Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted JavaScript code that makes an XMLHttpRequest call with zero bytes of data.

Versions of Mozilla Firefox ESR prior to 31.5 are unpatched for the following vulnerabilities : 

 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)


NOTE : The following vulnerabilities exist only within the stable release, and do not affect any Firefox ESR releases :

 - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832)
 - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830)
 - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in plaintext connections. (CVE-2015-0834)
 - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829)
 - A double-free issue exists when sending a zero-length 'XmlHttpRequest' (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828)
 - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825)
 - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826)
 - An issue exists in the 'DrawTarget()' function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824)
 - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823)
 - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821)

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

SeaMonkey was updated to 2.33 (bnc#917597)

  - MFSA 2015-11/CVE-2015-0835/CVE-2015-0836 Miscellaneous     memory safety hazards

  - MFSA 2015-12/CVE-2015-0833 (bmo#945192) Invoking Mozilla     updater will load locally stored DLL files (Windows     only)

  - MFSA 2015-13/CVE-2015-0832 (bmo#1065909) Appended period     to hostnames can bypass HPKP and HSTS protections

  - MFSA 2015-14/CVE-2015-0830 (bmo#1110488) Malicious WebGL     content crash when writing strings

  - MFSA 2015-15/CVE-2015-0834 (bmo#1098314) TLS TURN and     STUN connections silently fail to simple TCP connections

  - MFSA 2015-16/CVE-2015-0831 (bmo#1130514) Use-after-free     in IndexedDB

  - MFSA 2015-17/CVE-2015-0829 (bmo#1128939) Buffer overflow     in libstagefright during MP4 video playback

  - MFSA 2015-18/CVE-2015-0828 (bmo#1030667, bmo#988675)     Double-free when using non-default memory allocators     with a zero-length XHR

  - MFSA 2015-19/CVE-2015-0827 (bmo#1117304) Out-of-bounds     read and write while rendering SVG content

  - MFSA 2015-20/CVE-2015-0826 (bmo#1092363) Buffer overflow     during CSS restyling

  - MFSA 2015-21/CVE-2015-0825 (bmo#1092370) Buffer     underflow during MP3 playback

  - MFSA 2015-22/CVE-2015-0824 (bmo#1095925) Crash using     DrawTarget in Cairo graphics library

  - MFSA 2015-23/CVE-2015-0823 (bmo#1098497) Use-after-free     in Developer Console date with OpenType Sanitiser

  - MFSA 2015-24/CVE-2015-0822 (bmo#1110557) Reading of     local files through manipulation of form autocomplete

  - MFSA 2015-25/CVE-2015-0821 (bmo#1111960) Local files or     privileged URLs in pages can be opened into new tabs

  - MFSA 2015-26/CVE-2015-0819 (bmo#1079554) UI Tour     whitelisted sites in background tab can spoof foreground     tabs

  - MFSA 2015-27CVE-2015-0820 (bmo#1125398) Caja Compiler     JavaScript sandbox bypass

Update to SeaMonkey 2.32.1

  - fixed MailNews feeds not updating

  - fixed selected profile in Profile Manager not remembered

  - fixed opening a bookmark folder in tabs on Linux

  - fixed Troubleshooting Information (about:support) with     the Modern theme

Versions of Mozilla Firefox earlier than 36.0 are unpatched for the following vulnerabilities : 

 - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822)
 - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827)
 - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831)
 - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833)
 - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)


NOTE : The following vulnerabilities exist only within the stable release, and do not affect any Firefox ESR releases :

 - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832)
 - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830)
 - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in plaintext connections. (CVE-2015-0834)
 - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829)
 - A double-free issue exists when sending a zero-length 'XmlHttpRequest' (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828)
 - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825)
 - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826)
 - An issue exists in the 'DrawTarget()' function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824)
 - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823)
 - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821)

MozillaFirefox, mozilla-nss were updated to fix 18 security issues.

MozillaFirefox was updated to version 36.0. These security issues were fixed :

  - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory     safety hazards

  - CVE-2015-0832: Appended period to hostnames can bypass     HPKP and HSTS protections

  - CVE-2015-0830: Malicious WebGL content crash when     writing strings

  - CVE-2015-0834: TLS TURN and STUN connections silently     fail to simple TCP connections

  - CVE-2015-0831: Use-after-free in IndexedDB

  - CVE-2015-0829: Buffer overflow in libstagefright during     MP4 video playback

  - CVE-2015-0828: Double-free when using non-default memory     allocators with a zero-length XHR

  - CVE-2015-0827: Out-of-bounds read and write while     rendering SVG content

  - CVE-2015-0826: Buffer overflow during CSS restyling

  - CVE-2015-0825: Buffer underflow during MP3 playback

  - CVE-2015-0824: Crash using DrawTarget in Cairo graphics     library

  - CVE-2015-0823: Use-after-free in Developer Console date     with OpenType Sanitiser

  - CVE-2015-0822: Reading of local files through     manipulation of form autocomplete

  - CVE-2015-0821: Local files or privileged URLs in pages     can be opened into new tabs

  - CVE-2015-0819: UI Tour whitelisted sites in background     tab can spoof foreground tabs

  - CVE-2015-0820: Caja Compiler JavaScript sandbox bypass

mozilla-nss was updated to version 3.17.4 to fix the following issues :

  - CVE-2014-1569: QuickDER decoder length issue     (bnc#910647).

  - bmo#1084986: If an SSL/TLS connection fails, because     client and server don't have any common protocol version     enabled, NSS has been changed to report error code     SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting     SSL_ERROR_NO_CYPHER_OVERLAP).

  - bmo#1112461: libpkix was fixed to prefer the newest     certificate, if multiple certificates match.

  - bmo#1094492: fixed a memory corruption issue during     failure of keypair generation.

  - bmo#1113632: fixed a failure to reload a PKCS#11 module     in FIPS mode.

  - bmo#1119983: fixed interoperability of NSS server code     with a LibreSSL client.

The Mozilla Project reports :

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)

MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files

MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections

MFSA-2015-14 Malicious WebGL content crash when writing strings

MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections

MFSA-2015-16 Use-after-free in IndexedDB

MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback

MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR

MFSA-2015-19 Out-of-bounds read and write while rendering SVG content

MFSA-2015-20 Buffer overflow during CSS restyling

MFSA-2015-21 Buffer underflow during MP3 playback

MFSA-2015-22 Crash using DrawTarget in Cairo graphics library

MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser

MFSA-2015-24 Reading of local files through manipulation of form autocomplete

MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs

MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass

The version of Firefox installed on the remote Windows host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. Note that hosts are only     affected if the updater is not run by the Mozilla     Maintenance Service. (CVE-2015-0833)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

The version of Firefox installed on the remote Mac OS X host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

ID	Name	Product	Family	Severity
701251	Mozilla Firefox ESR < 31.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
82013	openSUSE Security Update : seamonkey (openSUSE-2015-250)	Nessus	SuSE Local Security Checks	high
8653	Mozilla Firefox < 36.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
81589	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-185)	Nessus	SuSE Local Security Checks	high
81588	FreeBSD : mozilla -- multiple vulnerabilities (99029172-8253-407d-9d8b-2cfeab9abf81)	Nessus	FreeBSD Local Security Checks	high
81521	Firefox < 36 Multiple Vulnerabilities	Nessus	Windows	high
81518	Firefox < 36.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2015-0828

high

Tenable Plugins

high

critical

high

high

high

high

high

high