KLA10852 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code, spoof user interface, bypass security restrictions, conduct cross-site scripting or read local files.

Below is a complete list of vulnerabilities

1. An improper network connection handling can be exploited remotely via traffic overview to obtain sensitive information;
2. Multiple unknown vulnerabilities at the browser engine can be exploited remotely to cause denial of service or possibly execute arbitrary code;
3. Buffer overflow vulnerability at ClearKey Content Decryption Module can be exploited remotely via a specially designed video to execute arbitrary code;
4. Buffer overflow can be exploited remotely via a specially designed SVG document to execute arbitrary code;
5. An improper cairo calls can be exploited remotely via a specially designed video to cause denial of service;
6. Lack of restrictions can be exploited remotely via a specially designed API calls to obtain sensitive information;
7. An unknown vulnerability can be exploited remotely via a specially designed URL to spoof user interface;
8. Buffer overflow can be exploited remotely via a specially designed graphics to execute arbitrary code;
9. An unknown vulnerability at Updater can be exploited locally via vectors related to callback application-path parameter and a hard link to write arbitrary files;
10. Use-after-free vulnerability can be exploited via vectors related to keyboard yo cause denial of service or execute arbitrary code;
11. Use-after-free vulnerability can be exploited via a specially designed JavaScript to execute arbitrary code;
12. Use-after-free at WebRTC can be exploited remotely to execute arbitrary code;
13. Use-after-free vulnerability can be exploited remotely via a specially designed script to execute arbitrary code;
14. An improper input types handling at Sessions Manager can be exploited via session restoration file reading to obtain sensitive information;
15. Integer overflow at WebSocket can be exploited remotely via a specially designed packets to cause denial of service or execute arbitrary code;
16. Lack of restrictions can be exploited via a specially designed web-site to conduct cross-site scripting;
17. An improper rendering display transformation handling can be exploited remotely via a specially designed web site to execute arbitrary code;
18. Use-after-free vulnerability can be exploited remotely via a specially designed SVG element to cause denial of service or execute arbitrary code;
19. An unknown vulnerability can be exploited user-assisted remote attackers via a files manipulation to bypass security restrictions, conduct universal cross-site scripting attack or read arbitrary files;
20. Lack of drag-n-drop restrictions can be exploited via a specially designed web site to access local files;
21. An unknown vulnerability can be exploited remotely via a special characters to spoof user interface;
22. An improper flags handling can be exploited via a specially designed URL to spoof user interface.

Technical details

To exploit vulnerability №2 can be exploited via vectors related to Http2Session::Shutdown, SpdySession31::Shutdown, and other vectors.

Vulnerability №3 can be exploited via malformed video and Gecko Media Plugin (GMP) sandbox bypass.

Vulnerability №4 caused by Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function

Vulnerability №5 related to cairo _cairo_surface_get_extents calls that do not properly interact with libav header allocation in FFmpeg 0.10

Vulnerability №8 caused by Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function

Vulnerability №10 related to nsXULPopupManager::KeyDown function

Vulnerability №11 related to js::PreliminaryObjectArray::sweep function

Vulnerability №12 related to WebRTC socket thread

Vulnerability №13 related to CanonicalizeXPCOMParticipant function

Vulnerability №14 caused by mishandling changes from ‘INPUT type=”password”‘ to ‘INPUT type=”text”‘ within a single Session Manager session

Vulnerability №15 can be exploited via packets that trigger incorrect buffer-resize operations during buffering

Vulnerability №16 related to process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox=”allow-scripts” attribute value

Vulnerability №17 related to nsDisplayList::HitTest function that mishandles rendering display transformation

Vulnerability №18 related to nsNodeUtils::NativeAnonymousChildListChange function

Vulnerability №20 caused by not restricted drag-and-drop (aka dataTransfer) actions for file: URIs

Vulnerability №21 can be exploited via left-to-right characters in conjunction with a right-to-left character set. (Android)

Vulnerability №22 caused by an improper LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags handling.

Original advisories

Mozilla Foundation Security Advisories page

Related products

Mozilla-Firefox

Mozilla-Firefox-ESR

CVE list

CVE-2016-5250 warning

CVE-2016-5261 critical

CVE-2016-2830 warning

CVE-2016-2835 high

CVE-2016-2836 high

CVE-2016-2837 high

CVE-2016-2838 high

CVE-2016-2839 warning

CVE-2016-5251 warning

CVE-2016-5252 high

CVE-2016-5253 warning

CVE-2016-5254 critical

CVE-2016-5255 high

CVE-2016-5258 high

CVE-2016-5259 high

CVE-2016-5260 warning

CVE-2016-5262 warning

CVE-2016-5263 high

CVE-2016-5264 high

CVE-2016-5265 warning

CVE-2016-5266 high

CVE-2016-5267 warning

CVE-2016-5268 warning

Solution

Update to the latest versionGet Mozilla Firefox

Get Mozilla Firefox ESR

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Firefox versions earlier than 48.0Firefox ESR versions earlier than 45.3