Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.

The remote host is affected by the vulnerability described in GLSA-201605-06 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, NSS, NSPR, and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms, or have other unspecified       impacts.
  Workaround :

    There is no known workaround at this time.

MozillaFirefox ESR was updated to version 38.4.0ESR to fix multiple security issues.

MFSA 2015-116/CVE-2015-4513 Miscellaneous memory safety hazards (rv:42.0 / rv:38.4)

MFSA 2015-122/CVE-2015-7188 Trailing whitespace in IP address hostnames can bypass same-origin policy

MFSA 2015-123/CVE-2015-7189 Buffer overflow during image interactions in canvas

MFSA 2015-127/CVE-2015-7193 CORS preflight is bypassed when non-standard Content-Type headers are received

MFSA 2015-128/CVE-2015-7194 Memory corruption in libjar through zip files

MFSA 2015-130/CVE-2015-7196 JavaScript garbage collection crash with Java applet

MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 Vulnerabilities found through code inspection

MFSA 2015-132/CVE-2015-7197 Mixed content WebSocket policy bypass through workers

MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 NSS and NSPR memory corruption issues

It also includes fixes from 38.3.0ESR :

MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3)

MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx while parsing vp9 format video

MFSA 2015-105/CVE-2015-4511 Buffer overflow while decoding WebM video

MFSA 2015-106/CVE-2015-4509 Use-after-free while manipulating HTML media content

MFSA 2015-110/CVE-2015-4519 Dragging and dropping images exposes final URL after redirects

MFSA 2015-111/CVE-2015-4520 Errors in the handling of CORS preflight request headers

MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522 CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177 CVE-2015-7180 Vulnerabilities found through code inspection

It also includes fixes from the Firefox 38.2.1ESR release :

MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free when resizing canvas element during restyling

MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on notification bypass through data URLs

It also includes fixes from the Firefox 38.2.0ESR release :

MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

MFSA 2015-80/CVE-2015-4475 Out-of-bounds read with malformed MP3 file

MFSA 2015-82/CVE-2015-4478 Redefinition of non-configurable JavaScript object properties

MFSA 2015-83/CVE-2015-4479 Overflow issues in libstagefright

MFSA 2015-87/CVE-2015-4484 Crash when using shared memory in JavaScript

MFSA 2015-88/CVE-2015-4491 Heap overflow in gdk-pixbuf when scaling bitmap images

MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 Buffer overflows on Libvpx when decoding WebM video

MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities found through code inspection

MFSA 2015-92/CVE-2015-4492 Use-after-free in XMLHttpRequest with shared workers

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox is being updated to the current Firefox 38ESR branch (specifically the 38.2.0ESR release).

Security issues fixed :

  - MFSA 2015-78 / CVE-2015-4495: Same origin violation and     local file stealing via PDF reader

  - MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474:
    Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

  - MFSA 2015-80 / CVE-2015-4475: Out-of-bounds read with     malformed MP3 file

  - MFSA 2015-82 / CVE-2015-4478: Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83 / CVE-2015-4479: Overflow issues in     libstagefright

  - MFSA 2015-87 / CVE-2015-4484: Crash when using shared     memory in JavaScript

  - MFSA 2015-88 / CVE-2015-4491: Heap overflow in     gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486: Buffer     overflows on Libvpx when decoding WebM video

  - MFSA 2015-90 /     CVE-2015-4487/CVE-2015-4488/CVE-2015-4489:
    Vulnerabilities found through code inspection

  - MFSA 2015-92 / CVE-2015-4492: Use-after-free in     XMLHttpRequest with shared workers

This update also contains a lot of feature improvements and bug fixes from 31ESR to 38ESR.

Also the Mozilla NSS library switched its CKBI API from 1.98 to 2.4, which is what Firefox 38ESR uses.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox is prior to 40.0 and is affected by multiple vulnerabilities : 

 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4473) 
 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4474) 
 - An out-of-bounds read error exists in the 'PlayFromAudioQueue()' function due to improper handling of mismatched sample formats. A remote attacker can exploit this, via a specially crafted MP3 file, to disclose memory contents or execute arbitrary code. (CVE-2015-4475) 
 - A use-after-free error exists in the Web Audio API during MediaStream playback. A remote attacker can exploit this to dereference already freed memory, resulting in the potential execution of arbitrary code. (CVE-2015-4477) 
 - A same-origin policy bypass vulnerability exists due to non-configurable properties being redefined in violation of the ECMAScript 6 standard during JSON parsing. A remote attacker can exploit this, by editing these properties to arbitrary values, to bypass the same-origin policy. (CVE-2015-4478) 
 - Multiple integer overflow conditions exist due to improper validation of user-supplied input when handling 'saio' chunks in MPEG4 video. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4479) 
 - An integer overflow condition exists in the bundled libstagefright component when handling H.264 media content. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4480) 
 - An arbitrary file overwrite vulnerability exists in the Mozilla Maintenance Service due to a race condition. An attacker can exploit this, via the use of a hard link, to overwrite arbitrary files with log output. (CVE-2015-4481) 
 - An out-of-bounds write error exists due to an array indexing flaw in the 'mar_consume_index()' function when handling index names in MAR files. An attacker can exploit this to execute arbitrary code. (CVE-2015-4482) 
 - A security bypass vulnerability exists due to a flaw in the 'ShouldLoad()' function that occurs during the handling of POST requests to URLs using the 'feed:' URI handler. An attacker can exploit this to bypass the mixed content blocker. (CVE-2015-4483) 
 - A denial of service vulnerability exists when handling JavaScript using shared memory without properly gating access to Atomics and SharedArrayBuffer views. An attacker can exploit this to crash the program, resulting in a denial of service condition. (CVE-2015-4484) 
 - A heap-based buffer overflow condition exists in the  'resize_context_buffers()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4485) 
 - A heap-based buffer overflow condition exists in the 'decrease_ref_count()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4486) 
 - A buffer overflow condition exists in the 'ReplacePrep()' function. A remote attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4487) 
 - A use-after-free error exists in the 'operator=()' function. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4488) 
 - A memory corruption issue exists in the 'nsTArray_Impl()' function due to improper validation of user-supplied input during self-assignment. An attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2015-4489) 
 - A security bypass vulnerability exists due to a discrepancy in the implementation of Content Security Policy and the CSP specification. The specification states that 'blob:', 'data:', and 'filesystem:' URLs should be excluded in case of a wildcard when matching source expressions, but Mozilla's implementation allows these in the case of an asterisk wildcard. A remote attacker can exploit this to bypass restrictions. (CVE-2015-4490) 
 - A use-after-free error exists in the 'XMLHttpRequest::Open()' function due to improper handling of recursive calls. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4492) 
 - An integer underflow condition exists in the bundled libstagefright library. An attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-4493) 
 - A flaw in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files. (CVE-2015-4495)

Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities.

  - Firefox was updated to 38.2.1 ESR (bsc#943608)

  - MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free     when resizing canvas element during restyling

  - MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on     notification bypass through data URLs

  - Firefox was updated to 38.2.0 ESR (bsc#940806)

  - MFSA 2015-78/CVE-2015-4495 (bmo#1178058, bmo#1179262)     Same origin violation and local file stealing via PDF     reader

  - MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 (bmo#1143130,     bmo#1161719, bmo#1177501, bmo#1181204, bmo#1184068,     bmo#1188590, bmo#1146213, bmo#1178890, bmo#1182711)     Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

  - MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds     read with malformed MP3 file

  - MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83/CVE-2015-4479 (bmo#1185115, bmo#1144107,     bmo#1170344, bmo#1186718) Overflow issues in     libstagefright

  - MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when     using shared memory in JavaScript

  - MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow     in gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948,     bmo#1178148) Buffer overflows on Libvpx when decoding     WebM video

  - MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489     (bmo#1176270, bmo#1182723, bmo#1171603) Vulnerabilities     found through code inspection

  - MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free     in XMLHttpRequest with shared workers

Mozilla NSS switched the CKBI ABI from 1.98 to 2.4, which is what Firefox 38ESR uses.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox is being updated to the current Firefox 38ESR branch (specifically the 38.2.0ESR release).

Security issues fixed :

  - MFSA 2015-78 / CVE-2015-4495: Same origin violation and     local file stealing via PDF reader

  - MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474:
    Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

  - MFSA 2015-80 / CVE-2015-4475: Out-of-bounds read with     malformed MP3 file

  - MFSA 2015-82 / CVE-2015-4478: Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83 / CVE-2015-4479: Overflow issues in     libstagefright

  - MFSA 2015-87 / CVE-2015-4484: Crash when using shared     memory in JavaScript

  - MFSA 2015-88 / CVE-2015-4491: Heap overflow in     gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486: Buffer     overflows on Libvpx when decoding WebM video

  - MFSA 2015-90 /     CVE-2015-4487/CVE-2015-4488/CVE-2015-4489:
    Vulnerabilities found through code inspection

  - MFSA 2015-92 / CVE-2015-4492: Use-after-free in     XMLHttpRequest with shared workers

The following vulnerabilities were fixed in ESR31 and are also included here :

  - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous     memory safety hazards (bsc#935979).

  - CVE-2015-2728: Type confusion in Indexed Database     Manager (bsc#935979).

  - CVE-2015-2730: ECDSA signature validation fails to     handle some signatures correctly (bsc#935979).

  - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers     while using XMLHttpRequest (bsc#935979).
    CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/     CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740:
    Vulnerabilities found through code inspection     (bsc#935979).

  - CVE-2015-2743: Privilege escalation in PDF.js     (bsc#935979).

  - CVE-2015-4000: NSS accepts export-length DHE keys with     regular DHE cipher suites (bsc#935033).

  - CVE-2015-2721: NSS incorrectly permits skipping of     ServerKeyExchange (bsc#935979).

This update also contains a lot of feature improvements and bug fixes from 31ESR to 38ESR.

Also the Mozilla NSS library switched its CKBI API from 1.98 to 2.4, which is what Firefox 38ESR uses.

Mozilla Firefox and mozilla-nss were updated to fix 17 security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to Thunderbird 38.2.0 fixes the following issues (bnc#940806) :

  - MFSA 2015-79/CVE-2015-4473 Miscellaneous memory safety     hazards

  - MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds     read with malformed MP3 file

  - MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493     Overflow issues in libstagefright

  - MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file     overwriting through Mozilla Maintenance Service with     hard links (only affected Windows)

  - MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds     write with Updater and malicious MAR file (does not     affect openSUSE RPM packages which do not ship the     updater)

  - MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when     using shared memory in JavaScript

  - MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow     in gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948,     bmo#1178148) Buffer overflows on Libvpx when decoding     WebM video

  - MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489     Vulnerabilities found through code inspection

  - MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free     in XMLHttpRequest with shared workers

- update to Firefox 40.0 (bnc#940806)

  - Added protection against unwanted software downloads

  - Suggested Tiles show sites of interest, based on     categories from your recent browsing history

  - Hello allows adding a link to conversations to provide     context on what the conversation will be about

  - New style for add-on manager based on the in-content     preferences style

  - Improved scrolling, graphics, and video playback     performance with off main thread compositing (GNU/Linux     only)

  - Graphic blocklist mechanism improved: Firefox version     ranges can be specified, limiting the number of devices     blocked security fixes :

  - MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 Miscellaneous     memory safety hazards

  - MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds     read with malformed MP3 file

  - MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free     in MediaStream playback

  - MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493     Overflow issues in libstagefright

  - MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file     overwriting through Mozilla Maintenance Service with     hard links (only affected Windows)

  - MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds     write with Updater and malicious MAR file (does not     affect openSUSE RPM packages which do not ship the     updater)

  - MFSA 2015-86/CVE-2015-4483 (bmo#1148732) Feed protocol     with POST bypasses mixed content protections

  - MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when     using shared memory in JavaScript

  - MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow     in gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948,     bmo#1178148) Buffer overflows on Libvpx when decoding     WebM video

  - MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489     Vulnerabilities found through code inspection

  - MFSA 2015-91/CVE-2015-4490 (bmo#1086999) Mozilla Content     Security Policy allows for asterisk wildcards in     violation of CSP specification

  - MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free     in XMLHttpRequest with shared workers

  - added mozilla-no-stdcxx-check.patch

  - removed obsolete patches

  - mozilla-add-glibcxx_use_cxx11_abi.patch

  - firefox-multilocale-chrome.patch

  - rebased patches

  - requires version 40 of the branding package

  - removed browser/searchplugins/ location as it's not     valid anymore

  - includes security update to Firefox 39.0.3 (bnc#940918)

  - MFSA 2015-78/CVE-2015-4495 (bmo#1179262, bmo#1178058)     Same origin violation and local file stealing via PDF     reader

The version of Firefox installed on the remote Windows host is prior to 40. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exist that allow a     remote attacker, via a specially crafted web page, to     corrupt memory and potentially execute arbitrary code.
    (CVE-2015-4473)

  - Multiple memory corruption issues exist that allow a     remote attacker, via a specially crafted web page, to     corrupt memory and potentially execute arbitrary code.
    (CVE-2015-4474)

  - An out-of-bounds read error exists in the     PlayFromAudioQueue() function due to improper handling     of mismatched sample formats. A remote attacker can     exploit this, via a specially crafted MP3 file, to     disclose memory contents or execute arbitrary code.
    (CVE-2015-4475)

  - A use-after-free error exists in the Web Audio API     during MediaStream playback. A remote attacker can     exploit this to dereference already freed memory,     resulting in the potential execution of arbitrary code.
    (CVE-2015-4477)

  - A same-origin policy bypass vulnerability exists due to     non-configurable properties being redefined in violation     of the ECMAScript 6 standard during JSON parsing. A     remote attacker can exploit this, by editing these     properties to arbitrary values, to bypass the     same-origin policy. (CVE-2015-4478)

  - Multiple integer overflow conditions exist due to     improper validation of user-supplied input when handling     'saio' chunks in MPEG4 video. A remote attacker can     exploit this, via a specially crafted MPEG4 file, to     execute arbitrary code. (CVE-2015-4479)

  - An integer overflow condition exists in the bundled     libstagefright component when handling H.264 media     content. A remote attacker can exploit this, via a     specially crafted MPEG4 file, to execute arbitrary code.
    (CVE-2015-4480)

  - An arbitrary file overwrite vulnerability exists in the     Mozilla Maintenance Service due to a race condition. An     attacker can exploit this, via the use of a hard link,     to overwrite arbitrary files with log output.
    (CVE-2015-4481)

  - An out-of-bounds write error exists due to an array     indexing flaw in the mar_consume_index() function when     handling index names in MAR files. An attacker can     exploit this to execute arbitrary code. (CVE-2015-4482)

  - A security bypass vulnerability exists due to a flaw in     the ShouldLoad() function that occurs during the     handling of POST requests to URLs using the 'feed:' URI     handler. An attacker can exploit this to bypass the     mixed content blocker. (CVE-2015-4483)

  - A denial of service vulnerability exists when handling     JavaScript using shared memory without properly gating     access to Atomics and SharedArrayBuffer views. An     attacker can exploit this to crash the program,     resulting in a denial of service condition.
    (CVE-2015-4484)

  - A heap-based buffer overflow condition exists in the     resize_context_buffers() function due to improper     validation of user-supplied input. A remote attacker can     exploit this, via specially crafted WebM content, to     cause a heap-based buffer overflow, resulting in the     execution of arbitrary code. (CVE-2015-4485)

  - A heap-based buffer overflow condition exists in the     decrease_ref_count() function due to improper validation     of user-supplied input. A remote attacker can exploit     this, via specially crafted WebM content, to cause a     heap-based buffer overflow, resulting in the execution     of arbitrary code. (CVE-2015-4486)

  - A buffer overflow condition exists in the ReplacePrep()     function. A remote attacker can exploit this to cause a     buffer overflow, resulting in the execution of arbitrary     code. (CVE-2015-4487)

  - A use-after-free error exists in the operator=()     function. An attacker can exploit this to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-4488)

  - A memory corruption issue exists in the nsTArray_Impl()     function due to improper validation of user-supplied     input during self-assignment. An attacker can exploit     this to corrupt memory, resulting in the execution of     arbitrary code. (CVE-2015-4489)

  - A security bypass vulnerability exists due to a     discrepancy in the implementation of Content Security     Policy and the CSP specification. The specification     states that 'blob:', 'data:', and 'filesystem:' URLs     should be excluded in case of a wildcard when matching     source expressions, but Mozilla's implementation allows     these in the case of an asterisk wildcard. A remote     attacker can exploit this to bypass restrictions.
    (CVE-2015-4490)

  - A use-after-free error exists in the     XMLHttpRequest::Open() function due to improper handling     of recursive calls. An attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2015-4492)

  - An integer underflow condition exists in the bundled     libstagefright library. An attacker can exploit this to     crash the application, resulting in a denial of service     condition. (CVE-2015-4493)

The version of Firefox ESR installed on the remote Windows host is prior to 38.2. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exist that allow a     remote attacker, via a specially crafted web page, to     corrupt memory and potentially execute arbitrary code.
    (CVE-2015-4473)

  - An out-of-bounds read error exists in the     PlayFromAudioQueue() function due to improper handling     of mismatched sample formats. A remote attacker can     exploit this, via a specially crafted MP3 file, to     disclose memory contents or execute arbitrary code.
    (CVE-2015-4475)

  - A same-origin policy bypass vulnerability exists due to     non-configurable properties being redefined in violation     of the ECMAScript 6 standard during JSON parsing. A     remote attacker can exploit this, by editing these     properties to arbitrary values, to bypass the     same-origin policy. (CVE-2015-4478)

  - Multiple integer overflow conditions exist due to     improper validation of user-supplied input when handling     'saio' chunks in MPEG4 video. A remote attacker can     exploit this, via a specially crafted MPEG4 file, to     execute arbitrary code. (CVE-2015-4479)

  - An integer overflow condition exists in the bundled     libstagefright component when handling H.264 media     content. A remote attacker can exploit this, via a     specially crafted MPEG4 file, to execute arbitrary code.
    (CVE-2015-4480)

  - An arbitrary file overwrite vulnerability exists in the     Mozilla Maintenance Service due to a race condition. An     attacker can exploit this, via the use of a hard link,     to overwrite arbitrary files with log output.
    (CVE-2015-4481)

  - An out-of-bounds write error exists due to an array     indexing flaw in the mar_consume_index() function when     handling index names in MAR files. An attacker can     exploit this to execute arbitrary code. (CVE-2015-4482)

  - A denial of service vulnerability exists when handling     JavaScript using shared memory without properly gating     access to Atomics and SharedArrayBuffer views. An     attacker can exploit this to crash the program,     resulting in a denial of service condition.
    (CVE-2015-4484)

  - A heap-based buffer overflow condition exists in the     resize_context_buffers() function due to improper     validation of user-supplied input. A remote attacker can     exploit this, via specially crafted WebM content, to     cause a heap-based buffer overflow, resulting in the     execution of arbitrary code. (CVE-2015-4485)

  - A heap-based buffer overflow condition exists in the     decrease_ref_count() function due to improper validation     of user-supplied input. A remote attacker can exploit     this, via specially crafted WebM content, to cause a     heap-based buffer overflow, resulting in the execution     of arbitrary code. (CVE-2015-4486)

  - A buffer overflow condition exists in the ReplacePrep()     function. A remote attacker can exploit this to cause a     buffer overflow, resulting in the execution of arbitrary     code. (CVE-2015-4487)

  - A use-after-free error exists in the operator=()     function. An attacker can exploit this to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-4488)

  - A memory corruption issue exists in the nsTArray_Impl()     function due to improper validation of user-supplied     input during self-assignment. An attacker can exploit     this to corrupt memory, resulting in the execution of     arbitrary code. (CVE-2015-4489)

  - A use-after-free error exists in the     XMLHttpRequest::Open() function due to improper handling     of recursive calls. An attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2015-4492)

  - An integer underflow condition exists in the bundled     libstagefright library. An attacker can exploit this to     crash the application, resulting in a denial of service     condition. (CVE-2015-4493)

