KLA10584 Multiple vulnerabilities in Mozilla products

Multiple serious vulnerabilities have been found in Mozilla products. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, bypass security restrictions, execute arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

1. An unknown vulnerability can be exploited remotely via a specially designed web site or m4v file and other unknown vectors;
2. Integer overflow can be exploited remotely via a specially designed MP4 file;
3. Buffer overflow can be exploited remotely via a specially designed XML data;
4. Race condition can be exploited remotely via Media Decoder Threat manipulations;
5. Improper URL restrictions in Firefox for Android can be exploited remotely via a specially designed application;
6. Use-after-free vulnerability can be exploited remotely via a specially designed document;
7. Improper heap handling can be exploited remotely via a specially designed JavaScript;
8. Improper context-menu handling can be exploited remotely via a logs manipulation;
9. Heap-based buffer overflow can be exploited remotely via a specially designed SVG graphics.

Original advisories

Mozilla Foundation Security Advisory

Related products

Mozilla-Firefox

Mozilla-Thunderbird

Mozilla-Firefox-ESR

CVE list

CVE-2015-0833 high

CVE-2015-2710 high

CVE-2015-2718 warning

CVE-2015-2715 high

CVE-2015-2714 warning

CVE-2015-2716 critical

CVE-2011-3079 critical

CVE-2015-2711 warning

CVE-2015-2709 critical

CVE-2015-2720 warning

CVE-2015-0797 high

CVE-2015-2717 high

CVE-2015-2712 critical

CVE-2015-2713 high

CVE-2015-2708 critical

CVE-2015-4496 critical

Solution

Update to the latest versionGet Firefox

Get Thunderbird

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Mozilla Firefox versions earlier than 38.0Mozilla Firefox ESR versions earlier than 31.7Mozilla Thunderbird versions earlier than 31.7