Mozilla Firefox < 46.0 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 9380

Synopsis

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Description

Versions of Mozilla Firefox earlier than 46.0 are unpatched for the following vulnerabilities :

- Multiple memory corruption issues exist that allow an attacker to corrupt memory, resulting in the execution of arbitrary code. (CVE-2016-2804, CVE-2016-2806, CVE-2016-2807)
- A flaw exists due to improper validation of user-supplied input when handling the 32-bit generation count of the underlying HashMap. A context-dependent attacker can exploit this to cause a buffer overflow condition, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-2808)
- A local privilege escalation vulnerability exists in the Maintenance Service updater due to improper handling of long log file paths. A local attacker can exploit this to delete arbitrary files and gain elevated privileges. (CVE-2016-2809)
- A remote code execution vulnerability exists due to a use-after-free error in the 'BeginReading()' function. A context-dependent attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2811)
- A remote code execution vulnerability exists due to a race condition in 'ServiceWorkerManager' in the 'get()' function. A context-dependent attacker can exploit this to execute arbitrary code. (CVE-2016-2812)
- A heap buffer overflow condition exists in the Google Stagefright component due to improper validation of user-supplied input when handling CENC offsets and the sizes table. A context-dependent attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-2814)
- A security bypass vulnerability exists due to the Content Security Policy (CSP) not being properly applied to web content sent with the 'multipart/x-mixed-replace' MIME-type. A context-dependent attacker can exploit this to bypass CSP protection. (CVE-2016-2816)
- A cross-site scripting (XSS) vulnerability exists due to improper restriction of unprivileged 'javascript: URL' navigation. A context-dependent attacker can exploit this, via a specially crafted request, to execute arbitrary script code in the context of a user's browser session. (CVE-2016-2817)
- A flaw exists in the Firefox Health Report that is triggered when it accepts any content document events that are presented in its iframe. A context-dependent attacker can exploit this to manipulate sharing preferences. (CVE-2016-2820)

Solution

Upgrade to Firefox 46.0 or later.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2016-39

https://www.mozilla.org/en-US/security/advisories/mfsa2016-40

https://www.mozilla.org/en-US/security/advisories/mfsa2016-42

https://www.mozilla.org/en-US/security/advisories/mfsa2016-44

https://www.mozilla.org/en-US/security/advisories/mfsa2016-45

https://www.mozilla.org/en-US/security/advisories/mfsa2016-46

https://www.mozilla.org/en-US/security/advisories/mfsa2016-47

https://www.mozilla.org/en-US/security/advisories/mfsa2016-48

Plugin Details

Severity: High

ID: 9380

Family: Web Clients

Published: 6/24/2016

Updated: 3/6/2019

Nessus ID: 90790, 90793

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Patch Publication Date: 5/21/2015

Vulnerability Publication Date: 5/21/2015

Reference Information

CVE: CVE-2016-2804, CVE-2016-2806, CVE-2016-2807, CVE-2016-2808, CVE-2016-2809, CVE-2016-2811, CVE-2016-2812, CVE-2016-2814, CVE-2016-2816, CVE-2016-2817, CVE-2016-2820

BID: 88099, 88100