The version of Firefox installed on the remote Mac OS X host is prior to 40. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exist that allow a     remote attacker, via a specially crafted web page, to     corrupt memory and potentially execute arbitrary code.
    (CVE-2015-4473)

  - Multiple memory corruption issues exist that allow a     remote attacker, via a specially crafted web page, to     corrupt memory and potentially execute arbitrary code.
    (CVE-2015-4474)

  - An out-of-bounds read error exists in the     PlayFromAudioQueue() function due to improper handling     of mismatched sample formats. A remote attacker can     exploit this, via a specially crafted MP3 file, to     disclose memory contents or execute arbitrary code.
    (CVE-2015-4475)

  - A use-after-free error exists in the Web Audio API     during MediaStream playback. A remote attacker can     exploit this to dereference already freed memory,     resulting in the potential execution of arbitrary code.
    (CVE-2015-4477)

  - A same-origin policy bypass vulnerability exists due to     non-configurable properties being redefined in violation     of the ECMAScript 6 standard during JSON parsing. A     remote attacker can exploit this, by editing these     properties to arbitrary values, to bypass the     same-origin policy. (CVE-2015-4478)

  - Multiple integer overflow conditions exist due to     improper validation of user-supplied input when handling     'saio' chunks in MPEG4 video. A remote attacker can     exploit this, via a specially crafted MPEG4 file, to     execute arbitrary code. (CVE-2015-4479)

  - An integer overflow condition exists in the bundled     libstagefright component when handling H.264 media     content. A remote attacker can exploit this, via a     specially crafted MPEG4 file, to execute arbitrary code.
    (CVE-2015-4480)

  - An out-of-bounds write error exists due to an array     indexing flaw in the mar_consume_index() function when     handling index names in MAR files. An attacker can     exploit this to execute arbitrary code. (CVE-2015-4482)

  - A security bypass vulnerability exists due to a flaw in     the ShouldLoad() function that occurs during the     handling of POST requests to URLs using the 'feed:' URI     handler. An attacker can exploit this to bypass the     mixed content blocker. (CVE-2015-4483)

  - A denial of service vulnerability exists when handling     JavaScript using shared memory without properly gating     access to Atomics and SharedArrayBuffer views. An     attacker can exploit this to crash the program,     resulting in a denial of service condition.
    (CVE-2015-4484)

  - A heap-based buffer overflow condition exists in the     resize_context_buffers() function due to improper     validation of user-supplied input. A remote attacker can     exploit this, via specially crafted WebM content, to     cause a heap-based buffer overflow, resulting in the     execution of arbitrary code. (CVE-2015-4485)

  - A heap-based buffer overflow condition exists in the     decrease_ref_count() function due to improper validation     of user-supplied input. A remote attacker can exploit     this, via specially crafted WebM content, to cause a     heap-based buffer overflow, resulting in the execution     of arbitrary code. (CVE-2015-4486)

  - A buffer overflow condition exists in the ReplacePrep()     function. A remote attacker can exploit this to cause a     buffer overflow, resulting in the execution of arbitrary     code. (CVE-2015-4487)

  - A use-after-free error exists in the operator=()     function. An attacker can exploit this to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-4488)

  - A memory corruption issue exists in the nsTArray_Impl()     function due to improper validation of user-supplied     input during self-assignment. An attacker can exploit     this to corrupt memory, resulting in the execution of     arbitrary code. (CVE-2015-4489)

  - A security bypass vulnerability exists due to a     discrepancy in the implementation of Content Security     Policy and the CSP specification. The specification     states that 'blob:', 'data:', and 'filesystem:' URLs     should be excluded in case of a wildcard when matching     source expressions, but Mozilla's implementation allows     these in the case of an asterisk wildcard. A remote     attacker can exploit this to bypass restrictions.
    (CVE-2015-4490)

  - A use-after-free error exists in the     XMLHttpRequest::Open() function due to improper handling     of recursive calls. An attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2015-4492)

  - An integer underflow condition exists in the bundled     libstagefright library. An attacker can exploit this to     crash the application, resulting in a denial of service     condition. (CVE-2015-4493)

The version of Firefox ESR installed on the remote Mac OS X host is prior to 38.2. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exist that allow a     remote attacker, via a specially crafted web page, to     corrupt memory and potentially execute arbitrary code.
    (CVE-2015-4473)

  - An out-of-bounds read error exists in the     PlayFromAudioQueue() function due to improper handling     of mismatched sample formats. A remote attacker can     exploit this, via a specially crafted MP3 file, to     disclose memory contents or execute arbitrary code.
    (CVE-2015-4475)

  - A same-origin policy bypass vulnerability exists due to     non-configurable properties being redefined in violation     of the ECMAScript 6 standard during JSON parsing. A     remote attacker can exploit this, by editing these     properties to arbitrary values, to bypass the     same-origin policy. (CVE-2015-4478)

  - Multiple integer overflow conditions exist due to     improper validation of user-supplied input when handling     'saio' chunks in MPEG4 video. A remote attacker can     exploit this, via a specially crafted MPEG4 file, to     execute arbitrary code. (CVE-2015-4479)

  - An integer overflow condition exists in the bundled     libstagefright component when handling H.264 media     content. A remote attacker can exploit this, via a     specially crafted MPEG4 file, to execute arbitrary code.
    (CVE-2015-4480)

  - An out-of-bounds write error exists due to an array     indexing flaw in the mar_consume_index() function when     handling index names in MAR files. An attacker can     exploit this to execute arbitrary code. (CVE-2015-4482)

  - A denial of service vulnerability exists when handling     JavaScript using shared memory without properly gating     access to Atomics and SharedArrayBuffer views. An     attacker can exploit this to crash the program,     resulting in a denial of service condition.
    (CVE-2015-4484)

  - A heap-based buffer overflow condition exists in the     resize_context_buffers() function due to improper     validation of user-supplied input. A remote attacker can     exploit this, via specially crafted WebM content, to     cause a heap-based buffer overflow, resulting in the     execution of arbitrary code. (CVE-2015-4485)

  - A heap-based buffer overflow condition exists in the     decrease_ref_count() function due to improper validation     of user-supplied input. A remote attacker can exploit     this, via specially crafted WebM content, to cause a     heap-based buffer overflow, resulting in the execution     of arbitrary code. (CVE-2015-4486)

  - A buffer overflow condition exists in the ReplacePrep()     function. A remote attacker can exploit this to cause a     buffer overflow, resulting in the execution of arbitrary     code. (CVE-2015-4487)

  - A use-after-free error exists in the operator=()     function. An attacker can exploit this to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-4488)

  - A memory corruption issue exists in the nsTArray_Impl()     function due to improper validation of user-supplied     input during self-assignment. An attacker can exploit     this to corrupt memory, resulting in the execution of     arbitrary code. (CVE-2015-4489)

  - A use-after-free error exists in the     XMLHttpRequest::Open() function due to improper handling     of recursive calls. An attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2015-4492)

  - An integer underflow condition exists in the bundled     libstagefright library. An attacker can exploit this to     crash the application, resulting in a denial of service     condition. (CVE-2015-4493)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2702-1 advisory.

    Gary Kwong, Christian Holler, Byron Campen, Tyson Smith, Bobby Holley, Chris Coulson, and Eric Rahm     discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via application     crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-4473,     CVE-2015-4474)

    Aki Helin discovered an out-of-bounds read when playing malformed MP3 content in some circumstances. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     obtain sensitive information, cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Firefox. (CVE-2015-4475)

    A use-after-free was discovered during MediaStream playback in some circumstances. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox.
    (CVE-2015-4477)

    Andr Bargull discovered that non-configurable properties on javascript objects could be redefined when     parsing JSON. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass same-origin restrictions. (CVE-2015-4478)

    Multiple integer overflows were discovered in libstagefright. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2015-4479, CVE-2015-4480, CVE-2015-4493)

    Jukka Jylnki discovered a crash that occurs because javascript does not properly gate access to Atomics     or SharedArrayBuffers in some circumstances. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-4484)

    Abhishek Arya discovered 2 buffer overflows in libvpx when decoding malformed WebM content in some     circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit these to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Firefox. (CVE-2015-4485, CVE-2015-4486)

    Ronald Crane reported 3 security issues. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit these, in combination with another security vulnerability, to cause     a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-4487, CVE-2015-4488, CVE-2015-4489)

    Christoph Kerschbaumer discovered an issue with Mozilla's implementation of Content Security Policy (CSP),     which could allow for a more permissive usage in some cirucumstances. An attacker could potentially     exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2015-4490)

    Gustavo Grieco discovered a heap overflow in gdk-pixbuf. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-4491)

    Looben Yang discovered a use-after-free when using XMLHttpRequest with shared workers in some     circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to cause a denial of service via application crash or execute arbitrary code with     the priviliges of the user invoking Firefox. (CVE-2015-4492)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-4473, CVE-2015-4475, CVE-2015-4478, CVE-2015-4479, CVE-2015-4480, CVE-2015-4493, CVE-2015-4484, CVE-2015-4491, CVE-2015-4485, CVE-2015-4486, CVE-2015-4487, CVE-2015-4488, CVE-2015-4489, CVE-2015-4492)

After installing the update, Firefox must be restarted for the changes to take effect.

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-4473, CVE-2015-4475, CVE-2015-4478, CVE-2015-4479, CVE-2015-4480, CVE-2015-4493, CVE-2015-4484, CVE-2015-4491, CVE-2015-4485, CVE-2015-4486, CVE-2015-4487, CVE-2015-4488, CVE-2015-4489, CVE-2015-4492)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christian Holler, Byron Campen, Aki Helin, Andre Bargull, Massimiliano Tomassoli, laf.intel, Massimiliano Tomassoli, Tyson Smith, Jukka Jylanki, Gustavo Grieco, Abhishek Arya, Ronald Crane, and Looben Yang as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.2 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-1586 advisory.

    [38.2.0-4.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one
    - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484]

    [38.2.0-4]
    - Update to 38.2.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Mozilla Project reports :

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover two buffer overflow issues in the Libvpx library used for WebM video when decoding a malformed WebM video file. These buffer overflows result in potentially exploitable crashes.

ID	Name	Product	Family	Severity
91379	GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)	Nessus	Gentoo Local Security Checks	critical
87063	SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2015:2081-1)	Nessus	SuSE Local Security Checks	critical
85906	SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1528-1)	Nessus	SuSE Local Security Checks	critical
8856	Mozilla Firefox < 40.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
85763	SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1476-1)	Nessus	SuSE Local Security Checks	critical
85721	SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1449-1) (Logjam)	Nessus	SuSE Local Security Checks	low
85703	openSUSE Security Update : MozillaThunderbird (openSUSE-2015-559)	Nessus	SuSE Local Security Checks	critical
85702	openSUSE Security Update : MozillaThunderbird (openSUSE-2015-558)	Nessus	SuSE Local Security Checks	critical
85437	openSUSE Security Update : MozillaFirefox (openSUSE-2015-548)	Nessus	SuSE Local Security Checks	critical
85436	openSUSE Security Update : MozillaFirefox (openSUSE-2015-547)	Nessus	SuSE Local Security Checks	critical
85386	Firefox < 40 Multiple Vulnerabilities	Nessus	Windows	critical
85385	Firefox ESR < 38.2 Multiple Vulnerabilities	Nessus	Windows	critical
85384	Firefox < 40 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
85383	Firefox ESR < 38.2 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
85344	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2702-1)	Nessus	Ubuntu Local Security Checks	medium
85343	Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150811)	Nessus	Scientific Linux Local Security Checks	critical
85342	RHEL 5 / 6 / 7 : firefox (RHSA-2015:1586)	Nessus	Red Hat Local Security Checks	critical
85339	Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1586)	Nessus	Oracle Linux Local Security Checks	medium
85337	FreeBSD : libvpx -- multiple buffer overflows (34e60332-2448-4ed6-93f0-12713749f250)	Nessus	FreeBSD Local Security Checks	critical
85336	CentOS 5 / 6 / 7 : firefox (CESA-2015:1586)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2015-4485

critical

Tenable Plugins

critical

critical

critical

critical

critical

low

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

medium

critical

critical