The New Tab page in Mozilla Firefox before 17.0 uses a privileged context for execution of JavaScript code by bookmarklets, which allows user-assisted remote attackers to run arbitrary programs by leveraging a javascript: URL in a bookmark.

Changes in xulrunner :

  - update to 17.0 (bnc#790140)

  - MFSA 2012-91/CVE-2012-5842/CVE-2012-5843 Miscellaneous     memory safety hazards

  - MFSA 2012-92/CVE-2012-4202 (bmo#758200) Buffer overflow     while rendering GIF images

  - MFSA 2012-93/CVE-2012-4201 (bmo#747607) evalInSanbox     location context incorrectly applied

  - MFSA 2012-94/CVE-2012-5836 (bmo#792857) Crash when     combining SVG text on path with CSS

  - MFSA 2012-95/CVE-2012-4203 (bmo#765628) Javascript: URLs     run in privileged context on New Tab page

  - MFSA 2012-96/CVE-2012-4204 (bmo#778603) Memory     corruption in str_unescape

  - MFSA 2012-97/CVE-2012-4205 (bmo#779821) XMLHttpRequest     inherits incorrect principal within sandbox

  - MFSA 2012-99/CVE-2012-4208 (bmo#798264) XrayWrappers     exposes chrome-only properties when not in chrome     compartment

  - MFSA 2012-100/CVE-2012-5841 (bmo#805807) Improper     security filtering for cross-origin wrappers

  - MFSA 2012-101/CVE-2012-4207 (bmo#801681) Improper     character decoding in HZ-GB-2312 charset

  - MFSA 2012-102/CVE-2012-5837 (bmo#800363) Script entered     into Developer Toolbar runs with chrome privileges

  - MFSA 2012-103/CVE-2012-4209 (bmo#792405) Frames can     shadow top.location

  - MFSA 2012-104/CVE-2012-4210 (bmo#796866) CSS and HTML     injection through Style Inspector

  - MFSA 2012-105/CVE-2012-4214/CVE-2012-4215/CVE-2012-4216/     CVE-2012-5829/CVE-2012-5839/CVE-2012-5840/CVE-2012-4212/     CVE-2012-4213/CVE-2012-4217/CVE-2012-4218 Use-after-free     and buffer overflow issues found using Address Sanitizer

  - MFSA     2012-106/CVE-2012-5830/CVE-2012-5833/CVE-2012-5835/CVE-2     012-5838 Use-after-free, buffer overflow, and memory     corruption issues found using Address Sanitizer

  - rebased patches

  - disabled WebRTC since build is broken (bmo#776877)

Changes in MozillaFirefox :

  - update to Firefox 17.0 (bnc#790140)

  - MFSA 2012-91/CVE-2012-5842/CVE-2012-5843 Miscellaneous     memory safety hazards

  - MFSA 2012-92/CVE-2012-4202 (bmo#758200) Buffer overflow     while rendering GIF images

  - MFSA 2012-93/CVE-2012-4201 (bmo#747607) evalInSanbox     location context incorrectly applied

  - MFSA 2012-94/CVE-2012-5836 (bmo#792857) Crash when     combining SVG text on path with CSS

  - MFSA 2012-95/CVE-2012-4203 (bmo#765628) Javascript: URLs     run in privileged context on New Tab page

  - MFSA 2012-96/CVE-2012-4204 (bmo#778603) Memory     corruption in str_unescape

  - MFSA 2012-97/CVE-2012-4205 (bmo#779821) XMLHttpRequest     inherits incorrect principal within sandbox

  - MFSA 2012-99/CVE-2012-4208 (bmo#798264) XrayWrappers     exposes chrome-only properties when not in chrome     compartment

  - MFSA 2012-100/CVE-2012-5841 (bmo#805807) Improper     security filtering for cross-origin wrappers

  - MFSA 2012-101/CVE-2012-4207 (bmo#801681) Improper     character decoding in HZ-GB-2312 charset

  - MFSA 2012-102/CVE-2012-5837 (bmo#800363) Script entered     into Developer Toolbar runs with chrome privileges

  - MFSA 2012-103/CVE-2012-4209 (bmo#792405) Frames can     shadow top.location

  - MFSA 2012-104/CVE-2012-4210 (bmo#796866) CSS and HTML     injection through Style Inspector

  - MFSA 2012-105/CVE-2012-4214/CVE-2012-4215/CVE-2012-4216/     CVE-2012-5829/CVE-2012-5839/CVE-2012-5840/CVE-2012-4212/     CVE-2012-4213/CVE-2012-4217/CVE-2012-4218 Use-after-free     and buffer overflow issues found using Address Sanitizer

  - MFSA     2012-106/CVE-2012-5830/CVE-2012-5833/CVE-2012-5835/CVE-2     012-5838 Use-after-free, buffer overflow, and memory     corruption issues found using Address Sanitizer

  - rebased patches

  - disabled WebRTC since build is broken (bmo#776877)

Mozilla Firefox has been updated to the 10.0.11 ESR security release, which fixes various bugs and security issues.

  - Security researcher miaubiz used the Address Sanitizer     tool to discover a series critically rated of     use-after-free, buffer overflow, and memory corruption     issues in shipped software. These issues are potentially     exploitable, allowing for remote code execution. We     would also like to thank miaubiz for reporting two     additional use-after-free and memory corruption issues     introduced during Firefox development that have been     fixed before general release. (MFSA 2012-106)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    The following issues have been fixed in Firefox 17 and     ESR 10.0.11 :

  - use-after-free when loading html file on osx.
    (CVE-2012-5830)

  - Mesa crashes on certain texImage2D calls involving     level>0. (CVE-2012-5833)

  - integer overflow, invalid write w/webgl bufferdata     (CVE-2012-5835) The following issues have been fixed in     Firefox 17 :

  - crash in copyTexImage2D with image dimensions too large     for given level. (CVE-2012-5838)

  - Security researcher Abhishek Arya (Inferno) of the     Google Chrome Security Team discovered a series     critically rated of use-after-free and buffer overflow     issues using the Address Sanitizer tool in shipped     software. These issues are potentially exploitable,     allowing for remote code execution. We would also like     to thank Abhishek for reporting five additional     use-after-free, out of bounds read, and buffer overflow     flaws introduced during Firefox development that have     been fixed before general release. (MFSA 2012-105)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    The following issues have been fixed in Firefox 17 and     ESR 10.0.11 :

  - Heap-use-after-free in nsTextEditorState::PrepareEditor.
    (CVE-2012-4214)

  - Heap-use-after-free in     nsPlaintextEditor::FireClipboardEvent. (CVE-2012-4215)

  - Heap-use-after-free in gfxFont::GetFontEntry.
    (CVE-2012-4216)

  - Heap-buffer-overflow in nsWindow::OnExposeEvent.
    (CVE-2012-5829)

  - heap-buffer-overflow in     gfxShapedWord::CompressedGlyph::IsClusterStart

  - CVE-2012-5839

  - Heap-use-after-free in nsTextEditorState::PrepareEditor     (CVE-2012-5840) The following issues have been fixed in     Firefox 17 :

  - Heap-use-after-free in XPCWrappedNative::Mark.
    (CVE-2012-4212)

  - Heap-use-after-free in nsEditor::FindNextLeafNode.
    (CVE-2012-4213)

  - Heap-use-after-free in     nsViewManager::ProcessPendingUpdates. (CVE-2012-4217)

  - Heap-use-after-free     BuildTextRunsScanner::BreakSink::SetBreaks.
    (CVE-2012-4218)

  - Security researcher Mariusz Mlynski reported that when a     maliciously crafted stylesheet is inspected in the Style     Inspector, HTML and CSS can run in a chrome privileged     context without being properly sanitized first. This can     lead to arbitrary code execution. (MFSA 2012-104 /     CVE-2012-4210)

  - Security researcher Mariusz Mlynski reported that the     location property can be accessed by binary plugins     through top.location with a frame whose name attribute's     value is set to 'top'. This can allow for possible     cross-site scripting (XSS) attacks through plugins.
    (MFSA 2012-103 / CVE-2012-4209)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Security researcher Masato Kinugawa reported that when     script is entered into the Developer Toolbar, it runs in     a chrome privileged context. This allows for arbitrary     code execution or cross-site scripting (XSS) if a user     can be convinced to paste malicious code into the     Developer Toolbar. (MFSA 2012-102 / CVE-2012-5837)

  - Security researcher Masato Kinugawa found when     HZ-GB-2312 charset encoding is used for text, the '~'     character will destroy another character near the chunk     delimiter. This can lead to a cross-site scripting (XSS)     attack in pages encoded in HZ-GB-2312. (MFSA 2012-101 /     CVE-2012-4207)

  - Mozilla developer Bobby Holley reported that security     wrappers filter at the time of property access, but once     a function is returned, the caller can use this function     without further security checks. This affects     cross-origin wrappers, allowing for write actions on     objects when only read actions should be properly     allowed. This can lead to cross-site scripting (XSS)     attacks. (MFSA 2012-100 / CVE-2012-5841)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Mozilla developer Peter Van der Beken discovered that     same-origin XrayWrappers expose chrome-only properties     even when not in a chrome compartment. This can allow     web content to get properties of DOM objects that are     intended to be chrome-only. (MFSA 2012-99 /     CVE-2012-4208)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Security researcher Robert Kugler reported that when a     specifically named DLL file on a Windows computer is     placed in the default downloads directory with the     Firefox installer, the Firefox installer will load this     DLL when it is launched. In circumstances where the     installer is run by an administrator privileged account,     this allows for the downloaded DLL file to be run with     administrator privileges. This can lead to arbitrary     code execution from a privileged account. (MFSA 2012-98     / CVE-2012-4206)

  - Mozilla developer Gabor Krizsanits discovered that     XMLHttpRequest objects created within sandboxes have the     system principal instead of the sandbox principal. This     can lead to cross-site request forgery (CSRF) or     information theft via an add-on running untrusted code     in a sandbox. (MFSA 2012-97 / CVE-2012-4205)

  - Security researcher Scott Bell of     Security-Assessment.com used the Address Sanitizer tool     to discover a memory corruption in str_unescape in the     JavaScript engine. This could potentially lead to     arbitrary code execution. (MFSA 2012-96 / CVE-2012-4204)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Security researcher kakzz.ng@gmail.com reported that if     a javascript: URL is selected from the list of Firefox     'new tab' page, the script will inherit the privileges     of the privileged 'new tab' page. This allows for the     execution of locally installed programs if a user can be     convinced to save a bookmark of a malicious javascript:
    URL. (MFSA 2012-95 / CVE-2012-4203)

  - Security researcher Jonathan Stephens discovered that     combining SVG text on a path with the setting of CSS     properties could lead to a potentially exploitable     crash. (MFSA 2012-94 / CVE-2012-5836)

  - Mozilla security researcher moz_bug_r_a4 reported that     if code executed by the evalInSandbox function sets     location.href, it can get the wrong subject principal     for the URL check, ignoring the sandbox's JavaScript     context and gaining the context of evalInSandbox object.
    This can lead to malicious web content being able to     perform a cross-site scripting (XSS) attack or stealing     a copy of a local file if the user has installed an     add-on vulnerable to this attack. (MFSA 2012-93 /     CVE-2012-4201)

  - Security researcher Atte Kettunen from OUSPG used the     Address Sanitizer tool to discover a buffer overflow     while rendering GIF format images. This issue is     potentially exploitable and could lead to arbitrary code     execution. (MFSA 2012-92 / CVE-2012-4202)

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-91)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary,     Kyle Huey, Ed Morley, Chris Lord, Boris Zbarsky, Julian     Seward, and Bill McCloskey reported memory safety     problems and crashes that affect Firefox 16.
    (CVE-2012-5843)

    Jesse Ruderman, Andrew McCreight, Bob Clary, and Kyle     Huey reported memory safety problems and crashes that     affect Firefox ESR 10 and Firefox 16. (CVE-2012-5842)

USN-1638-1 fixed vulnerabilities in Firefox. The new packages introduced regressions in cookies handling and the User Agent string.
This update fixes the problem.

Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary, Kyle Huey, Ed Morley, Chris Lord, Boris Zbarsky, Julian Seward, Bill McCloskey, and Andrew McCreight discovered multiple memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-5842, CVE-2012-5843)

Atte Kettunen discovered a buffer overflow while rendering GIF format images. An attacker could exploit this to possibly execute arbitrary code as the user invoking Firefox. (CVE-2012-4202)

It was discovered that the evalInSandbox function's JavaScript sandbox context could be circumvented. An attacker could exploit this to perform a cross-site scripting (XSS) attack or steal a copy of a local file if the user has installed an add-on vulnerable to this attack.
With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-4201)

Jonathan Stephens discovered that combining vectors involving the setting of Cascading Style Sheets (CSS) properties in conjunction with SVG text could cause Firefox to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service via application crash or execute arbitrary code with the privliges of the user invoking the program. (CVE-2012-5836)

It was discovered that if a javascript: URL is selected from the list of Firefox 'new tab' page, the script will inherit the privileges of the privileged 'new tab' page. This allows for the execution of locally installed programs if a user can be convinced to save a bookmark of a malicious javascript: URL. (CVE-2012-4203)

Scott Bell discovered a memory corruption issue in the JavaScript engine. If a user were tricked into opening a malicious website, an attacker could exploit this to execute arbitrary JavaScript code within the context of another website or arbitrary code as the user invoking the program.
(CVE-2012-4204)

Gabor Krizsanits discovered that XMLHttpRequest objects created within sandboxes have the system principal instead of the sandbox principal. This can lead to cross-site request forgery (CSRF) or information theft via an add-on running untrusted code in a sandbox. (CVE-2012-4205)

Peter Van der Beken discovered XrayWrapper implementation in Firefox does not consider the compartment during property filtering. An attacker could use this to bypass intended chrome-only restrictions on reading DOM object properties via a crafted website. (CVE-2012-4208)

Bobby Holley discovered that cross-origin wrappers were allowing write actions on objects when only read actions should have been properly allowed. This can lead to cross-site scripting (XSS) attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-5841)

Masato Kinugawa discovered that when HZ-GB-2312 charset encoding is used for text, the '~' character will destroy another character near the chunk delimiter. This can lead to a cross-site scripting (XSS) attack in pages encoded in HZ-GB-2312. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
(CVE-2012-4207)

Masato Kinugawa discovered that scripts entered into the Developer Toolbar could run in a chrome privileged context.
An attacker could use this vulnerability to conduct cross-site scripting (XSS) attacks or execute arbitrary code as the user invoking Firefox. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-5837)

Mariusz Mlynski discovered that the location property can be accessed by binary plugins through top.location with a frame whose name attribute's value is set to 'top'. This can allow for possible cross-site scripting (XSS) attacks through plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
(CVE-2012-4209)

Mariusz Mlynski discovered that when a maliciously crafted stylesheet is inspected in the Style Inspector, HTML and CSS can run in a chrome privileged context without being properly sanitized first. If a user were tricked into opening a malicious web page, an attacker could execute arbitrary code with the privliges of the user invoking the program. (CVE-2012-4210)

Abhishek Arya discovered multiple use-after-free and buffer overflow issues in Firefox. If a user were tricked into opening a malicious page, an attacker could exploit these to execute arbitrary code as the user invoking the program.
(CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829, CVE-2012-5839, CVE-2012-5840, CVE-2012-4212, CVE-2012-4213, CVE-2012-4217, CVE-2012-4218)

Several memory corruption flaws were discovered in Firefox.
If a user were tricked into opening a malicious page, an attacker could exploit these to execute arbitrary code as the user invoking the program. (CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5838).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Firefox 16.x are potentially affected by the following security issues :

  - Several memory safety bugs exist in the browser engine used in Mozilla-based products that could be exploited to execute arbitrary code. (CVE-2012-5842, CVE-2012-5843)

  - An error exists in the method 'image::RasterImage::DrawFrameTo' related to GIF images that could allow a heap-based buffer overflow, leading to arbitrary code execution. (CVE-2012-4202)

  - An error exists related to SVG text and CSS properties that could lead to application crashes. (CVE-2012-5836)

  - A bookmarked, malicious 'javascript:' URL could allow execution of local executables. (CVE-2012-4203)

  - The JavaScript function 'str_unescape' could allow arbitrary code execution. (CVE-2012-4204)

  - 'XMLHttpRequest' objects inherit incorrect principals when created in sandboxes that could allow cross-site request forgery attacks (XSRF). (CVE-2012-4205)

  - An error exists related to the application installer and DLL loading. (CVE-2012-4206)

   - 'XrayWrappers' can expose DOM properties that are not meant to be accessible outside of the chrome compartment. (CVE-2012-4208)

  - Errors exist related to 'evalInSandbox', 'HZ-GB-2312' charset, frames and the 'location' object, the 'Style Inspector', 'Developer Toolbar' and 'cross-origin wrappers' that could allow cross-site scripting (XSS) attacks. (CVE-2012-4201, CVE-2012-4207, CVE-2012-4209, CVE-2012-4210, CVE-2012-5837, CVE-2012-5841)

  - Various use-after-free, out-of-bounds read and buffer overflow errors exist that could potentially lead to arbitrary code execution. (CVE-2012-4212, CVE-2012-4213, CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-4217, CVE-2012-4218, CVE-2012-5829, CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5838, CVE-2012-5839, CVE-2012-5840)

Versions of Firefox prior to 17.0 are potentially affected by the following security issues :

 - Several memory safety bugs exist in the browser engine used in Mozilla-based products that could be exploited to execute arbitrary code. (CVE-2012-5842, CVE-2012-5843)
 - An error exists in the method 'image::RasterImage::DrawFrameTo' related to GIF images that could allow a heap-based buffer overflow, leading to arbitrary code execution. (CVE-2012-4202)
 - An error exists related to SVG text and CSS properties that could lead to application crashes. (CVE-2012-5836)
 - A bookmarked, malicious 'javascript:' URL could allow execution of local executables. (CVE-2012-4203)
 - The JavaScript function 'str_unescape' could allow arbitrary code execution. (CVE-2012-4204)
 - 'XMLHttpRequest' objects inherit incorrect principals when created in sandboxes that could allow cross-site request forgery attacks (XSRF). (CVE-2012-4205)
 - An error exists related to the application installer and DLL loading. (CVE-2012-4206)
  - 'XrayWrappers' can expose DOM properties that are not meant to be accessible outside of the chrome compartment. (CVE-2012-4208)
 - Errors exist related to 'evalInSandbox', 'HZ-GB-2312' charset, frames and the 'location' object, the 'Style Inspector', 'Developer Toolbar' and 'cross-origin wrappers' that could allow cross-site scripting (XSS) attacks. (CVE-2012-4201, CVE-2012-4207, CVE-2012-4209, CVE-2012-4210, CVE-2012-5837, CVE-2012-5841)
 - Various use-after-free, out-of-bounds read and buffer overflow errors exist that could potentially lead to arbitrary code execution. (CVE-2012-4212, CVE-2012-4213, CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-4217, CVE-2012-4218, CVE-2012-5829, CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5838, CVE-2012-5839, CVE-2012-5840)

Mozilla Firefox has been updated to the 10.0.11 ESR security release, which fixes various bugs and security issues.

  - Security researcher miaubiz used the Address Sanitizer     tool to discover a series critically rated of     use-after-free, buffer overflow, and memory corruption     issues in shipped software. These issues are potentially     exploitable, allowing for remote code execution. We     would also like to thank miaubiz for reporting two     additional use-after-free and memory corruption issues     introduced during Firefox development that have been     fixed before general release. (MFSA 2012-106)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    The following issues have been fixed in Firefox 17 and     ESR 10.0.11 :

o use-after-free when loading html file on osx (CVE-2012-5830) o Mesa crashes on certain texImage2D calls involving level>0 (CVE-2012-5833) o integer overflow, invalid write w/webgl bufferdata. (CVE-2012-5835)

The following issues have been fixed in Firefox 17 :

o crash in copyTexImage2D with image dimensions too large for given level. (CVE-2012-5838)

  - Security researcher Abhishek Arya (Inferno) of the     Google Chrome Security Team discovered a series     critically rated of use-after-free and buffer overflow     issues using the Address Sanitizer tool in shipped     software. These issues are potentially exploitable,     allowing for remote code execution. We would also like     to thank Abhishek for reporting five additional     use-after-free, out of bounds read, and buffer overflow     flaws introduced during Firefox development that have     been fixed before general release. (MFSA 2012-105)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    The following issues have been fixed in Firefox 17 and     ESR 10.0.11 :

o Heap-use-after-free in nsTextEditorState::PrepareEditor (CVE-2012-4214) o Heap-use-after-free in nsPlaintextEditor::FireClipboardEvent (CVE-2012-4215) o Heap-use-after-free in gfxFont::GetFontEntry (CVE-2012-4216) o Heap-buffer-overflow in nsWindow::OnExposeEvent (CVE-2012-5829) o heap-buffer-overflow in gfxShapedWord::CompressedGlyph::IsClusterStart o CVE-2012-5839 o Heap-use-after-free in nsTextEditorState::PrepareEditor. (CVE-2012-5840)

The following issues have been fixed in Firefox 17 :

o Heap-use-after-free in XPCWrappedNative::Mark (CVE-2012-4212) o Heap-use-after-free in nsEditor::FindNextLeafNode (CVE-2012-4213) o Heap-use-after-free in nsViewManager::ProcessPendingUpdates (CVE-2012-4217) o Heap-use-after-free BuildTextRunsScanner::BreakSink::SetBreaks. (CVE-2012-4218)

  - Security researcher Mariusz Mlynski reported that when a     maliciously crafted stylesheet is inspected in the Style     Inspector, HTML and CSS can run in a chrome privileged     context without being properly sanitized first. This can     lead to arbitrary code execution. (MFSA 2012-104 /     CVE-2012-4210)

  - Security researcher Mariusz Mlynski reported that the     location property can be accessed by binary plugins     through top.location with a frame whose name attribute's     value is set to 'top'. This can allow for possible     cross-site scripting (XSS) attacks through plugins.
    (MFSA 2012-103 / CVE-2012-4209)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Security researcher Masato Kinugawa reported that when     script is entered into the Developer Toolbar, it runs in     a chrome privileged context. This allows for arbitrary     code execution or cross-site scripting (XSS) if a user     can be convinced to paste malicious code into the     Developer Toolbar. (MFSA 2012-102 / CVE-2012-5837)

  - Security researcher Masato Kinugawa found when     HZ-GB-2312 charset encoding is used for text, the '~'     character will destroy another character near the chunk     delimiter. This can lead to a cross-site scripting (XSS)     attack in pages encoded in HZ-GB-2312. (MFSA 2012-101 /     CVE-2012-4207)

  - Mozilla developer Bobby Holley reported that security     wrappers filter at the time of property access, but once     a function is returned, the caller can use this function     without further security checks. This affects     cross-origin wrappers, allowing for write actions on     objects when only read actions should be properly     allowed. This can lead to cross-site scripting (XSS)     attacks. (MFSA 2012-100 / CVE-2012-5841)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Mozilla developer Peter Van der Beken discovered that     same-origin XrayWrappers expose chrome-only properties     even when not in a chrome compartment. This can allow     web content to get properties of DOM objects that are     intended to be chrome-only. (MFSA 2012-99 /     CVE-2012-4208)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Security researcher Robert Kugler reported that when a     specifically named DLL file on a Windows computer is     placed in the default downloads directory with the     Firefox installer, the Firefox installer will load this     DLL when it is launched. In circumstances where the     installer is run by an administrator privileged account,     this allows for the downloaded DLL file to be run with     administrator privileges. This can lead to arbitrary     code execution from a privileged account. (MFSA 2012-98     / CVE-2012-4206)

  - Mozilla developer Gabor Krizsanits discovered that     XMLHttpRequest objects created within sandboxes have the     system principal instead of the sandbox principal. This     can lead to cross-site request forgery (CSRF) or     information theft via an add-on running untrusted code     in a sandbox. (MFSA 2012-97 / CVE-2012-4205)

  - Security researcher Scott Bell of     Security-Assessment.com used the Address Sanitizer tool     to discover a memory corruption in str_unescape in the     JavaScript engine. This could potentially lead to     arbitrary code execution. (MFSA 2012-96 / CVE-2012-4204)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Security researcher kakzz.ng@gmail.com reported that if     a javascript: URL is selected from the list of Firefox     'new tab' page, the script will inherit the privileges     of the privileged 'new tab' page. This allows for the     execution of locally installed programs if a user can be     convinced to save a bookmark of a malicious javascript:
    URL. (MFSA 2012-95 / CVE-2012-4203)

  - Security researcher Jonathan Stephens discovered that     combining SVG text on a path with the setting of CSS     properties could lead to a potentially exploitable     crash. (MFSA 2012-94 / CVE-2012-5836)

  - Mozilla security researcher moz_bug_r_a4 reported that     if code executed by the evalInSandbox function sets     location.href, it can get the wrong subject principal     for the URL check, ignoring the sandbox's JavaScript     context and gaining the context of evalInSandbox object.
    This can lead to malicious web content being able to     perform a cross-site scripting (XSS) attack or stealing     a copy of a local file if the user has installed an     add-on vulnerable to this attack. (MFSA 2012-93 /     CVE-2012-4201)

  - Security researcher Atte Kettunen from OUSPG used the     Address Sanitizer tool to discover a buffer overflow     while rendering GIF format images. This issue is     potentially exploitable and could lead to arbitrary code     execution. (MFSA 2012-92 / CVE-2012-4202)

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-91)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary,     Kyle Huey, Ed Morley, Chris Lord, Boris Zbarsky, Julian     Seward, and Bill McCloskey reported memory safety     problems and crashes that affect Firefox 16.
    (CVE-2012-5843)

    Jesse Ruderman, Andrew McCreight, Bob Clary, and Kyle     Huey reported memory safety problems and crashes that     affect Firefox ESR 10 and Firefox 16. (CVE-2012-5842)

USN-1638-1 fixed vulnerabilities in Firefox. This update provides an updated ubufox package for use with the latest Firefox.

Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary, Kyle Huey, Ed Morley, Chris Lord, Boris Zbarsky, Julian Seward, Bill McCloskey, and Andrew McCreight discovered multiple memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-5842, CVE-2012-5843)

Atte Kettunen discovered a buffer overflow while rendering GIF format images. An attacker could exploit this to possibly execute arbitrary code as the user invoking Firefox. (CVE-2012-4202)

It was discovered that the evalInSandbox function's JavaScript sandbox context could be circumvented. An attacker could exploit this to perform a cross-site scripting (XSS) attack or steal a copy of a local file if the user has installed an add-on vulnerable to this attack.
With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-4201)

Jonathan Stephens discovered that combining vectors involving the setting of Cascading Style Sheets (CSS) properties in conjunction with SVG text could cause Firefox to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service via application crash or execute arbitrary code with the privliges of the user invoking the program. (CVE-2012-5836)

It was discovered that if a javascript: URL is selected from the list of Firefox 'new tab' page, the script will inherit the privileges of the privileged 'new tab' page. This allows for the execution of locally installed programs if a user can be convinced to save a bookmark of a malicious javascript: URL. (CVE-2012-4203)

Scott Bell discovered a memory corruption issue in the JavaScript engine. If a user were tricked into opening a malicious website, an attacker could exploit this to execute arbitrary JavaScript code within the context of another website or arbitrary code as the user invoking the program.
(CVE-2012-4204)

Gabor Krizsanits discovered that XMLHttpRequest objects created within sandboxes have the system principal instead of the sandbox principal. This can lead to cross-site request forgery (CSRF) or information theft via an add-on running untrusted code in a sandbox. (CVE-2012-4205)

Peter Van der Beken discovered XrayWrapper implementation in Firefox does not consider the compartment during property filtering. An attacker could use this to bypass intended chrome-only restrictions on reading DOM object properties via a crafted website. (CVE-2012-4208)

Bobby Holley discovered that cross-origin wrappers were allowing write actions on objects when only read actions should have been properly allowed. This can lead to cross-site scripting (XSS) attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-5841)

Masato Kinugawa discovered that when HZ-GB-2312 charset encoding is used for text, the '~' character will destroy another character near the chunk delimiter. This can lead to a cross-site scripting (XSS) attack in pages encoded in HZ-GB-2312. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit these to modify the contents, or steal confidential data, within the same domain.
(CVE-2012-4207)

Mariusz Mlynski discovered that the location property can be accessed by binary plugins through top.location with a frame whose name attribute's value is set to 'top'. This can allow for possible cross-site scripting (XSS) attacks through plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
(CVE-2012-4209)

Mariusz Mlynski discovered that when a maliciously crafted stylesheet is inspected in the Style Inspector, HTML and CSS can run in a chrome privileged context without being properly sanitized first. If a user were tricked into opening a malicious web page, an attacker could execute arbitrary code with the privliges of the user invoking the program. (CVE-2012-4210)

