Mozilla Firefox was updated to version 38.5.0 ESR to fix the following issues :

  - MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 Miscellaneous     memory safety hazards (rv:43.0 / rv:38.5)

  - MFSA 2015-138/CVE-2015-7210 A use-after-free in WebRTC     when datachannel is used after being destroyed

  - MFSA 2015-139/CVE-2015-7212 An integer overflow     allocating extremely large textures

  - MFSA 2015-145/CVE-2015-7205 A underflow found through     code inspection

  - MFSA 2015-146/CVE-2015-7213 A integer overflow in MP4     playback in 64-bit versions

  - MFSA 2015-147/CVE-2015-7222 Integer underflow and buffer     overflow processing MP4 metadata in libstagefright

  - MFSA 2015-149/CVE-2015-7214 Cross-site reading attack     through data and view-source URIs

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Firefox installed on the remote Mac OS X host is prior to 43. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory corruption issues exist due     to improper validation of user-supplied input. A remote     attacker can exploit these issues by convincing a user     to visit a specially crafted web page, resulting in the     execution of arbitrary code. (CVE-2015-7201)

  - Multiple unspecified memory corruption issues exist due     to improper validation of user-supplied input. A remote     attacker can exploit these issues by convincing a user     to visit a specially crafted web page, resulting in the     execution of arbitrary code. (CVE-2015-7202)

  - An overflow condition exists in the LoadFontFamilyData()     function due to improper validation of user-supplied     input. A remote attacker can exploit this to cause a     buffer overflow, resulting in the execution of arbitrary     code. (CVE-2015-7203)

  - A flaw exists in the PropertyWriteNeedsTypeBarrier()     function due to improper handling of unboxed objects     during JavaScript variable assignments. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-7204)

  - A flaw exists in the RtpHeaderParser::Parse() function     due to improper handling of RTP headers. An     unauthenticated, remote attacker can exploit this, via     specially crafted RTP headers, to execute arbitrary     code. (CVE-2015-7205)

  - A same-origin bypass vulnerability exists that is     triggered after a redirect when the function is used     alongside an iframe to host a page. An attacker can     exploit this to gain access to cross-origin URL     information. (CVE-2015-7207)

  - The SetCookieInternal() function improperly allows     control characters (e.g. ASCII code 11) to be inserted     into cookies. An attacker can exploit this to inject     cookies. (CVE-2015-7208)

  - A use-after-free error exists due to improper prevention     of datachannel operations on closed PeerConnections. An     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2015-7210)

  - A flaw exists in the ParseURI() function due to improper     handling of a hash (#) character in the data: URI. An     attacker can exploit this to spoof the URL bar.
    (CVE-2015-7211)

  - An integer overflow condition exists in the     readMetaData() function due to improper validation of     user-supplied input when handling a specially crafted     MP4 file. An attacker can exploit this to execute     arbitrary code. (CVE-2015-7213)

  - A same-origin bypass vulnerability exists due to     improper handling of 'data:' and 'view-source:' URIs. An     attacker can exploit this to read data from cross-site     URLs and local files. (CVE-2015-7214)

  - An information disclosure vulnerability exists due to     improper handling of error events in web workers. An     attacker can exploit this to gain access to sensitive     cross-origin information. (CVE-2015-7215)

  - Multiple integer underflow conditions exist due to     improper  validation of user-supplied input when     handling HTTP2 frames. An attacker can exploit these to     crash the application, resulting in a denial of service.
    (CVE-2015-7218, CVE-2015-7219)

  - An overflow condition exists in the XDRBuffer::grow()     function due to improper validation of user-supplied     input. An attacker can exploit this to cause a buffer     overflow, resulting in the execution of arbitrary code.
    (CVE-2015-7220)

  - An overflow condition exists in the GrowCapacity()     function due to improper validation of user-supplied     input. An attacker can exploit this to cause a buffer     overflow, resulting in the execution of arbitrary code.
    (CVE-2015-7221)

  - An integer underflow condition exists in the bundled     version of libstagefright in the parseChunk() function     that is triggered when handling 'covr' chunks. An     unauthenticated, remote attacker can exploit this, via     specially crafted media content, to crash the     application or execute arbitrary code. (CVE-2015-7222)

  - A privilege escalation vulnerability exists in the     Extension.jsm script due to a failure to restrict     WebExtension APIs from being injected into documents     without WebExtension principals. An attacker can exploit     this to conduct a cross-site scripting attack, resulting     in the execution of arbitrary script code in a user's     browser session. (CVE-2015-7223)

Mozilla Firefox was updated to version 38.5.0 ESR.

It fixes the following security issues :

  - MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 Miscellaneous     memory safety hazards (rv:43.0 / rv:38.5)

  - MFSA 2015-138/CVE-2015-7210 Use-after-free in WebRTC     when datachannel is used after being destroyed

  - MFSA 2015-139/CVE-2015-7212 Integer overflow allocating     extremely large textures

  - MFSA 2015-145/CVE-2015-7205 Underflow through code     inspection

  - MFSA 2015-146/CVE-2015-7213 Integer overflow in MP4     playback in 64-bit versions

  - MFSA 2015-147/CVE-2015-7222 Integer underflow and buffer     overflow processing MP4 metadata in libstagefright

  - MFSA 2015-149/CVE-2015-7214 Cross-site reading attack     through data and view-source URIs

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
87648	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:2335-1)	Nessus	SuSE Local Security Checks	12/29/2015	1/6/2021	critical
87474	Firefox < 43 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	12/17/2015	3/3/2026	critical
87649	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:2336-1)	Nessus	SuSE Local Security Checks	12/29/2015	1/19/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical