KLA11004 Multiple vulnerabilities in Mozilla Firefox and Mozilla Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox and Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause a denial of service, spoof user interface, obtain sensitive information, execute arbitrary code, perform cross-site scripting attacks, bypass security restrictions, gain privileges and read/write local files.

Below is a complete list of vulnerabilities:

1. A use-after-free vulnerability in SMIL can be exploited remotely to cause denial of service;
2. A use-after-free vulnerability which occurs during transaction processing in the editor can be exploited remotely to cause a denial of service;
3. An out-of-bounds write vulnerability in the Graphite 2 library can be exploited remotely to cause a denial of service;
4. An out-of-bounds write vulnerability in BASE64 encoding in NSS can be exploited remotely to cause a denial of service;
5. A buffer overflow vulnerability in WebGL can be exploited remotely to cause denial of service;
6. A use-after-free vulnerability in focus handling can be exploited remotely to cause denial of service;
7. A use-after-free vulnerability in text input selection can be exploited remotely to cause denial of service;
8. A use-after-free vulnerability in frame selection can be exploited remotely to cause denial of service;
9. A use-after-free vulnerability in nsAutoPtr and nsTArrayLength() during XSLT processing can be exploited remotely to cause denial of service;
10. A use-after-free vulnerability in txExecutionState destructor related to XSLT processing can be exploited remotely to cause denial of service;
11. A use-after-free vulnerability related to holding a selection during scroll events can be exploited remotely to cause denial of service;
12. A use-after-free vulnerability related to style changes when manipulating DOM elements can be exploited remotely to cause denial of service;
13. A memory corruption vulnerability related to DOM manipulations of the accessibility tree can be exploited remotely to cause denial of service;
14. An out-of-bounds write vulnerability in BinHex decoding can be exploited remotely to cause denial of service;
15. A buffer overflow vulnerability in application/http-index-format content can be exploited remotely to allow out-of-bounds reading of data from memory;
16. An out-of-bounds read vulnerability related to HTTP/2 DATA frames are sent with incorrect data content can be exploited remotely to cause a denial of service;
17. An out-of-bounds read vulnerability related to glyph processing can be exploited remotely to cause denial of service;
18. An out-of-bounds read vulnerability in ConvolvePixel can be exploited remotely to cause denial of service;
19. An out-of-bounds write vulnerability in ClearKeyDecryptor can be exploited remotely to cause denial of service;
20. Multiple out-of-bounds read vulnerabilities in the Libevent library can be exploited remotely to cause denial of service;
21. A potential buffer overflow vulnerability in flex-generated code can be exploited remotely to cause denial of service;
22. A reading of uninitialized memory vulnerability in application/http-index-format content can be exploited remotely to read uninitialized memory;
23. An improper DRBG number generation in NSS (Network Security Services) library can be exploited remotely possibly to cause a denial of service or execute arbitrary code;
24. Multiple memory corruption vulnerabilities, which occur because of memory safety bugs, can be exploited remotely to execute arbitrary code
25. Origin confusion vulnerability related to reloading isolated data:text/html URL can be exploited remotely to execute a cross-site scripting (XSS) attack;
26. An improper sandbox escape handling can be exploited remotely through file picker via relative paths to bypass security restrictions and gain privileges (get read only access to the local file system);
27. An incorrect handling of the internal feed reader APIs which crossed the sandbox barrier can be exploited remotely to gain privileges and possibly to execute arbitrary code inside the sandboxed process;
28. An improper work of file system request constructor in the sandbox can be exploited remotely via a specially designed IPC message to bypass security restrictions, read and write files in the local system;
29. A potential vulnerability related to layout and manipulation of bidirectional unicode text in concert with CSS animations can be exploited remotely to cause denial of service;
30. An addressbar spoofing vulnerability in onblur event can be exploited remotely to make the loaded site appear to be different from the one actually loaded within the addressbar;
31. A potential memory corruption occurring while drawing Skia content outside the bounds of a clipping region can be exploited remotely possibly to cause a denial of service;
32. An incorrect handling of escape characters sent as URL parameters for a feed’s title element while injecting static HTML into the RSS reader preview page can be exploited remotely to spoof user interface;
33. An improper handling of drag and drop of a javascript: URL into the adressbar can be exploited remotely to perform an XSS (cross-site scripting) attack on themselves;
34. An issue with improper ownership model of privateBrowsing information (which is exposed through deleveloper tools) can be exploited remotely while debugging to cause a denial of service.

Technical details

Vulnerability (23) can affect displayed text so that the loaded site will look different from the one which is to be loaded within the adressbar.

Vulnerability (29) occurs because unitialized values are used to create an array.

Vulnerability (31) occurs because in the NSS library the internal state V does not correctly carry bits over.

Vulnerabilities 1-24 are related for Mozilla Firefox ESR before 45.9

Vulnerabilities 1-31 are related for Mozilla Firefox ESR before 52.1

All vulnerabilities are related for Mozilla Firefox.

NB: This vulnerability have no public CVSS rating so rating can be changed by the time.

NB: At this moment Mozilla just reserved CVE numbers for this vulnerabilities. Information can be changed soon.

Original advisories

MFSA-2017-10

MFSA-2017-11

MFSA-2017-12

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Mozilla-Firefox

Mozilla-Firefox-ESR

CVE list

CVE-2016-10197 warning

CVE-2017-5461 critical

CVE-2016-6354 critical

CVE-2017-5433 critical

CVE-2017-5435 critical

CVE-2017-5436 high

CVE-2017-5459 critical

CVE-2017-5466 warning

CVE-2017-5434 critical

CVE-2017-5432 critical

CVE-2017-5460 critical

CVE-2017-5438 critical

CVE-2017-5439 critical

CVE-2017-5440 critical

CVE-2017-5441 critical

CVE-2017-5442 critical

CVE-2017-5464 critical

CVE-2017-5443 critical

CVE-2017-5444 warning

CVE-2017-5446 critical

CVE-2017-5447 high

CVE-2017-5465 high

CVE-2017-5454 warning

CVE-2017-5469 critical

CVE-2017-5445 warning

CVE-2017-5449 warning

CVE-2017-5451 warning

CVE-2017-5462 warning

CVE-2017-5467 warning

CVE-2017-5430 critical

CVE-2017-5429 critical

CVE-2016-10195 critical

CVE-2016-10196 warning

CVE-2017-5448 critical

CVE-2017-5455 warning

CVE-2017-5456 critical

CVE-2017-5450 warning

CVE-2017-5463 warning

CVE-2017-5452 warning

CVE-2017-5453 warning

CVE-2017-5458 warning

CVE-2017-5468 high

Solution

Update to the latest versionDownload Mozilla Firefox

Download Mozilla Firefox ESR

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Mozilla Firefox versions earlier than 53Mozilla Firefox ESR versions earlier than 45.9Mozilla Firefox ESR versions earlier than 52.1