Mozilla Firefox < 46.0 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 9380

Synopsis

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Description

Versions of Mozilla Firefox earlier than 46.0 are unpatched for the following vulnerabilities :

- Multiple memory corruption issues exist that allow an attacker to corrupt memory, resulting in the execution of arbitrary code. (CVE-2016-2804, CVE-2016-2806, CVE-2016-2807)
- A flaw exists due to improper validation of user-supplied input when handling the 32-bit generation count of the underlying HashMap. A context-dependent attacker can exploit this to cause a buffer overflow condition, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-2808)
- A local privilege escalation vulnerability exists in the Maintenance Service updater due to improper handling of long log file paths. A local attacker can exploit this to delete arbitrary files and gain elevated privileges. (CVE-2016-2809)
- A remote code execution vulnerability exists due to a use-after-free error in the 'BeginReading()' function. A context-dependent attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2811)
- A remote code execution vulnerability exists due to a race condition in 'ServiceWorkerManager' in the 'get()' function. A context-dependent attacker can exploit this to execute arbitrary code. (CVE-2016-2812)
- A heap buffer overflow condition exists in the Google Stagefright component due to improper validation of user-supplied input when handling CENC offsets and the sizes table. A context-dependent attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-2814)
- A security bypass vulnerability exists due to the Content Security Policy (CSP) not being properly applied to web content sent with the 'multipart/x-mixed-replace' MIME-type. A context-dependent attacker can exploit this to bypass CSP protection. (CVE-2016-2816)
- A cross-site scripting (XSS) vulnerability exists due to improper restriction of unprivileged 'javascript: URL' navigation. A context-dependent attacker can exploit this, via a specially crafted request, to execute arbitrary script code in the context of a user's browser session. (CVE-2016-2817)
- A flaw exists in the Firefox Health Report that is triggered when it accepts any content document events that are presented in its iframe. A context-dependent attacker can exploit this to manipulate sharing preferences. (CVE-2016-2820)

Solution

Upgrade to Firefox 46.0 or later.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2016-39

https://www.mozilla.org/en-US/security/advisories/mfsa2016-40

https://www.mozilla.org/en-US/security/advisories/mfsa2016-42

https://www.mozilla.org/en-US/security/advisories/mfsa2016-44

https://www.mozilla.org/en-US/security/advisories/mfsa2016-45

https://www.mozilla.org/en-US/security/advisories/mfsa2016-46

https://www.mozilla.org/en-US/security/advisories/mfsa2016-47

https://www.mozilla.org/en-US/security/advisories/mfsa2016-48

Plugin Details

Severity: High

ID: 9380

File Name: 9380.prm

Family: Web Clients

Published: 2016/06/24

Modified: 2016/09/30

Dependencies: 9131

Nessus ID: 90790, 90793

Risk Information

Risk Factor: High

CVSSv2

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSSv3

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Patch Publication Date: 2015/05/21

Vulnerability Publication Date: 2015/05/21

Reference Information

CVE: CVE-2016-2804, CVE-2016-2806, CVE-2016-2807, CVE-2016-2808, CVE-2016-2809, CVE-2016-2811, CVE-2016-2812, CVE-2016-2814, CVE-2016-2816, CVE-2016-2817, CVE-2016-2820

BID: 88099, 88100

OSVDB: 137609, 137610, 137611, 137613, 137614, 137615, 137616, 137617, 137618, 137619, 137620, 137621, 137622, 137623, 137624, 137625, 137626, 137627, 137628, 137629, 137630, 137631, 137632, 137633, 137634, 137635, 137636, 137637, 137638, 137640, 137641, 137642, 137643