Abhishek Arya discovered multiple use-after-free and buffer overflow issues in Firefox. If a user were tricked into opening a malicious page, an attacker could exploit these to execute arbitrary code as the user invoking the program.
(CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829, CVE-2012-5839, CVE-2012-5840, CVE-2012-4212, CVE-2012-4213, CVE-2012-4217, CVE-2012-4218)

Several memory corruption flaws were discovered in Firefox.
If a user were tricked into opening a malicious page, an attacker could exploit these to execute arbitrary code as the user invoking the program. (CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5838).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary, Kyle Huey, Ed Morley, Chris Lord, Boris Zbarsky, Julian Seward, Bill McCloskey, and Andrew McCreight discovered multiple memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-5842, CVE-2012-5843)

Atte Kettunen discovered a buffer overflow while rendering GIF format images. An attacker could exploit this to possibly execute arbitrary code as the user invoking Firefox. (CVE-2012-4202)

It was discovered that the evalInSandbox function's JavaScript sandbox context could be circumvented. An attacker could exploit this to perform a cross-site scripting (XSS) attack or steal a copy of a local file if the user has installed an add-on vulnerable to this attack.
With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-4201)

Jonathan Stephens discovered that combining vectors involving the setting of Cascading Style Sheets (CSS) properties in conjunction with SVG text could cause Firefox to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service via application crash or execute arbitrary code with the privliges of the user invoking the program. (CVE-2012-5836)

It was discovered that if a javascript: URL is selected from the list of Firefox 'new tab' page, the script will inherit the privileges of the privileged 'new tab' page. This allows for the execution of locally installed programs if a user can be convinced to save a bookmark of a malicious javascript: URL. (CVE-2012-4203)

Scott Bell discovered a memory corruption issue in the JavaScript engine. If a user were tricked into opening a malicious website, an attacker could exploit this to execute arbitrary JavaScript code within the context of another website or arbitrary code as the user invoking the program. (CVE-2012-4204)

Gabor Krizsanits discovered that XMLHttpRequest objects created within sandboxes have the system principal instead of the sandbox principal.
This can lead to cross-site request forgery (CSRF) or information theft via an add-on running untrusted code in a sandbox.
(CVE-2012-4205)

Peter Van der Beken discovered XrayWrapper implementation in Firefox does not consider the compartment during property filtering. An attacker could use this to bypass intended chrome-only restrictions on reading DOM object properties via a crafted website. (CVE-2012-4208)

Bobby Holley discovered that cross-origin wrappers were allowing write actions on objects when only read actions should have been properly allowed. This can lead to cross-site scripting (XSS) attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-5841)

Masato Kinugawa discovered that when HZ-GB-2312 charset encoding is used for text, the '~' character will destroy another character near the chunk delimiter. This can lead to a cross-site scripting (XSS) attack in pages encoded in HZ-GB-2312. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
(CVE-2012-4207)

Masato Kinugawa discovered that scripts entered into the Developer Toolbar could run in a chrome privileged context. An attacker could use this vulnerability to conduct cross-site scripting (XSS) attacks or execute arbitrary code as the user invoking Firefox. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-5837)

Mariusz Mlynski discovered that the location property can be accessed by binary plugins through top.location with a frame whose name attribute's value is set to 'top'. This can allow for possible cross-site scripting (XSS) attacks through plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
(CVE-2012-4209)

Mariusz Mlynski discovered that when a maliciously crafted stylesheet is inspected in the Style Inspector, HTML and CSS can run in a chrome privileged context without being properly sanitized first. If a user were tricked into opening a malicious web page, an attacker could execute arbitrary code with the privliges of the user invoking the program. (CVE-2012-4210)

Abhishek Arya discovered multiple use-after-free and buffer overflow issues in Firefox. If a user were tricked into opening a malicious page, an attacker could exploit these to execute arbitrary code as the user invoking the program. (CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829, CVE-2012-5839, CVE-2012-5840, CVE-2012-4212, CVE-2012-4213, CVE-2012-4217, CVE-2012-4218)

Several memory corruption flaws were discovered in Firefox. If a user were tricked into opening a malicious page, an attacker could exploit these to execute arbitrary code as the user invoking the program.
(CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5838).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Firefox is earlier than 17.0 and thus, is potentially affected by the following security issues :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-5842,     CVE-2012-5843)

  - An error exists in the method     'image::RasterImage::DrawFrameTo' related to GIF images     that could allow a heap-based buffer overflow, leading to     arbitrary code execution. (CVE-2012-4202)

  - An error exists related to SVG text and CSS properties     that could lead to application crashes. (CVE-2012-5836)

  - A bookmarked, malicious 'javascript:' URL could allow     execution of local executables. (CVE-2012-4203)

  - The JavaScript function 'str_unescape' could allow     arbitrary code execution. (CVE-2012-4204)

  - 'XMLHttpRequest' objects inherit incorrect principals     when created in sandboxes that could allow cross-site     request forgery attacks (CSRF). (CVE-2012-4205)

  - An error exists related to the application installer     and DLL loading. (CVE-2012-4206)

  - 'XrayWrappers' can expose DOM properties that are     not meant to be accessible outside of the chrome     compartment. (CVE-2012-4208)

  - Errors exist related to 'evalInSandbox', 'HZ-GB-2312'     charset, frames and the 'location' object, the 'Style     Inspector', 'Developer Toolbar' and 'cross-origin     wrappers' that could allow cross-site scripting (XSS)     attacks. (CVE-2012-4201, CVE-2012-4207, CVE-2012-4209,     CVE-2012-4210, CVE-2012-5837, CVE-2012-5841)

  - Various use-after-free, out-of-bounds read and buffer     overflow errors exist that could potentially lead to     arbitrary code execution. (CVE-2012-4212, CVE-2012-4213,     CVE-2012-4214, CVE-2012-4215, CVE-2012-4216,     CVE-2012-4217, CVE-2012-4218, CVE-2012-5829,     CVE-2012-5830, CVE-2012-5833, CVE-2012-5835,     CVE-2012-5838, CVE-2012-5839, CVE-2012-5840)

The installed version of Firefox is earlier than 17.0 and thus, is potentially affected by the following security issues :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-5842,     CVE-2012-5843)

  - An error exists in the method     'image::RasterImage::DrawFrameTo' related to GIF images     that could allow a heap-based buffer overflow, leading to     arbitrary code execution. (CVE-2012-4202)

  - An error exists related to SVG text and CSS properties     that could lead to application crashes. (CVE-2012-5836)

  - A bookmarked, malicious 'javascript:' URL could allow     execution of local executables. (CVE-2012-4203)

  - The JavaScript function 'str_unescape' could allow     arbitrary code execution. (CVE-2012-4204)

  - 'XMLHttpRequest' objects inherit incorrect principals     when created in sandboxes that could allow cross-site     request forgery attacks (CSRF). (CVE-2012-4205)

  - 'XrayWrappers' can expose DOM properties that are     not meant to be accessible outside of the chrome     compartment. (CVE-2012-4208)

  - Errors exist related to 'evalInSandbox', 'HZ-GB-2312'     charset, frames and the 'location' object, the 'Style     Inspector', 'Developer Toolbar' and  'cross-origin     wrappers' that can allow cross-site scripting (XSS)     attacks. (CVE-2012-4201, CVE-2012-4207, CVE-2012-4209,     CVE-2012-4210, CVE-2012-5837, CVE-2012-5841)

  - Various use-after-free, out-of-bounds read and buffer     overflow errors exist that could potentially lead to     arbitrary code execution. (CVE-2012-4212, CVE-2012-4213,     CVE-2012-4214, CVE-2012-4215, CVE-2012-4216,     CVE-2012-4217, CVE-2012-4218, CVE-2012-5829,     CVE-2012-5830, CVE-2012-5833, CVE-2012-5835,     CVE-2012-5838, CVE-2012-5839, CVE-2012-5840)

The Mozilla Project reports :

MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/ rv:10.0.11)

MFSA 2012-92 Buffer overflow while rendering GIF images

MFSA 2012-93 evalInSanbox location context incorrectly applied

MFSA 2012-94 Crash when combining SVG text on path with CSS

MFSA 2012-95 Javascript: URLs run in privileged context on New Tab page

MFSA 2012-96 Memory corruption in str_unescape

MFSA 2012-97 XMLHttpRequest inherits incorrect principal within sandbox

MFSA 2012-98 Firefox installer DLL hijacking

MFSA 2012-99 XrayWrappers exposes chrome-only properties when not in chrome compartment

MFSA 2012-100 Improper security filtering for cross-origin wrappers

MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset

MFSA 2012-102 Script entered into Developer Toolbar runs with chrome privileges

MFSA 2012-103 Frames can shadow top.location

MFSA 2012-104 CSS and HTML injection through Style Inspector

MFSA 2012-105 Use-after-free and buffer overflow issues found

MFSA 2012-106 Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer

ID	Name	Product	Family	Severity
74826	openSUSE Security Update : xulrunner (openSUSE-SU-2012:1586-1)	Nessus	SuSE Local Security Checks	critical
74824	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1583-1)	Nessus	SuSE Local Security Checks	critical
64135	SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 7093)	Nessus	SuSE Local Security Checks	critical
63145	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : firefox regressions (USN-1638-3)	Nessus	Ubuntu Local Security Checks	critical
801327	Mozilla Firefox 16.x <= 16 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6625	Mozilla Firefox < 17.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
63091	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8381)	Nessus	SuSE Local Security Checks	critical
63026	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : ubufox update (USN-1638-2)	Nessus	Ubuntu Local Security Checks	critical
63025	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : firefox vulnerabilities (USN-1638-1)	Nessus	Ubuntu Local Security Checks	critical
62998	Firefox < 17.0 Multiple Vulnerabilities	Nessus	Windows	critical
62994	Firefox < 17.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
62979	FreeBSD : mozilla -- multiple vulnerabilities (d23119df-335d-11e2-b64c-c8600054b392)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-4203

high

Tenable Plugins

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

high