-dependent attacker to determine the authentication key.
- A flaw exists that is is triggered as results of the 'instanceof' operator can be manipulated. With specially crafted web content, a context-dependent attacker can bypass the Xray wrapper mechanism.
- An unspecified flaw exists that is triggered when drawing and validating elements with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
- A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.
Solution
Upgrade to Firefox version 56 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2017-21
Plugin Details
Severity: High
ID: 700321
Family: Web Clients
Published: 8/21/2018
Updated: 3/6/2019
Nessus ID: 103680
Risk Information
VPR
Risk Factor: High
Score: 7.6
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Patch Publication Date: 9/28/2017
Vulnerability Publication Date: 8/22/2017
Reference Information
CVE: CVE-2017-5715, CVE-2017-7793, CVE-2017-7805, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7816, CVE-2017-7817, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7821, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824, CVE-2017-7825