此 Thunderbird 38.2.0 更新可修正下列問題 (bnc#940806)：

- MFSA 2015-79/CVE-2015-4473 其他記憶體安全危險

- MFSA 2015-80/CVE-2015-4475 (bmo#1175396) 透過格式錯誤的 MP3 檔案引發的超出邊界讀取問題

- MFSA 2015-82/CVE-2015-4478 (bmo#1105914) 不可設定的 JavaScript 物件內容重新定義

- MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 libstagefright 中的溢位問題

- MFSA 2015-84/CVE-2015-4481 (bmo1171518) 透過 Mozilla Maintenance Service，以硬連結引發的任意檔案覆寫 (只影響 Windows)

- MFSA 2015-85/CVE-2015-4482 (bmo#1184500) 利用 Updater 和惡意 MAR 檔案引發的超出邊界寫入 (不會影響未隨附更新程式的 openSUSE RPM 套件)

- MFSA 2015-87/CVE-2015-4484 (bmo#1171540) 在 JavaScript 中使用共用記憶體時當機

- MFSA 2015-88/CVE-2015-4491 (bmo#1184009) 縮放點陣圖影像時 gdk-pixbuf 中發生堆積溢位

- MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948、bmo#1178148) 解碼 WebM 視訊時 Libvpx 上發生緩衝區溢位

- MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 在程式碼檢查過程中發現多個弱點

- MFSA 2015-92/CVE-2015-4492 (bmo#1185820) 含有共用背景工作的 XMLHttpRequest 發生釋放後使用問題

遠端 Mac OS X 主機上安裝的 Firefox ESR 版本為 38.2 之前的版本。因此受到以下弱點影響：

- 存在多個記憶體損毀問題，會允許遠端攻擊者透過特製的網頁損毀記憶體，且可能執行任意程式碼。
 (CVE-2015-4473)

- PlayFromAudioQueue() 函式中存在一個超出邊界讀取錯誤，是因不當處理不相符的範例格式所導致。遠端攻擊者可加以惡意利用，透過特製的 MP3 檔案來洩漏記憶體內容或執行任意程式碼。
 (CVE-2015-4475)

- 存在一個同源原則繞過弱點，是因 JSON 剖析期間，違反 ECMAScript 6 標準而重新定義不可設定的內容所導致。遠端攻擊者可加以惡意利用，將這些內容編輯為任意值，藉此繞過同源原則。(CVE-2015-4478)

- 存在多個整數溢位情形，是因處理 MPEG4 視訊中的「aio」區塊時，不當驗證使用者提供的輸入所導致。遠端攻擊者可加以惡意利用，透過特製的 MPEG4 檔案來執行任意程式碼。(CVE-2015-4479)

- 處理 H.264 媒體內容時，隨附的 libstagefright 元件中存在一個整數溢位情形。遠端攻擊者可加以惡意利用，透過特製的 MPEG4 檔案來執行任意程式碼。
 (CVE-2015-4480)

- 存在一個超出邊界寫入錯誤，是因處理 MAR 檔案中的索引名稱時，mar_consume_index() 函式出現一個陣列索引瑕疵所導致。攻擊者可惡意利用這點執行任意程式碼。(CVE-2015-4482)

- 使用共用記憶體處理 JavaScript 卻未正確控制 Atomics 和 SharedArrayBuffer 檢視的存取權時，存在一個拒絕服務弱點。攻擊者可加以惡意利用以造成程式損毀，進而導致拒絕服務情形。
 (CVE-2015-4484)

- resize_context_buffers() 函式中存在一個堆積型緩衝區溢位情形，是因不當驗證使用者提供的輸入所導致。遠端攻擊者可加以惡意利用，透過特製的 WebM 內容來造成堆積型緩衝區溢位，進而導致任意程式碼執行。(CVE-2015-4485)

- decrease_ref_count() 函式中存在一個堆積型緩衝區溢位情形，是因不當驗證使用者提供的輸入所導致。遠端攻擊者可加以惡意利用，透過特製的 WebM 內容來造成堆積型緩衝區溢位，進而導致任意程式碼執行。(CVE-2015-4486)

- ReplacePrep() 函式中存在一個緩衝區溢位情形。遠端攻擊者可加以惡意利用以造成緩衝區溢位，進而導致任意程式碼執行。(CVE-2015-4487)

- operator=() 函式中存在一個釋放後使用錯誤。攻擊者可加以利用，解除參照已釋放的記憶體，進而導致執行任意程式碼。(CVE-2015-4488)

- nsTArray_Impl() 函式中存在一個記憶體損毀問題，是因自我指派期間不當驗證使用者提供的輸入所導致。攻擊者可加以惡意利用以損毀記憶體，進而導致任意程式碼執行。(CVE-2015-4489)

- XMLHttpRequest::Open() 函式中存在一個釋放後使用錯誤，是因不當處理遞迴呼叫所導致。攻擊者可加以利用，解除參照已釋放的記憶體，進而導致執行任意程式碼。(CVE-2015-4492)

- 隨附的 libstagefright 程式庫中存在一個整數反向溢位情形。攻擊者可加以惡意利用以造成應用程式損毀，進而導致拒絕服務情形。(CVE-2015-4493)

Mozilla Project 報告：

MFSA 2015-79 其他記憶體安全性危險 (rv:40.0 / rv:38.2)

MFSA 2015-80 透過格式錯誤的 MP3 檔案引發的超出邊界讀取

MFSA 2015-81 MediaStream 播放過程中的釋放後使用

MFSA 2015-82 不可設定之 JavaScript 物件屬性的重新定義

MFSA 2015-83 libstagefright 中的溢位問題

MFSA 2015-84 透過 Mozilla Maintenance Service，以硬連結引發的任意檔案覆寫

MFSA 2015-85 透過更新程式與惡意 MAR 檔案引發的超出邊界寫入

MFSA 2015-86 含有 POST 的 Feed 通訊協定繞過混合內容保護

MFSA 2015-87 在 JavaScript 中使用共用記憶體時當機

MFSA 2015-88 縮放點陣圖影像時 gdk-pixbuf 中發生堆積溢位

MFSA 2015-90 在程式碼檢查過程中發現多個弱點

MFSA 2015-91 Mozilla 內容安全性原則違反 CSP 規格，允許使用星號萬用字元

MFSA 2015-92 含有共用背景工作的 XMLHttpRequest 發生釋放後使用

遠端主機受到 GLSA-201605-06 中所述的弱點影響 (Mozilla 產品：多個弱點)

在 Firefox、NSS、NSPR 和 Thunderbird 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者還可能發動攔截式攻擊、取得敏感資訊、偽造位址列、發動點擊劫持攻擊、繞過安全性限制和保護機制，或造成其他不明影響。
 因應措施：

目前尚無已知的因應措施。

The version of Mozilla Firefox is prior to 40.0 and is affected by multiple vulnerabilities : 

 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4473) 
 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4474) 
 - An out-of-bounds read error exists in the 'PlayFromAudioQueue()' function due to improper handling of mismatched sample formats. A remote attacker can exploit this, via a specially crafted MP3 file, to disclose memory contents or execute arbitrary code. (CVE-2015-4475) 
 - A use-after-free error exists in the Web Audio API during MediaStream playback. A remote attacker can exploit this to dereference already freed memory, resulting in the potential execution of arbitrary code. (CVE-2015-4477) 
 - A same-origin policy bypass vulnerability exists due to non-configurable properties being redefined in violation of the ECMAScript 6 standard during JSON parsing. A remote attacker can exploit this, by editing these properties to arbitrary values, to bypass the same-origin policy. (CVE-2015-4478) 
 - Multiple integer overflow conditions exist due to improper validation of user-supplied input when handling 'saio' chunks in MPEG4 video. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4479) 
 - An integer overflow condition exists in the bundled libstagefright component when handling H.264 media content. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4480) 
 - An arbitrary file overwrite vulnerability exists in the Mozilla Maintenance Service due to a race condition. An attacker can exploit this, via the use of a hard link, to overwrite arbitrary files with log output. (CVE-2015-4481) 
 - An out-of-bounds write error exists due to an array indexing flaw in the 'mar_consume_index()' function when handling index names in MAR files. An attacker can exploit this to execute arbitrary code. (CVE-2015-4482) 
 - A security bypass vulnerability exists due to a flaw in the 'ShouldLoad()' function that occurs during the handling of POST requests to URLs using the 'feed:' URI handler. An attacker can exploit this to bypass the mixed content blocker. (CVE-2015-4483) 
 - A denial of service vulnerability exists when handling JavaScript using shared memory without properly gating access to Atomics and SharedArrayBuffer views. An attacker can exploit this to crash the program, resulting in a denial of service condition. (CVE-2015-4484) 
 - A heap-based buffer overflow condition exists in the  'resize_context_buffers()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4485) 
 - A heap-based buffer overflow condition exists in the 'decrease_ref_count()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4486) 
 - A buffer overflow condition exists in the 'ReplacePrep()' function. A remote attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4487) 
 - A use-after-free error exists in the 'operator=()' function. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4488) 
 - A memory corruption issue exists in the 'nsTArray_Impl()' function due to improper validation of user-supplied input during self-assignment. An attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2015-4489) 
 - A security bypass vulnerability exists due to a discrepancy in the implementation of Content Security Policy and the CSP specification. The specification states that 'blob:', 'data:', and 'filesystem:' URLs should be excluded in case of a wildcard when matching source expressions, but Mozilla's implementation allows these in the case of an asterisk wildcard. A remote attacker can exploit this to bypass restrictions. (CVE-2015-4490) 
 - A use-after-free error exists in the 'XMLHttpRequest::Open()' function due to improper handling of recursive calls. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4492) 
 - An integer underflow condition exists in the bundled libstagefright library. An attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-4493) 
 - A flaw in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files. (CVE-2015-4495)

Versions of Firefox OS prior to 2.2 are outdated and thus unpatched for the following vulnerabilities : 

 - A logic error in 'apps/system/js/usb_storage.js' that is triggered during the handling of USB mass storage. This may allow a local attacker with access to the USB host to gain access to USB media volumes that are locked with a passcode after a reboot or certain unspecified screen saver state changes. (CVE-2015-5960) 
 - A flaw exists in the SharedBufferManagerParent::RecvAllocateGrallocBuffer() function in 'gfx/layers/ipc/SharedBufferManagerParent.cpp'. This may allow an attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2015-5960) 
 - A flaw exists in the 'FxAccounts signup dialog' that is triggered as input passed via the COPPA error screen is not properly sanitized before being passed to the B2G root process. This may allow a remote attacker to inject arbitrary web content into the B2G root process. (CVE-2015-5961) 
 - A flaw exists in 'dom/messages/SystemMessagePermissionsChecker.jsm' within the WiFi-related system message, as the system fails to restrict system messages to applications with the 'wifi-manage' permissions. With an unprivileged application, a local attacker can gain access to limited information from system messages. (CVE-2015-4494) 
 - A use-after-free error affects the StyleAnimationValue::operator=() function in 'layout/style/StyleAnimationValue.cpp'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-4488) 
 - An unspecified flaw exists in the nsTArray_Impl() function. The issue is triggered as user-supplied input is not properly validated during self-assignment. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4489) 
 - An overflow condition affects the nsTSubstring::ReplacePrep() function. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2015-4487) 
 - Gaia contains a flaw in the search app within 'apps/search/js/providers/provider.js' that is triggered during the handling of a specially crafted search link. When the link is opened in the browser and the browser is re-opened or a new tab is opened, a context-dependent attacker can potentially inject HTML content. (CVE-2015-2744) 
 - Gaia contains a flaw in 'apps/system/js/card.js' that is triggered when handling titles. When the link is opened in the browser and the HOME button is pressed or the Show Windows function is used, a context-dependent attacker can potentially inject HTML content. (CVE-2015-2745) 
 - A flaw affects the nsDocShell::LoadURI() function in 'docshell/base/nsDocShell.cpp' that is triggered when converting an expanded principal into inheriting the current principal. This may allow a context-dependent attacker to bypass the same-origin policy and disclose the contents of local files. (CVE-2015-4495)

ID	Name	Product	Family	Published	Updated	Severity
85703	openSUSE 安全性更新：MozillaThunderbird (openSUSE-2015-559)	Nessus	SuSE Local Security Checks	8/31/2015	1/19/2021	critical
85383	Firefox ESR < 38.2 多個弱點 (Mac OS X)	Nessus	MacOS X Local Security Checks	8/13/2015	11/22/2019	critical
85338	FreeBSD：mozilla -- 多個弱點 (c66a5632-708a-4727-8236-d65b2d5b2739)	Nessus	FreeBSD Local Security Checks	8/12/2015	1/6/2021	critical
91379	GLSA-201605-06：Mozilla 產品：多個弱點	Nessus	Gentoo Local Security Checks	5/31/2016	12/5/2022	critical
8856	Mozilla Firefox < 40.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/9/2015	3/6/2019	critical
8878	Firefox OS < 2.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	9/24/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical