Detections
Analytics

Mozilla Firefox ESR < 52.4 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 700331

Synopsis

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Description

Versions of Mozilla Firefox ESR earlier than 52.4 are unpatched for the following vulnerabilities :

 - A flaw exists in 'js/src/vm/StructuredClone.cpp' that is triggered when handling structured clone reads. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling root elements in the editor. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/GraphDriver.cpp' that is triggered when handling errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'hnj_hyphen_hyphword()' function in 'hyphen.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code within a process linked against the library.
 - A flaw exists in the 'EditorBase::FinalizeSelection()' function in 'editor/libeditor/EditorBase.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free condition exists in the Fetch API related to missing thread safety. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'accessible/generic/DocAccessible.cpp' that is triggered when manipulating Accessible Rich Internet Applications (ARIA) elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in design mode that is triggered when objects are resized. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'ssl3_HandleCertificateVerify()' function in 'lib/ssl/ssl3con.c' that is triggered when handling handshake hashes during TLS '1.2' exchanges. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the PendingLookup class in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered when handling downloads encoded with data: and blob: URL elements. This may allow a context-dependent attacker to bypass the phishing and malware protection feature.
 - A flaw exists in the 'MacOSFontEntry::ReadCMAP()' function in 'gfx/thebes/gfxMacPlatformFontList.mm' that is triggered as certain tibetan and arabic unicode characters are displayed as whitespace in combination with macOS fonts. With a specially crafted IDN domain, a context-dependent attacker can spoof a valid URL and conduct phishing attacks.
 - A flaw exists in the 'nsDocument::InitCSP()' function in 'dom/base/nsDocument.cpp' that is triggered as the sandbox directive does not create unique origin. This may result in incorrect enforcement of the content security policy (CSP).
 - An unspecified flaw exists that is triggered when drawing and validating elements with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.

Solution

Upgrade to Firefox ESR version 52.4 or later.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2017-22

Plugin Details

Severity: High

ID: 700331

Family: Web Clients

Published: 8/21/2018

Updated: 11/6/2019

Nessus ID: 103679

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox_esr

Patch Publication Date: 9/28/2017

Vulnerability Publication Date: 3/27/2017

Reference Information

CVE: CVE-2017-7793, CVE-2017-7805, CVE-2017-7810, CVE-2017-7814, CVE-2017-7818, CVE-2017-7819, CVE-2017-7823, CVE-2017-7824, CVE-2017-7825

BID: 101053, 101054, 101055