The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read of heap memory) via a crafted Cascading Style Sheets (CSS) token sequence that triggers a restyle or reflow operation.

Versions of Mozilla Firefox ESR prior to 31.5 are unpatched for the following vulnerabilities : 

 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)


NOTE : The following vulnerabilities exist only within the stable release, and do not affect any Firefox ESR releases :

 - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832)
 - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830)
 - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in plaintext connections. (CVE-2015-0834)
 - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829)
 - A double-free issue exists when sending a zero-length 'XmlHttpRequest' (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828)
 - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825)
 - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826)
 - An issue exists in the 'DrawTarget()' function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824)
 - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823)
 - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821)

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

SeaMonkey was updated to 2.33 (bnc#917597)

  - MFSA 2015-11/CVE-2015-0835/CVE-2015-0836 Miscellaneous     memory safety hazards

  - MFSA 2015-12/CVE-2015-0833 (bmo#945192) Invoking Mozilla     updater will load locally stored DLL files (Windows     only)

  - MFSA 2015-13/CVE-2015-0832 (bmo#1065909) Appended period     to hostnames can bypass HPKP and HSTS protections

  - MFSA 2015-14/CVE-2015-0830 (bmo#1110488) Malicious WebGL     content crash when writing strings

  - MFSA 2015-15/CVE-2015-0834 (bmo#1098314) TLS TURN and     STUN connections silently fail to simple TCP connections

  - MFSA 2015-16/CVE-2015-0831 (bmo#1130514) Use-after-free     in IndexedDB

  - MFSA 2015-17/CVE-2015-0829 (bmo#1128939) Buffer overflow     in libstagefright during MP4 video playback

  - MFSA 2015-18/CVE-2015-0828 (bmo#1030667, bmo#988675)     Double-free when using non-default memory allocators     with a zero-length XHR

  - MFSA 2015-19/CVE-2015-0827 (bmo#1117304) Out-of-bounds     read and write while rendering SVG content

  - MFSA 2015-20/CVE-2015-0826 (bmo#1092363) Buffer overflow     during CSS restyling

  - MFSA 2015-21/CVE-2015-0825 (bmo#1092370) Buffer     underflow during MP3 playback

  - MFSA 2015-22/CVE-2015-0824 (bmo#1095925) Crash using     DrawTarget in Cairo graphics library

  - MFSA 2015-23/CVE-2015-0823 (bmo#1098497) Use-after-free     in Developer Console date with OpenType Sanitiser

  - MFSA 2015-24/CVE-2015-0822 (bmo#1110557) Reading of     local files through manipulation of form autocomplete

  - MFSA 2015-25/CVE-2015-0821 (bmo#1111960) Local files or     privileged URLs in pages can be opened into new tabs

  - MFSA 2015-26/CVE-2015-0819 (bmo#1079554) UI Tour     whitelisted sites in background tab can spoof foreground     tabs

  - MFSA 2015-27CVE-2015-0820 (bmo#1125398) Caja Compiler     JavaScript sandbox bypass

Update to SeaMonkey 2.32.1

  - fixed MailNews feeds not updating

  - fixed selected profile in Profile Manager not remembered

  - fixed opening a bookmark folder in tabs on Linux

  - fixed Troubleshooting Information (about:support) with     the Modern theme

Versions of Mozilla Firefox earlier than 36.0 are unpatched for the following vulnerabilities : 

 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)


NOTE : The following vulnerabilities exist only within the stable release, and do not affect any Firefox ESR releases :

 - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832)
 - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830)
 - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in plaintext connections. (CVE-2015-0834)
 - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829)
 - A double-free issue exists when sending a zero-length 'XmlHttpRequest' (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828)
 - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825)
 - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826)
 - An issue exists in the 'DrawTarget()' function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824)
 - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823)
 - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821)

MozillaFirefox, mozilla-nss were updated to fix 18 security issues.

MozillaFirefox was updated to version 36.0. These security issues were fixed :

  - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory     safety hazards

  - CVE-2015-0832: Appended period to hostnames can bypass     HPKP and HSTS protections

  - CVE-2015-0830: Malicious WebGL content crash when     writing strings

  - CVE-2015-0834: TLS TURN and STUN connections silently     fail to simple TCP connections

  - CVE-2015-0831: Use-after-free in IndexedDB

  - CVE-2015-0829: Buffer overflow in libstagefright during     MP4 video playback

  - CVE-2015-0828: Double-free when using non-default memory     allocators with a zero-length XHR

  - CVE-2015-0827: Out-of-bounds read and write while     rendering SVG content

  - CVE-2015-0826: Buffer overflow during CSS restyling

  - CVE-2015-0825: Buffer underflow during MP3 playback

  - CVE-2015-0824: Crash using DrawTarget in Cairo graphics     library

  - CVE-2015-0823: Use-after-free in Developer Console date     with OpenType Sanitiser

  - CVE-2015-0822: Reading of local files through     manipulation of form autocomplete

  - CVE-2015-0821: Local files or privileged URLs in pages     can be opened into new tabs

  - CVE-2015-0819: UI Tour whitelisted sites in background     tab can spoof foreground tabs

  - CVE-2015-0820: Caja Compiler JavaScript sandbox bypass

mozilla-nss was updated to version 3.17.4 to fix the following issues :

  - CVE-2014-1569: QuickDER decoder length issue     (bnc#910647).

  - bmo#1084986: If an SSL/TLS connection fails, because     client and server don't have any common protocol version     enabled, NSS has been changed to report error code     SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting     SSL_ERROR_NO_CYPHER_OVERLAP).

  - bmo#1112461: libpkix was fixed to prefer the newest     certificate, if multiple certificates match.

  - bmo#1094492: fixed a memory corruption issue during     failure of keypair generation.

  - bmo#1113632: fixed a failure to reload a PKCS#11 module     in FIPS mode.

  - bmo#1119983: fixed interoperability of NSS server code     with a LibreSSL client.

The Mozilla Project reports :

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)

MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files

MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections

MFSA-2015-14 Malicious WebGL content crash when writing strings

MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections

MFSA-2015-16 Use-after-free in IndexedDB

MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback

MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR

MFSA-2015-19 Out-of-bounds read and write while rendering SVG content

MFSA-2015-20 Buffer overflow during CSS restyling

MFSA-2015-21 Buffer underflow during MP3 playback

MFSA-2015-22 Crash using DrawTarget in Cairo graphics library

MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser

MFSA-2015-24 Reading of local files through manipulation of form autocomplete

MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs

MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2505-1 advisory.

    Matthew Noorenberghe discovered that Mozilla domains in the allowlist could make UITour API calls from     background tabs. If one of these domains were compromised and open in a background tab, an attacker could

    potentially exploit this to conduct clickjacking attacks. (CVE-2015-0819)

    Jan de Mooij discovered an issue that affects content using the Caja Compiler. If web content loads     specially crafted code, this could be used to bypass sandboxing security measures provided by Caja.
    (CVE-2015-0820)

    Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a     Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to bypass security     restrictions. (CVE-2015-0821)

    Armin Razmdjou discovered that contents of locally readable files could be made available via manipulation     of form autocomplete in some circumstances. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0822)

    Atte Kettunen discovered a use-after-free in the OpenType Sanitiser (OTS) in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash. (CVE-2015-0823)

    Atte Kettunen discovered a crash when drawing images using Cairo in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service. (CVE-2015-0824)

    Atte Kettunen discovered a buffer underflow during playback of MP3 files in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     obtain sensitive information. (CVE-2015-0825)

    Atte Kettunen discovered a buffer overflow during CSS restyling in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-0826)

    Abhishek Arya discovered an out-of-bounds read and write when rendering SVG content in some circumstances.
    If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit     this to obtain sensitive information. (CVE-2015-0827)

    A buffer overflow was discovered in libstagefright during video playback in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-0829)

    Daniele Di Proietto discovered that WebGL could cause a crash in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service. (CVE-2015-0830)

    Paul Bandha discovered a use-after-free in IndexedDB. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0831)

    Muneaki Nishimura discovered that a period appended to a hostname could bypass key pinning and HSTS in     some circumstances. A remote attacker could potentially exloit this to conduct a Machine-in-the-middle     (MITM) attack. (CVE-2015-0832)

    Alexander Kolesnik discovered that Firefox would attempt plaintext connections to servers when handling     turns: and stuns: URIs. A remote attacker could potentially exploit this by conducting a Machine-in-the-     middle (MITM) attack in order to obtain credentials. (CVE-2015-0834)

    Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan     VanderMeulen, Christian Holler, Jesse Ruderman, Randell Jesup, Robin Whittleton, Jon Coppeard, and Nikhil     Marathe discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2015-0835, CVE-2015-0836)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. Note that hosts are only     affected if the updater is not run by the Mozilla     Maintenance Service. (CVE-2015-0833)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

The version of Firefox installed on the remote Mac OS X host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

ID	Name	Product	Family	Severity
701251	Mozilla Firefox ESR < 31.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
82013	openSUSE Security Update : seamonkey (openSUSE-2015-250)	Nessus	SuSE Local Security Checks	high
8653	Mozilla Firefox < 36.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
81589	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-185)	Nessus	SuSE Local Security Checks	high
81588	FreeBSD : mozilla -- multiple vulnerabilities (99029172-8253-407d-9d8b-2cfeab9abf81)	Nessus	FreeBSD Local Security Checks	high
81544	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2505-1)	Nessus	Ubuntu Local Security Checks	medium
81521	Firefox < 36 Multiple Vulnerabilities	Nessus	Windows	high
81518	Firefox < 36.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2015-0826

critical

Tenable Plugins

high

critical

high

high

high

high

medium

high

high