KLA10672 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, gain privileges, spoof user interface, impact local files, execute arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Improper memory handling can be exploited remotely via an unknown vectors to cause denial of service or execute arbitrary code;
2. Improper memory handling at mozTCPSocket implementation can be exploited remotely via an unknown vectors to obtain sensitive information;
3. Out of bounds read at color management can be exploited remotely via specially designed image to cause denial of service or obtain sensitive information;
4. Improper URL rendering at Firefox for Android can be exploited remotely via a specially designed URL to spoof user interface;
5. Lack of restrictions at updater can be exploited locally via files manipulation to overwrite arbitrary files or execute arbitrary code;
6. An unknown vulnerability at video parser can be exploited remotely via a specially designed vp9 video to cause denial of service or execute arbitrary code;
7. Unknown vulnerability at JavaScript engine can be exploited remotely via a specially designed javascript to cause denial of service;
8. An unknown vulnerability at reader mode can be exploited remotely via URL manipulations to spoof user interface;
9. Use-after-free vulnerability at IndexedDB can be exploited remotely via a specially designed web content to cause denial of service;
10. Buffer overflow vulnerability at video codec library can be exploited remotely via a specially designed WebM video to cause denial of service;
11. Use-after-free at HTML media elements can be exploited remotely via URI table manipulations to cause denial of service;
12. Improper memory handling at 2D canvas can be exploited remotely via a specially designed surfaces to obtain sensitive information;
13. Improper scripted proxy handling can be exploited remotely via a specially designed handler to bypass security restrictions;
14. Improper API’s implementation at Gecko can be exploited remotely via a specially designed script to execute arbitrary code or gain privileges;
15. Improper image drag-n-drop handling can be exploited via an unknown vectors to obtain sensitive information;
16. Improper key generation at CORS can be exploited remotely via an unknwon vectors to bypass security restrictions;
17. An improper headers handling at CORS can be exploited remotely via a specially designed requests to bypass security restrictions;
18. Multiple memory safety vulnerabilities can be exploited remotely via an unknown vectors;
19. Improper memory handling at ANGLE graphics library can be exploited remotely via shaders manipulations to cause denial of service or execute arbitrary code;
20. Too fine timing resolution at High Resolution Time API can be exploited remotely via an unknown vectors to obtain sensitive information.

Technical details

Vulnerability (2) related to leaking data past the end of array. Feature that leads to vulnerability used by Firefox OS and disabled by default for other operating systems.

(3) related to QCMS color management library and can be triggered by specific attributes at ICC V4 profile of image.

If URL is pasted with unknown protocol, pasted URL is shown but no navigation occurs. Other addressbar attributes present before URL pasting will continue rendering. Which cause vulnerability (4). This vulnerability affects only Firefox for Android.

(5) caused by possibility of conducting Mozilla updater to load updated files from working directory which is under user control. This vulnerability actual only for Windows systems.

Vulnerability (7) occurs only when debugger is in use but may be potentially exploitable.

(8) allows to spoof URL but potential effects mitigated with restrictions of reader mode.

(10) caused by nestegg library and can be triggered via specially designed headers in WebM video.

Vulnerability (12) caused cairo graphics library when surfaces created with 32-bit color depth but displayed on a 16-bit color depth system. In this way attacker can obtain information in memory following 16-bit surface memory heap. This vulnerability can be exploited only on Linux.

(13) occurs when web page created a scripted proxy for window with a specially designed handler reference for the inner window will be passed.

Vulnerability (14) caused by ECMAScript 5 API, which enforces non-configurable properties with logic specific to each API. Script which bypassing API van bypass protection and make changes to the immutable properties.

(15) caused by situation when previously loaded image drag-n-dropped into content after redirect. In this case redirected URL available to scripts.

In some circumstances the same cache key can be generated for two preflight requests on a site. As a result request matches cached key will bypass CORS check leading to (16).

(17) related to Access-Control- headers, which values can be improperly reused if missed from CORS responses.

(18) describes multiple vulnerabilities at Network Utils.cpp, ConvertFialogOptinos, nsUnicodeToUTF8::GetMaxLength, nsAttrAndChildArray::GrowBy, XULContentSinkImpl::AddText, AnimationThread, InitTextures and ReadbackResultWriterD3D11:Run.

(19) caused by missing bounds check and insufficient memory allocation at libGLES portions of the ANGLE graphics library used for WebGL and OpenGL content. This vulnerability affects only Windows systems.

performance.now() uses single nanosecond resolution for timing, which making possible tracking access to the last-level cache and other sensitive information like Windows counter frequency. Vulnerability (20) caused by circumstances listed above was addressed by reducing resolution to 5 microseconds. Windows counter frequency does affect non-Windows systems.

Original advisories

Mozilla Foundation security advisories

Related products

Mozilla-Firefox

Mozilla-Firefox-ESR

CVE list

CVE-2015-7327 warning

CVE-2015-7180 critical

CVE-2015-7179 critical

CVE-2015-7178 critical

CVE-2015-7177 critical

CVE-2015-7176 critical

CVE-2015-7175 critical

CVE-2015-7174 critical

CVE-2015-4522 critical

CVE-2015-4521 critical

CVE-2015-4520 high

CVE-2015-4519 warning

CVE-2015-4517 critical

CVE-2015-4516 critical

CVE-2015-4512 high

CVE-2015-4511 high

CVE-2015-4510 high

CVE-2015-4509 critical

CVE-2015-4508 warning

CVE-2015-4507 high

CVE-2015-4506 high

CVE-2015-4505 high

CVE-2015-4504 high

CVE-2015-4503 critical

CVE-2015-4502 warning

CVE-2015-4501 critical

CVE-2015-4500 critical

CVE-2015-4476 warning

Solution

Update to the latest versionGet Firefox

Get Firefox ESR

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Mozilla Firefox versions earlier than 41Mozilla Firefox ESR versions earlier than 38.3