Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.

MozillaFirefox ESR was updated to version 38.4.0ESR to fix multiple security issues.

MFSA 2015-116/CVE-2015-4513 Miscellaneous memory safety hazards (rv:42.0 / rv:38.4)

MFSA 2015-122/CVE-2015-7188 Trailing whitespace in IP address hostnames can bypass same-origin policy

MFSA 2015-123/CVE-2015-7189 Buffer overflow during image interactions in canvas

MFSA 2015-127/CVE-2015-7193 CORS preflight is bypassed when non-standard Content-Type headers are received

MFSA 2015-128/CVE-2015-7194 Memory corruption in libjar through zip files

MFSA 2015-130/CVE-2015-7196 JavaScript garbage collection crash with Java applet

MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 Vulnerabilities found through code inspection

MFSA 2015-132/CVE-2015-7197 Mixed content WebSocket policy bypass through workers

MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 NSS and NSPR memory corruption issues

It also includes fixes from 38.3.0ESR :

MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3)

MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx while parsing vp9 format video

MFSA 2015-105/CVE-2015-4511 Buffer overflow while decoding WebM video

MFSA 2015-106/CVE-2015-4509 Use-after-free while manipulating HTML media content

MFSA 2015-110/CVE-2015-4519 Dragging and dropping images exposes final URL after redirects

MFSA 2015-111/CVE-2015-4520 Errors in the handling of CORS preflight request headers

MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522 CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177 CVE-2015-7180 Vulnerabilities found through code inspection

It also includes fixes from the Firefox 38.2.1ESR release :

MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free when resizing canvas element during restyling

MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on notification bypass through data URLs

It also includes fixes from the Firefox 38.2.0ESR release :

MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

MFSA 2015-80/CVE-2015-4475 Out-of-bounds read with malformed MP3 file

MFSA 2015-82/CVE-2015-4478 Redefinition of non-configurable JavaScript object properties

MFSA 2015-83/CVE-2015-4479 Overflow issues in libstagefright

MFSA 2015-87/CVE-2015-4484 Crash when using shared memory in JavaScript

MFSA 2015-88/CVE-2015-4491 Heap overflow in gdk-pixbuf when scaling bitmap images

MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 Buffer overflows on Libvpx when decoding WebM video

MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities found through code inspection

MFSA 2015-92/CVE-2015-4492 Use-after-free in XMLHttpRequest with shared workers

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated firefox packages that fix two security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-4497)

A flaw was found in the way Firefox handled installation of add-ons.
An attacker could use this flaw to bypass the add-on installation prompt, and trick the user inso installing an add-on from a malicious source. (CVE-2015-4498)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Jean-Max Reymond, Ucha Gobejishvili, and Bas Venis as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.2.1 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The version of Mozilla Firefox is prior to 41.0 and is affected by multiple vulnerabilities : 

 - A flaw exists in ReadbackResultWriterD3D11::Run(). The issue is triggered as user-supplied input is not properly validated when handling return statuses. This may potentially allow a context-dependent attacker to corrupt memory and have an unspecified impact. (CVE-2015-7180) 
 - A flaw exists in InitTextures(). The issue is triggered as user-supplied input is not properly validated. This may potentially allow a context-dependent attacker to corrupt memory and have an unspecified impact. (CVE-2015-7117) 
 - An overflow condition exists in AnimationThread(). The issue is triggered as user-supplied input is not properly validated when handling sscanf arguments. This may allow a context-dependent attacker to cause a stack overflow, resulting in an unspecified impact. (CVE-2015-7176) 
 - An overflow condition exists in XULContentSinkImpl::AddText(). The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact. (CVE-2015-7175) 
 - An overflow condition exists in the nsAttrAndChildArray::GrowBy() function in 'dom/base/nsAttrAndChildArray.cpp'. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code. (CVE-2015-7174) 
 - An overflow condition exists in the nsUnicode*::GetMaxLength() functions that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code. (CVE-2015-4522) 
 - A flaw exists in ConvertDialogOptions(). The issue is triggered as user-supplied input is not properly validated. This may potentially allow a context-dependent attacker to corrupt memory and have an unspecified impact. (CVE-2015-4521) 
 - A flaw exists in NetworkUtils.cpp. The issue is triggered as user-supplied input is not properly validated. This may potentially allow a context-dependent attacker to corrupt memory and have an unspecified impact. (CVE-2015-4517) 
 - An out-of-bounds read flaw exists in 'gfx/2d/DataSurfaceHelpers.cpp' that is triggered during the rendering of 2D canvases. This may allow a context-dependent attacker to potentially disclose sensitive memory contents. (CVE-2015-4512) 
 - A flaw exists that is triggered when identical cache keys may be generated for distinct preflight requests on a site. This may potentially allow a subsequent request to bypass intended cross-origin resource sharing (CORS) checks. (CVE-2015-4520) 
 - A flaw exists that is triggered when handling images that have been "dragged and dropped" after a redirect. The redirected URL of the image may be available to scripts, potentially allowing a context-dependent attacker to gain unauthorized access to it. (CVE-2015-4519) 
 - A use-after-free error exists in 'dom/html/HTMLMediaElement.cpp' that is triggered during the handling of HTML media elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-4509) 
 - nestegg contains an overflow condition. The issue is triggered as user-supplied input is not properly validated when decoding WebM videos. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2015-4511) 
 - A flaw related to scratch register scope handling exists. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in the cloneLeftHandSide() function in 'frontend/ParseNode.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in 'memory/mozjemalloc/jemalloc.c' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in the stagefright component that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists that is triggered when handling generator function groups, as they have an improper prototype. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in the nsXBLService::GetBinding() function in 'dom/xbl/nsXBLService.cpp' that is triggered when loading bindings. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in the IndexedDB component that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500)
 - A use-after-free error exists in 'nsIPresShell' that is triggered when handling a restyling operation during the resizing of a canvas element. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-4497)
 - A flaw exists that is triggered when handling add-on installation using 'data:' URLs. With a specially crafted web page, a context-dependent attacker can bypass the install permission prompt for add-ons and install add-ons from malicious sources. (CVE-2015-4498)

