Mozilla Project 報告：

MFSA 2015-134 其他記憶體安全性危險 (rv:43.0 / rv:38.5)

MFSA 2015-135 JavaScript 變數指派因未設限的物件而發生損毀

MFSA 2015-136 使用 perfomance.getEntries 和歷程記錄導覽時違反同源原則

MFSA 2015-137 Firefox 允許在 cookie 中設定控制字元

MFSA 2015-138 資料通道在損毀之後使用時，WebRTC 中發生的釋放後使用問題

MFSA 2015-139 配置極大紋理時發生的整數溢位

MFSA 2015-140 透過 web 背景工作錯誤事件發生的跨來源資訊洩漏

MFSA 2015-141 資料 URI 中的雜湊遭錯誤剖析

MFSA 2015-142 因 HTTP/2 中格式錯誤的框架引發的 DOS

MFSA 2015-143 因 Jasper 程式庫中的瑕疵，使用格式錯誤的影像時 Linux 檔案選擇器損毀

MFSA 2015-144 在程式碼檢查過程中發現緩衝區溢位

MFSA 2015-145 在程式碼檢查過程中發現反向溢位

MFSA 2015-146 在 64 位元版本中播放 MP4 而產生的整數溢位

MFSA 2015-147 在 libstagefright 中處理 MP4 詮釋資料時出現整數反向溢位和緩衝區溢位

MFSA 2015-148 WebExtension API 中的權限提升弱點

MFSA 2015-149 透過資料與檢視來源 URI 發動的跨網站讀取攻擊

此 MozillaFirefox 更新可修正下列安全性問題：

- MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 其他記憶體安全危險

- MFSA 2015-135/CVE-2015-7204 (bmo#1216130) JavaScript 變數指派因未設限的物件而發生損毀

- MFSA 2015-136/CVE-2015-7207 (bmo#1185256) 使用 perfomance.getEntries 和歷程記錄導覽時違反同源原則

- MFSA 2015-137/CVE-2015-7208 (bmo#1191423) Firefox 允許在 cookie 中設定控制字元

- MFSA 2015-138/CVE-2015-7210 (bmo#1218326) 資料通道在損毀之後使用時，WebRTC 中發生的釋放後使用問題

- MFSA 2015-139/CVE-2015-7212 (bmo#1222809) 配置極大紋理時發生的整數溢位

- MFSA 2015-140/CVE-2015-7215 (bmo#1160890) 透過 web 背景工作錯誤事件發生的跨來源資訊洩漏

- MFSA 2015-141/CVE-2015-7211 (bmo#1221444) 資料 URI 中的雜湊遭錯誤剖析

- MFSA 2015-142/CVE-2015-7218/CVE-2015-7219 (bmo#1194818, bmo#1194820) 因 HTTP/2 中格式錯誤的框架引發的 DOS

- MFSA 2015-143/CVE-2015-7216/CVE-2015-7217 (bmo#1197059、bmo#1203078) 因 Jasper 程式庫中的瑕疵，使用格式錯誤的影像時 Linux 檔案選擇器損毀

- MFSA 2015-144/CVE-2015-7203/CVE-2015-7220/CVE-2015-7221 (bmo#1201183、bmo#1178033、bmo#1199400) 在程式碼檢查過程中發現緩衝區溢位

- MFSA 2015-145/CVE-2015-7205 (bmo#1220493) 在程式碼檢查過程中發現反向溢位

- MFSA 2015-146/CVE-2015-7213 (bmo#1206211) 在 64 位元版本中播放 MP4 而產生的整數溢位

- MFSA 2015-147/CVE-2015-7222 (bmo#1216748) 在 libstagefright 中處理 MP4 詮釋資料時出現整數反向溢位和緩衝區溢位

- MFSA 2015-148/CVE-2015-7223 (bmo#1226423) WebExtension API 中的權限提升弱點

- MFSA 2015-149/CVE-2015-7214 (bmo#1228950) 透過資料與檢視來源 URI 發動的跨網站讀取攻擊

The version of Firefox is prior to 43.0 and is affected by multiple vulnerabilities : 

 - Multiple unspecified memory corruption issues exist due to improper validation of user-supplied input. A remote attacker can exploit these issues by convincing a user to visit a specially crafted web page, resulting in the execution of arbitrary code. (CVE-2015-7201) 
 - Multiple unspecified memory corruption issues exist due to improper validation of user-supplied input. A remote attacker can exploit these issues by convincing a user to visit a specially crafted web page, resulting in the execution of arbitrary code. (CVE-2015-7202) 
 - An overflow condition exists in the 'LoadFontFamilyData()' function due to improper validation of user-supplied input. A remote attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-7203) 
 - A flaw exists in the 'PropertyWriteNeedsTypeBarrier()' function due to improper handling of unboxed objects during JavaScript variable assignments. A remote attacker can exploit this to execute arbitrary code. (CVE-2015-7204) 
 - A flaw exists in the 'RtpHeaderParser::Parse()' function due to improper handling of RTP headers. An unauthenticated, remote attacker can exploit this, via specially crafted RTP headers, to execute arbitrary code. (CVE-2015-7205) 
 - A same-origin bypass vulnerability exists that is triggered after a redirect when the function is used alongside an iframe to host a page. An attacker can exploit this to gain access to cross-origin URL information. (CVE-2015-7207) 
 - The 'SetCookieInternal()' function improperly allows control characters (e.g. ASCII code 11) to be inserted into cookies. An attacker can exploit this to inject cookies. (CVE-2015-7208) 
 - A use-after-free error exists due to improper prevention of datachannel operations on closed PeerConnections. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-7210) 
 - A flaw exists in the 'ParseURI()' function due to improper handling of a hash (#) character in the 'data:' URI. An attacker can exploit this to spoof the URL bar. (CVE-2015-7211) 
 - An overflow condition exists in the 'AllocateForSurface()' function due to improper validation of user-supplied input when handling texture allocation in graphics operations. An attacker can exploit this to execute arbitrary code. (CVE-2015-7212) 
 - An integer overflow condition exists in the 'readMetaData()' function due to improper validation of user-supplied input when handling a specially crafted MP4 file. An attacker can exploit this to execute arbitrary code. (CVE-2015-7213) 
 - A same-origin bypass vulnerability exists due to improper handling of 'data:' and 'view-source:' URIs. An attacker can exploit this to read data from cross-site URLs and local files. (CVE-2015-7214) 
 - An information disclosure vulnerability exists due to improper handling of error events in web workers. An attacker can exploit this to gain access to sensitive cross-origin information. (CVE-2015-7215) 
 - The gdk-pixbuf configuration on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image. (CVE-2015-7216) 
 - The gdk-pixbuf configuration on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image. (CVE-2015-7217) 
 - Multiple integer underflow conditions exist due to improper validation of user-supplied input when handling HTTP2 frames. An attacker can exploit these to crash the application, resulting in a denial of service. (CVE-2015-7218, CVE-2015-7219) 
 - An overflow condition exists in the 'XDRBuffer::grow()' function due to improper validation of user-supplied input. An attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-7220) 
 - An overflow condition exists in the 'GrowCapacity()' function due to improper validation of user-supplied input. An attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-7221) 
 - An integer underflow condition exists in the bundled version of libstagefright in the 'parseChunk()' function that is triggered when handling 'covr' chunks. An unauthenticated, remote attacker can exploit this, via specially crafted media content, to crash the application or execute arbitrary code. (CVE-2015-7222) 
 - A privilege escalation vulnerability exists in the Extension.jsm script due to a failure to restrict WebExtension APIs from being injected into documents without WebExtension principals. An attacker can exploit this to conduct a cross-site scripting attack, resulting in the execution of arbitrary script code in a user's browser session. (CVE-2015-7223)

ID	Name	Product	Family	Published	Updated	Severity
87385	FreeBSD：mozilla -- 多個弱點 (2c2d1c39-1396-459a-91f5-ca03ee7c64c6)	Nessus	FreeBSD Local Security Checks	12/16/2015	1/6/2021	critical
87620	openSUSE 安全性更新：MozillaFirefox (openSUSE-2015-942)	Nessus	SuSE Local Security Checks	12/29/2015	1/19/2021	critical
9058	Mozilla Firefox < 43.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/27/2016	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical