MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues :

  - MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES

  - MFSA 2016-95/CVE-2016-9901: Data from Pocket server     improperly sanitized before execution

  - MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor     while manipulating DOM subtrees

  - MFSA 2016-95/CVE-2016-9899: Use-after-free while     manipulating DOM events and audio elements

  - MFSA 2016-95/CVE-2016-9904: Cross-origin information     leak in shared atoms

  - MFSA 2016-95/CVE-2016-9905: Crash in     EnumerateSubDocuments

  - MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag

  - MFSA 2016-95/CVE-2016-9900: Restricted external     resources can be loaded by SVG images through data URLs

  - MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in     Firefox 50.1 and Firefox ESR 45.6

  - MFSA 2016-95/CVE-2016-9902: Pocket extension does not     validate the origin of events Please see     https://www.mozilla.org/en-US/security/advisories/mfsa20     16-95/ for more information.

  - Fix fontconfig issue (bsc#1000751) on 32bit systems as     well.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for firefox is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 45.6.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895, CVE-2016-9897, CVE-2016-9898, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9904, CVE-2016-9905)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Philipp, Wladimir Palant, Nils, Jann Horn, Aral, Andrew Krasichkov, insertscript, Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky as the original reporters.

Mozilla Foundation reports :

CVE-2016-9894: Buffer overflow in SkiaGL

CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements

CVE-2016-9895: CSP bypass using marquee tag

CVE-2016-9896: Use-after-free with WebVR

CVE-2016-9897: Memory corruption in libGLES

CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees

CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs

CVE-2016-9904: Cross-origin information leak in shared atoms

CVE-2016-9901: Data from Pocket server improperly sanitized before execution

CVE-2016-9902: Pocket extension does not validate the origin of events

CVE-2016-9903: XSS injection vulnerability in add-ons SDK

CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6

This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities :

  - CVE-2016-9894: Buffer overflow in SkiaGL

  - CVE-2016-9899: Use-after-free while manipulating DOM     events and audio elements

  - CVE-2016-9895: CSP bypass using marquee tag

  - CVE-2016-9896: Use-after-free with WebVR

  - CVE-2016-9897: Memory corruption in libGLES

  - CVE-2016-9898: Use-after-free in Editor while     manipulating DOM subtrees

  - CVE-2016-9900: Restricted external resources can be     loaded by SVG images through data URLs

  - CVE-2016-9904: Cross-origin information leak in shared     atoms

  - CVE-2016-9901: Data from Pocket server improperly     sanitized before execution

  - CVE-2016-9902: Pocket extension does not validate the     origin of events

  - CVE-2016-9903: XSS injection vulnerability in add-ons     SDK

  - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

  - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1     and Firefox ESR 45.6

The following bugs were fixed :

  - boo#1011922: fix crash after a few seconds of usage on     AArch64

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3165-1 advisory.

    Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a     specially crafted message, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code. (CVE-2016-9893, CVE-2017-5373)

    Andrew Krasichkov discovered that event handlers on <marquee> elements were executed despite a Content     Security Policy (CSP) that disallowed inline JavaScript. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit this to conduct cross-site     scripting (XSS) attacks. (CVE-2016-9895)

    A memory corruption issue was discovered in WebGL in some circumstances. If a user were tricked in to     opening a specially crafted website in a browsing context, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9897)

    A use-after-free was discovered when manipulating DOM subtrees in the Editor. If a user were tricked in to     opening a specially crafted website in a browsing context, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9898)

    A use-after-free was discovered when manipulating DOM events and audio elements. If a user were tricked in     to opening a specially crafted website in a browsing context, an attacker could potentially exploit this     to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9899)

    It was discovered that external resources that should be blocked when loading SVG images can bypass     security restrictions using data: URLs. An attacker could potentially exploit this to obtain sensitive     information. (CVE-2016-9900)

    Jann Horn discovered that JavaScript Map/Set were vulnerable to timing attacks. If a user were tricked in     to opening a specially crafted website in a browsing context, an attacker could potentially exploit this     to obtain sensitive information across domains. (CVE-2016-9904)

    A crash was discovered in EnumerateSubDocuments while adding or removing sub-documents. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to execute arbitrary code. (CVE-2016-9905)

    JIT code allocation can allow a bypass of ASLR protections in some circumstances. If a user were tricked     in to opening a specially crafted website in a browsing context, an attacker could potentially exploit     this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5375)

    Nicolas Grgoire discovered a use-after-free when manipulating XSL in XSLT documents in some     circumstances. If a user were tricked in to opening a specially crafted website in a browsing context, an     attacker could potentially exploit this to cause a denial of service via application crash, or execute     arbitrary code. (CVE-2017-5376)

    Jann Horn discovered that an object's address could be discovered through hashed codes of JavaScript     objects shared between pages. If a user were tricked in to opening a specially crafted website in a     browsing context, an attacker could potentially exploit this to obtain sensitive information.
    (CVE-2017-5378)

    A use-after-free was discovered during DOM manipulation of SVG content in some circumstances. If a user     were tricked in to opening a specially crafted website in a browsing context, an attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-5380)

    Armin Razmjou discovered that certain unicode glyphs do not trigger punycode display. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to spoof the URL bar contents. (CVE-2017-5383)

    Jerri Rice discovered insecure communication methods in the Dev Tools JSON Viewer. An attacker could     potentially exploit this to gain additional privileges. (CVE-2017-5390)

    Filipe Gomes discovered a use-after-free in the media decoder in some circumstances. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-5396)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox.
    (CVE-2016-9079,CVE-2016-9893,CVE-2016-9895,CVE-2016-989     7,CVE-2016-9898,CVE-2016-9899,CVE-2016-9900,CVE-2016-99     01,CVE-2016-9902,CVE-2016-9904,CVE-2016-9905,CVE-2017-5     373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378,     CVE-2017-5380, CVE-2017-5383, CVE-2017-5386,     CVE-2017-5390, CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Mozilla Firefox ESR earlier than 45.6 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'GetNPObjectWrapper()' function in 'dom/plugins/base/nsJSNPRuntime.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ObjectGroup::defaultNewGroup()' function in 'js/src/vm/ObjectGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling HTML5 content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsDocShell::RestoreFromHistory()' function in 'docshell/base/nsDocShell.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'Factory::CreateDrawTargetForData()' function in 'gfx/2d/Factory.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaRecorder.cpp' that is triggered when handling a document's activity state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHttpChunkedDecoder::ParseChunkRemaining()' function in 'netwerk/protocol/http/nsHttpChunkedDecoder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling media content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocument::EnumerateSubDocuments()' function in 'dom/base/nsDocument.cpp' that is triggered when adding and removing sub-documents. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/BindingUtils.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling DOM subtrees. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'VaryingPacking::packVarying()' function in 'libANGLE/renderer/d3d/hlsl/VaryingPacking.cpp'. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling failing node adoption. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as event handlers for marquee elements are executed despite restrictions against inline JavaScript. This may allow a context-dependent attacker to bypass the Content Security Policy (CSP).
 - A flaw exists in the 'nsDataDocumentContentPolicy::ShouldLoad()' function in 'dom/base/nsDataDocumentContentPolicy.cpp', as external resources may be inappropriately loaded by SVG images by utilizing 'data: URLs'. This may allow a context-dependent attacker to disclose potentially sensitive cross-domain information.
 - A flaw exists that is triggered as HTML tags from the Pocket server are not properly sanitized before use. This may allow a context-dependent attacker to inject content and gain access to the Pocket Messaging API.
 - A flaw exists in 'browser/extensions/pocket/content/main.js' related to the Pocket toolbar button, as it fails to properly verify the origin of events. This may potentially allow a context-dependent attacker to execute commands from other contexts.
 - A flaw exists that is triggered as atom information may be exposed. This may allow a context-dependent attacker to use a JavaScript Map/Set timing attack to determine if atoms are used by other compartments or zones, potentially disclosing cross-domain information.

Versions of Mozilla Firefox prior to 50.1 are unpatched for the following vulnerabilities :

 - A flaw exists in 'layout/style/nsRuleNode.cpp' that is triggered when handling style contexts. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'GrResourceProvider::createBuffer()' function in 'gfx/skia/skia/src/gpu/GrResourceProvider.cpp'. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling clamped gradients. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A flaw exists in the 'GetNPObjectWrapper()' function in 'dom/plugins/base/nsJSNPRuntime.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ObjectGroup::defaultNewGroup()' function in 'js/src/vm/ObjectGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling HTML5 content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsDocShell::RestoreFromHistory()' function in 'docshell/base/nsDocShell.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'Factory::CreateDrawTargetForData()' function in 'gfx/2d/Factory.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaRecorder.cpp' that is triggered when handling a document's activity state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHttpChunkedDecoder::ParseChunkRemaining()' function in 'network/protocol/http/nsHttpChunkedDecoder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling media content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/BindingUtils.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists because 'addon-sdk/source/lib/sdk/ui/frame/view.html' and 'addon-sdk/source/lib/sdk/ui/frame/view.js' within the Add-ons SDK do not properly validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and an add-on.
 - A use-after-free error exists in the handling of navigator objects within WebVR. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling DOM subtrees. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'VaryingPacking::packVarying()' function in 'libANGLE/renderer/d3d/hlsl/VaryingPacking.cpp'. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling failing node adoption. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as event handlers for marquee elements are executed despite restrictions against inline JavaScript. This may allow a context-dependent attacker to bypass the Content Security Policy (CSP).
 - A flaw exists in the 'nsDataDocumentContentPolicy::ShouldLoad()' function in 'dom/base/nsDataDocumentContentPolicy.cpp', as external resources may be inappropriately loaded by SVG images by utilizing 'data: URLs'. This may allow a context-dependent to disclose potentially sensitive cross-domain information.
 - A flaw exists that is triggered as HTML tags from the Pocket server are not properly sanitized before use. This may allow a context-dependent attacker to inject content and gain access to the Pocket Messaging API.
 - A flaw exists in 'browser/extensions/pocket/content/main.js' related to the Pocket toolbar button, as it fails to properly verify the origin of events. This may potentially allow a context-dependent attacker to execute commands from other contexts.
 - A flaw exists that is triggered as atom information may be exposed. This may allow a context-dependent attacker to use a JavaScript Map/Set timing attack to determine if atoms are used by other compartments or zones, potentially disclosing cross-domain information.

ID	Name	Product	Family	Published	Updated	Severity
96083	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2016:3223-1)	Nessus	SuSE Local Security Checks	12/22/2016	1/19/2021	critical
96004	CentOS 5 / 6 / 7 : firefox (CESA-2016:2946)	Nessus	CentOS Local Security Checks	12/20/2016	1/4/2021	critical
95814	FreeBSD : mozilla -- multiple vulnerabilities (512c0ffd-cd39-4da4-b2dc-81ff4ba8e238)	Nessus	FreeBSD Local Security Checks	12/14/2016	1/4/2021	critical
96030	openSUSE Security Update : MozillaFirefox (openSUSE-2016-1490)	Nessus	SuSE Local Security Checks	12/20/2016	1/19/2021	critical
96871	Ubuntu 14.04 LTS / 16.04 LTS : Thunderbird vulnerabilities (USN-3165-1)	Nessus	Ubuntu Local Security Checks	1/30/2017	8/27/2024	critical
99857	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1011)	Nessus	Huawei Local Security Checks	5/1/2017	6/22/2023	critical
9853	Mozilla Firefox ESR < 45.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/5/2017	11/6/2019	high
9851	Mozilla Firefox < 50.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/5/2017	3/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

high

high