Mozilla Firefox was updated to 38.2.1 ESR, fixing two severe security bugs. (bsc#943608)

  - MFSA 2015-94/CVE-2015-4497 (bsc#943557): Use-after-free     when resizing canvas element during restyling

  - MFSA 2015-95/CVE-2015-4498 (bsc#943558): Add-on     notification bypass through data URLs

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MozillaFirefox was updated to version 40.0.3 to fix two security issues and several bugs.

Changes in MozillaFirefox :

  - update to Firefox 40.0.3 (bnc#943550)

  - Disable the asynchronous plugin initialization     (bmo#1198590)

  - Fix a segmentation fault in the GStreamer support     (bmo#1145230)

  - Fix a regression with some Japanese fonts used in the     <input> field (bmo#1194055)

  - On some sites, the selection in a select combox box     using the mouse could be broken (bmo#1194733) security     fixes

  - MFSA 2015-94/CVE-2015-4497 (bmo#1164766, bmo#1175278,     bsc#943557) Use-after-free when resizing canvas element     during restyling

  - MFSA 2015-95/CVE-2015-4498 (bmo#1042699, bsc#943558)     Add-on notification bypass through data URLs

Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities.

  - Firefox was updated to 38.2.1 ESR (bsc#943608)

  - MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free     when resizing canvas element during restyling

  - MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on     notification bypass through data URLs

  - Firefox was updated to 38.2.0 ESR (bsc#940806)

  - MFSA 2015-78/CVE-2015-4495 (bmo#1178058, bmo#1179262)     Same origin violation and local file stealing via PDF     reader

  - MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 (bmo#1143130,     bmo#1161719, bmo#1177501, bmo#1181204, bmo#1184068,     bmo#1188590, bmo#1146213, bmo#1178890, bmo#1182711)     Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

  - MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds     read with malformed MP3 file

  - MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83/CVE-2015-4479 (bmo#1185115, bmo#1144107,     bmo#1170344, bmo#1186718) Overflow issues in     libstagefright

  - MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when     using shared memory in JavaScript

  - MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow     in gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948,     bmo#1178148) Buffer overflows on Libvpx when decoding     WebM video

  - MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489     (bmo#1176270, bmo#1182723, bmo#1171603) Vulnerabilities     found through code inspection

  - MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free     in XMLHttpRequest with shared workers

Mozilla NSS switched the CKBI ABI from 1.98 to 2.4, which is what Firefox 38ESR uses.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-4497)

A flaw was found in the way Firefox handled installation of add-ons.
An attacker could use this flaw to bypass the add-on installation prompt, and trick the user inso installing an add-on from a malicious source. (CVE-2015-4498)

After installing the update, Firefox must be restarted for the changes to take effect.

The Mozilla Project reports :

MFSA 2015-95 Add-on notification bypass through data URLs

MFSA 2015-94 Use-after-free when resizing canvas element during restyling

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-4497     Jean-Max Reymond and Ucha Gobejishvili discovered a     use-after-free vulnerability which occurs when resizing     of a canvas element is triggered in concert with style     changes. A web page containing malicious content can     cause Iceweasel to crash, or potentially, execute     arbitrary code with the privileges of the user running     Iceweasel.

  - CVE-2015-4498     Bas Venis reported a flaw in the handling of add-ons     installation. A remote attacker can take advantage of     this flaw to bypass the add-on installation prompt and     trick a user into installing an add-on from a malicious     source.

The version of Mozilla Firefox installed on the remote Windows host is prior to 40.0.3. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists when handling restyling     operations during the resizing of canvas elements due to     the canvas references being recreated, thus destroying     the original references. A remote, unauthenticated     attacker can exploit this to deference already freed     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2015-4497)

  - A security feature bypass vulnerability exists due to a     flaw that allows the manipulation of the 'data:' URL on     a loaded web page without install permission prompts     being displayed to the user. A remote, unauthenticated     attacker can exploit this to install add-ons from a     malicious source. (CVE-2015-4498)

The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 38.2.1. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists when handling restyling     operations during the resizing of canvas elements due to     the canvas references being recreated, thus destroying     the original references. A remote, unauthenticated     attacker can exploit this to deference already freed     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2015-4497)

  - A security feature bypass vulnerability exists due to a     flaw that allows the manipulation of the 'data:' URL on     a loaded web page without install permission prompts     being displayed to the user. A remote, unauthenticated     attacker can exploit this to install add-ons from a     malicious source. (CVE-2015-4498)

The version of Mozilla Firefox installed on the remote Mac OS X host is prior to 40.0.3. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists when handling restyling     operations during the resizing of canvas elements due to     the canvas references being recreated, thus destroying     the original references. A remote, unauthenticated     attacker can exploit this to deference already freed     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2015-4497)

  - A security feature bypass vulnerability exists due to a     flaw that allows the manipulation of the 'data:' URL on     a loaded web page without install permission prompts     being displayed to the user. A remote, unauthenticated     attacker can exploit this to install add-ons from a     malicious source. (CVE-2015-4498)

The version of Mozilla Firefox ESR installed on the remote Mac OS X host is prior to 38.2.1. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists when handling restyling     operations during the resizing of canvas elements due to     the canvas references being recreated, thus destroying     the original references. A remote, unauthenticated     attacker can exploit this to deference already freed     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2015-4497)

  - A security feature bypass vulnerability exists due to a     flaw that allows the manipulation of the 'data:' URL on     a loaded web page without install permission prompts     being displayed to the user. A remote, unauthenticated     attacker can exploit this to install add-ons from a     malicious source. (CVE-2015-4498)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2723-1 advisory.

    A use-after-free was discovered when resizing a canvas element during restyling in some circumstances. If     a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this     to cause a denial of service via application crash, or execute arbitrary code with the privileges of the     user invoking Firefox. (CVE-2015-4497)

    Bas Venis discovered that the addon install permission prompt could be bypassed using data: URLs in some     circumstances. It was also discovered that the installation notification could be made to appear over     another site. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to install a malicious addon. (CVE-2015-4498)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-1693 advisory.

    [38.2.1-1.0.1]
    - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html       and remove the corresponding Red Hat files

    [38.2.1-1]
    - Update to 38.2.1 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
87063	SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2015:2081-1)	Nessus	SuSE Local Security Checks	critical
86498	CentOS 5 / 6 / 7 : firefox (CESA-2015:1693)	Nessus	CentOS Local Security Checks	critical
8948	Mozilla Firefox < 41.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
85868	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:1504-1)	Nessus	SuSE Local Security Checks	critical
85834	openSUSE Security Update : MozillaFirefox (openSUSE-2015-565)	Nessus	SuSE Local Security Checks	critical
85763	SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1476-1)	Nessus	SuSE Local Security Checks	critical
85706	Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150827)	Nessus	Scientific Linux Local Security Checks	critical
85699	FreeBSD : mozilla -- multiple vulnerabilities (237a201c-888b-487f-84d3-7d92266381d6)	Nessus	FreeBSD Local Security Checks	critical
85696	Debian DSA-3345-1 : iceweasel - security update	Nessus	Debian Local Security Checks	critical
85689	Firefox < 40.0.3 Multiple Vulnerabilities	Nessus	Windows	critical
85688	Firefox ESR < 38.2.1 Multiple Vulnerabilities	Nessus	Windows	critical
85687	Firefox < 40.0.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
85686	Firefox ESR < 38.2.1 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
85682	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2723-1)	Nessus	Ubuntu Local Security Checks	high
85680	RHEL 5 / 6 / 7 : firefox (RHSA-2015:1693)	Nessus	Red Hat Local Security Checks	critical
85679	Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1693)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2015-4497

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

high