KLA10748 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, spoof user interface and execute arbitrary code.

Below is a complete list of vulnerabilities

1. Multiple memory safety bugs can be exploited remotely to cause denial of service or execute arbitrary code;
2. Improper image parsing can be exploited remotely via a specially designed GIF image to cause denial of service;
3. Buffer overflow can be exploited remotely via a specially designed WebGL content to execute arbitrary code;
4. Lack of RFC enforcement can be exploited remotely via a specially designed cookies to cause denial of service;
5. Improper URLs and bookmarks handling can be exploited remotely to spoof user interface; (Android)
6. Double click mishandle can be exploited remotely via a specially designed dialog to spoof user interface;
7. Improper Network Security Services handling can be exploited to bypass security restrictions;
8. Improper dialog handling can be exploited remotely via clickjacking to spoof user interface; (OS X)
9. Improper scroll-to realization can be exploited remotely to spoof user interface; (Android)
10. Improper address bar protocol handling can be exploited remotely to spoof user interface;
11. Memory safety bug at ANGLE can be exploited remotely to cause denial of service;
12. Improper pointer handling while handling zip files can be exploited remotely via a specially designed zip archive;
13. Integer overflow at libstagefright can be exploited remotely via a specially designed MP4 file to execute arbitrary code;
14. Unavailability of Application Reputation service can be exploited remotely to spoof user interface;
15. Lack of https enforcement at lightweight themes installation can be exploited remotely via man-in-the-middle attack.

Technical details

Vulnerability (1) related to uninitialized memory encountered during brotli data compression.

Vulnerability (3) related to the BufferSubData function.

Vulnerability (4) related to violation of RFC6265: storing cookies with vertical tab characters. This vulnerability exists beacause of an incomplete fix for CVE-2015-7208.

Vulnerability (5) related to data: URLs opened from bookmark or saved shortcut. Improper host handling in this case cause data: URL still showed even after redirect.

Vulnerability (6) related to lack of delay between protocol handler dialog appears and dialog action can be conducted. This can lead double click interpreted as two single clicks let complete some action in new dialog.

Vulnerability (7) related to s_mp_div function in lib/freebl/mpi/mpi.c which improperly manipulates with mp_div or mp_exptmod functions.

Vulnerability (8) related to lack of delay between download dialog getting focus and download button getting enabled. So attacker caused user to make double click can open download dialog by first and accept it by second click.

Vulnerability (9) related to scrollTo() function. By using this function attacker can scroll address bar out of view and replace it with a fake address bar.

Vulnerability (10) related to situation where invalid URL with wyciwyg: or resource: protocols pasted to address bar. In this case address bar content can be manipulated to show improper location.

Vulnerability (11) related to Buffer11::NativeBuffer11::map function.

Vulnerability (12) related to nsZipArchive function.

Vulnerability (13) related to MoofParser::Metadata function in binding/MoofParser.cpp. This vulnerability can be triggered via specially designed metadata in MP4 file.

Vulnerability (14) caused by mishandling of reputation data absence which can easier to trigger unintended download.

Original advisories

Mozilla foundation security advisories

Related products

Mozilla-Firefox

Mozilla-Firefox-ESR

CVE list

CVE-2016-1948 warning

CVE-2016-1947 warning

CVE-2016-1946 critical

CVE-2016-1945 critical

CVE-2016-1944 critical

CVE-2016-1943 warning

CVE-2016-1942 warning

CVE-2016-1941 warning

CVE-2016-1940 warning

CVE-2016-1939 warning

CVE-2016-1938 high

CVE-2016-1937 warning

CVE-2016-1935 critical

CVE-2016-1933 warning

CVE-2016-1931 critical

CVE-2016-1930 critical

Solution

Update to the latest versionDownload Firefox

Download Firefox ESR

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Mozilla Firefox versions earlier than 44Mozilla Firefox ESR versions earlier than 38.6