Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM video.

MozillaFirefox ESR was updated to version 38.4.0ESR to fix multiple security issues.

MFSA 2015-116/CVE-2015-4513 Miscellaneous memory safety hazards (rv:42.0 / rv:38.4)

MFSA 2015-122/CVE-2015-7188 Trailing whitespace in IP address hostnames can bypass same-origin policy

MFSA 2015-123/CVE-2015-7189 Buffer overflow during image interactions in canvas

MFSA 2015-127/CVE-2015-7193 CORS preflight is bypassed when non-standard Content-Type headers are received

MFSA 2015-128/CVE-2015-7194 Memory corruption in libjar through zip files

MFSA 2015-130/CVE-2015-7196 JavaScript garbage collection crash with Java applet

MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 Vulnerabilities found through code inspection

MFSA 2015-132/CVE-2015-7197 Mixed content WebSocket policy bypass through workers

MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 NSS and NSPR memory corruption issues

It also includes fixes from 38.3.0ESR :

MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3)

MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx while parsing vp9 format video

MFSA 2015-105/CVE-2015-4511 Buffer overflow while decoding WebM video

MFSA 2015-106/CVE-2015-4509 Use-after-free while manipulating HTML media content

MFSA 2015-110/CVE-2015-4519 Dragging and dropping images exposes final URL after redirects

MFSA 2015-111/CVE-2015-4520 Errors in the handling of CORS preflight request headers

MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522 CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177 CVE-2015-7180 Vulnerabilities found through code inspection

It also includes fixes from the Firefox 38.2.1ESR release :

MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free when resizing canvas element during restyling

MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on notification bypass through data URLs

It also includes fixes from the Firefox 38.2.0ESR release :

MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

MFSA 2015-80/CVE-2015-4475 Out-of-bounds read with malformed MP3 file

MFSA 2015-82/CVE-2015-4478 Redefinition of non-configurable JavaScript object properties

MFSA 2015-83/CVE-2015-4479 Overflow issues in libstagefright

MFSA 2015-87/CVE-2015-4484 Crash when using shared memory in JavaScript

MFSA 2015-88/CVE-2015-4491 Heap overflow in gdk-pixbuf when scaling bitmap images

MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 Buffer overflows on Libvpx when decoding WebM video

MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities found through code inspection

MFSA 2015-92/CVE-2015-4492 Use-after-free in XMLHttpRequest with shared workers

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Updated 25 August 2014] This erratum previously included an incorrect list of fixed issues. The issue list has been updated to reflect the CVEs that were fixed in this update. The firefox packages provided by this advisory have not been modified in any way.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-4500, CVE-2015-4506, CVE-2015-4509, CVE-2015-4511, CVE-2015-4517, CVE-2015-4521, CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176, CVE-2015-7177, CVE-2015-7180)

Two information leak flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to disclose sensitive information or, in certain cases, crash.
(CVE-2015-4519, CVE-2015-4520)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, Cameron McCormack, Khalil Zhani, Atte Kettunen, Ronald Crane, Mario Gomes, and Ehsan Akhgari as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.3.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Mozilla Firefox was updated to version 38.3.0 ESR (bsc#947003), fixing bugs and security issues.

  - MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous     memory safety hazards (rv:41.0 / rv:38.3)

  - MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx     while parsing vp9 format video

  - MFSA 2015-105/CVE-2015-4511 Buffer overflow while     decoding WebM video

  - MFSA 2015-106/CVE-2015-4509 Use-after-free while     manipulating HTML media content

  - MFSA 2015-110/CVE-2015-4519 Dragging and dropping images     exposes final URL after redirects

  - MFSA 2015-111/CVE-2015-4520 Errors in the handling of     CORS preflight request headers

  - MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522     CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177     CVE-2015-7180 Vulnerabilities found through code     inspection

More details can be found on https://www.mozilla.org/en-US/security/advisories/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox was updated to version 38.3.0 ESR (bsc#947003), fixing bugs and security issues.

  - MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous     memory safety hazards (rv:41.0 / rv:38.3)

  - MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx     while parsing vp9 format video

  - MFSA 2015-105/CVE-2015-4511 Buffer overflow while     decoding WebM video

  - MFSA 2015-106/CVE-2015-4509 Use-after-free while     manipulating HTML media content

  - MFSA 2015-110/CVE-2015-4519 Dragging and dropping images     exposes final URL after redirects

  - MFSA 2015-111/CVE-2015-4520 Errors in the handling of     CORS preflight request headers

  - MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522     CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177     CVE-2015-7180 Vulnerabilities found through code     inspection

More details can be found on https://www.mozilla.org/en-US/security/advisories/

The Mozilla NSPR library was updated to version 4.10.9, fixing various bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2754-1 advisory.

    Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, and     Cameron McCormack discovered multiple memory safety issues in Thunderbird. If a user were tricked in to     opening a specially crafted message, an attacker could potentially exploit these to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking     Thunderbird. (CVE-2015-4500)

    Khalil Zhani discovered a buffer overflow when parsing VP9 content in some circumstances. If a user were     tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Thunderbird. (CVE-2015-4506)

    A use-after-free was discovered when manipulating HTML media content in some circumstances. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to cause a denial of service via application crash, or execute arbitrary code with the     privileges of the user invoking Thunderbird. (CVE-2015-4509)

    Atte Kettunen discovered a buffer overflow in the nestegg library when decoding WebM format video in some     circumstances. If a user were tricked in to opening a specially crafted message, an attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Thunderbird. (CVE-2015-4511)

    Ronald Crane reported multiple vulnerabilities. If a user were tricked in to opening a specially crafted     website in a browsing context, an attacker could potentially exploit these to cause a denial of service     via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird.
    (CVE-2015-4517, CVE-2015-4521, CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176, CVE-2015-7177,     CVE-2015-7180)

    Mario Gomes discovered that dragging and dropping an image after a redirect exposes the redirected URL to     scripts. An attacker could potentially exploit this to obtain sensitive information. (CVE-2015-4519)

    Ehsan Akhgari discovered 2 issues with CORS preflight requests. An attacker could potentially exploit     these to bypass CORS restrictions. (CVE-2015-4520)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

seamonkey was updated to fix 25 security issues.

These security issues were fixed :

  - CVE-2015-4520: Mozilla Firefox before 41.0 and Firefox     ESR 38.x before 38.3 allowed remote attackers to bypass     CORS preflight protection mechanisms by leveraging (1)     duplicate cache-key generation or (2) retrieval of a     value from an incorrect HTTP Access-Control-* response     header (bsc#947003).

  - CVE-2015-4521: The ConvertDialogOptions function in     Mozilla Firefox before 41.0 and Firefox ESR 38.x before     38.3 might allowed remote attackers to cause a denial of     service (memory corruption and application crash) or     possibly have unspecified other impact via unknown     vectors (bsc#947003).

  - CVE-2015-4522: The nsUnicodeToUTF8::GetMaxLength     function in Mozilla Firefox before 41.0 and Firefox ESR     38.x before 38.3 might allowed remote attackers to cause     a denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

  - CVE-2015-4502: js/src/proxy/Proxy.cpp in Mozilla Firefox     before 41.0 mishandled certain receiver arguments, which     allowed remote attackers to bypass intended window     access restrictions via a crafted website (bsc#947003).

  - CVE-2015-4503: The TCP Socket API implementation in     Mozilla Firefox before 41.0 mishandled array boundaries     that were established with a navigator.mozTCPSocket.open     method call and send method calls, which allowed remote     TCP servers to obtain sensitive information from process     memory by reading packet data, as demonstrated by     availability of this API in a Firefox OS application     (bsc#947003).

  - CVE-2015-4500: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 41.0 and     Firefox ESR 38.x before 38.3 allowed remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via unknown vectors (bsc#947003).

  - CVE-2015-4501: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 41.0     allowed remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors (bsc#947003).

  - CVE-2015-4506: Buffer overflow in the     vp9_init_context_buffers function in libvpx, as used in     Mozilla Firefox before 41.0 and Firefox ESR 38.x before     38.3, allowed remote attackers to execute arbitrary code     via a crafted VP9 file (bsc#947003).

  - CVE-2015-4507: The SavedStacks class in the JavaScript     implementation in Mozilla Firefox before 41.0, when the     Debugger API is enabled, allowed remote attackers to     cause a denial of service (getSlotRef assertion failure     and application exit) or possibly execute arbitrary code     via a crafted website (bsc#947003).

  - CVE-2015-4504: The lut_inverse_interp16 function in the     QCMS library in Mozilla Firefox before 41.0 allowed     remote attackers to obtain sensitive information or     cause a denial of service (buffer over-read and     application crash) via crafted attributes in the ICC 4     profile of an image (bsc#947003).

  - CVE-2015-4505: updater.exe in Mozilla Firefox before     41.0 and Firefox ESR 38.x before 38.3 on Windows allowed     local users to write to arbitrary files by conducting a     junction attack and waiting for an update operation by     the Mozilla Maintenance Service (bsc#947003).

  - CVE-2015-7180: The ReadbackResultWriterD3D11::Run     function in Mozilla Firefox before 41.0 and Firefox ESR     38.x before 38.3 misinterprets the return value of a     function call, which might allowed remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly have unspecified other     impact via unknown vectors (bsc#947003).

  - CVE-2015-4509: Use-after-free vulnerability in the     HTMLVideoElement interface in Mozilla Firefox before     41.0 and Firefox ESR 38.x before 38.3 allowed remote     attackers to execute arbitrary code via crafted     JavaScript code that modifies the URI table of a media     element, aka ZDI-CAN-3176 (bsc#947003).

  - CVE-2015-7178: The ProgramBinary::linkAttributes     function in libGLES in ANGLE, as used in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 on Windows,     mishandles shader access, which allowed remote attackers     to execute arbitrary code or cause a denial of service     (memory corruption and application crash) via crafted     (1) OpenGL or (2) WebGL content (bsc#947003).

  - CVE-2015-7179: The     VertexBufferInterface::reserveVertexSpace function in     libGLES in ANGLE, as used in Mozilla Firefox before 41.0     and Firefox ESR 38.x before 38.3 on Windows, incorrectly     allocates memory for shader attribute arrays, which     allowed remote attackers to execute arbitrary code or     cause a denial of service (buffer overflow and     application crash) via crafted (1) OpenGL or (2) WebGL     content (bsc#947003).

  - CVE-2015-7176: The AnimationThread function in Mozilla     Firefox before 41.0 and Firefox ESR 38.x before 38.3     used an incorrect argument to the sscanf function, which     might allowed remote attackers to cause a denial of     service (stack-based buffer overflow and application     crash) or possibly have unspecified other impact via     unknown vectors (bsc#947003).

  - CVE-2015-7177: The InitTextures function in Mozilla     Firefox before 41.0 and Firefox ESR 38.x before 38.3     might allowed remote attackers to cause a denial of     service (memory corruption and application crash) or     possibly have unspecified other impact via unknown     vectors (bsc#947003).

  - CVE-2015-7174: The nsAttrAndChildArray::GrowBy function     in Mozilla Firefox before 41.0 and Firefox ESR 38.x     before 38.3 might allowed remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

  - CVE-2015-7175: The XULContentSinkImpl::AddText function     in Mozilla Firefox before 41.0 and Firefox ESR 38.x     before 38.3 might allowed remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

  - CVE-2015-4511: Heap-based buffer overflow in the     nestegg_track_codec_data function in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 allowed     remote attackers to execute arbitrary code via a crafted     header in a WebM video (bsc#947003).

  - CVE-2015-4510: Race condition in the     WorkerPrivate::NotifyFeatures function in Mozilla     Firefox before 41.0 allowed remote attackers to execute     arbitrary code or cause a denial of service     (use-after-free and application crash) by leveraging     improper interaction between shared workers and the     IndexedDB implementation (bsc#947003).

  - CVE-2015-4512: gfx/2d/DataSurfaceHelpers.cpp in Mozilla     Firefox before 41.0 on Linux improperly attempts to use     the Cairo library with 32-bit color-depth surface     creation followed by 16-bit color-depth surface display,     which allowed remote attackers to obtain sensitive     information from process memory or cause a denial of     service (out-of-bounds read) by using a CANVAS element     to trigger 2D rendering (bsc#947003).

  - CVE-2015-4517: NetworkUtils.cpp in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 might     allowed remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     have unspecified other impact via unknown vectors     (bsc#947003).

  - CVE-2015-4516: Mozilla Firefox before 41.0 allowed     remote attackers to bypass certain ECMAScript 5 (aka     ES5) API protection mechanisms and modify immutable     properties, and consequently execute arbitrary     JavaScript code with chrome privileges, via a crafted     web page that did not use ES5 APIs (bsc#947003).

  - CVE-2015-4519: Mozilla Firefox before 41.0 and Firefox     ESR 38.x before 38.3 allowed user-assisted remote     attackers to bypass intended access restrictions and     discover a redirect's target URL via crafted JavaScript     code that executes after a drag-and-drop action of an     image into a TEXTBOX element (bsc#947003).

MozillaThunderbird was updated to fix 17 security issues.

These security issues were fixed :

  - CVE-2015-4509: Use-after-free vulnerability in the     HTMLVideoElement interface in Mozilla Firefox before     41.0 and Firefox ESR 38.x before 38.3 allowed remote     attackers to execute arbitrary code via crafted     JavaScript code that modifies the URI table of a media     element, aka ZDI-CAN-3176 (bsc#947003).

  - CVE-2015-4520: Mozilla Firefox before 41.0 and Firefox     ESR 38.x before 38.3 allowed remote attackers to bypass     CORS preflight protection mechanisms by leveraging (1)     duplicate cache-key generation or (2) retrieval of a     value from an incorrect HTTP Access-Control-* response     header (bsc#947003).

  - CVE-2015-4521: The ConvertDialogOptions function in     Mozilla Firefox before 41.0 and Firefox ESR 38.x before     38.3 might allowed remote attackers to cause a denial of     service (memory corruption and application crash) or     possibly have unspecified other impact via unknown     vectors (bsc#947003).

  - CVE-2015-4522: The nsUnicodeToUTF8::GetMaxLength     function in Mozilla Firefox before 41.0 and Firefox ESR     38.x before 38.3 might allowed remote attackers to cause     a denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

  - CVE-2015-4500: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 41.0 and     Firefox ESR 38.x before 38.3 allowed remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via unknown vectors (bsc#947003).

  - CVE-2015-4511: Heap-based buffer overflow in the     nestegg_track_codec_data function in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 allowed     remote attackers to execute arbitrary code via a crafted     header in a WebM video (bsc#947003).

  - CVE-2015-7178: The ProgramBinary::linkAttributes     function in libGLES in ANGLE, as used in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 on Windows,     mishandles shader access, which allowed remote attackers     to execute arbitrary code or cause a denial of service     (memory corruption and application crash) via crafted     (1) OpenGL or (2) WebGL content (bsc#947003).

  - CVE-2015-7179: The     VertexBufferInterface::reserveVertexSpace function in     libGLES in ANGLE, as used in Mozilla Firefox before 41.0     and Firefox ESR 38.x before 38.3 on Windows, incorrectly     allocates memory for shader attribute arrays, which     allowed remote attackers to execute arbitrary code or     cause a denial of service (buffer overflow and     application crash) via crafted (1) OpenGL or (2) WebGL     content (bsc#947003).

  - CVE-2015-4506: Buffer overflow in the     vp9_init_context_buffers function in libvpx, as used in     Mozilla Firefox before 41.0 and Firefox ESR 38.x before     38.3, allowed remote attackers to execute arbitrary code     via a crafted VP9 file (bsc#947003).

  - CVE-2015-4517: NetworkUtils.cpp in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 might     allowed remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     have unspecified other impact via unknown vectors     (bsc#947003).

  - CVE-2015-4505: updater.exe in Mozilla Firefox before     41.0 and Firefox ESR 38.x before 38.3 on Windows allowed     local users to write to arbitrary files by conducting a     junction attack and waiting for an update operation by     the Mozilla Maintenance Service (bsc#947003).

  - CVE-2015-4519: Mozilla Firefox before 41.0 and Firefox     ESR 38.x before 38.3 allowed user-assisted remote     attackers to bypass intended access restrictions and     discover a redirect's target URL via crafted JavaScript     code that executes after a drag-and-drop action of an     image into a TEXTBOX element (bsc#947003).

  - CVE-2015-7180: The ReadbackResultWriterD3D11::Run     function in Mozilla Firefox before 41.0 and Firefox ESR     38.x before 38.3 misinterprets the return value of a     function call, which might allowed remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly have unspecified other     impact via unknown vectors (bsc#947003).

  - CVE-2015-7176: The AnimationThread function in Mozilla     Firefox before 41.0 and Firefox ESR 38.x before 38.3     used an incorrect argument to the sscanf function, which     might allowed remote attackers to cause a denial of     service (stack-based buffer overflow and application     crash) or possibly have unspecified other impact via     unknown vectors (bsc#947003).

  - CVE-2015-7177: The InitTextures function in Mozilla     Firefox before 41.0 and Firefox ESR 38.x before 38.3     might allowed remote attackers to cause a denial of     service (memory corruption and application crash) or     possibly have unspecified other impact via unknown     vectors (bsc#947003).

  - CVE-2015-7174: The nsAttrAndChildArray::GrowBy function     in Mozilla Firefox before 41.0 and Firefox ESR 38.x     before 38.3 might allowed remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

  - CVE-2015-7175: The XULContentSinkImpl::AddText function     in Mozilla Firefox before 41.0 and Firefox ESR 38.x     before 38.3 might allowed remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

MozillaFirefox was updated to Firefox 41.0 (bnc#947003)

Security issues fixed :

  - MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous     memory safety hazards

  - MFSA 2015-97/CVE-2015-4503 (bmo#994337) Memory leak in     mozTCPSocket to servers

  - MFSA 2015-98/CVE-2015-4504 (bmo#1132467) Out of bounds     read in QCMS library with ICC V4 profile attributes

  - MFSA 2015-99/CVE-2015-4476 (bmo#1162372) (Android only)     Site attribute spoofing on Android by pasting URL with     unknown scheme

  - MFSA 2015-100/CVE-2015-4505 (bmo#1177861) (Windows only)     Arbitrary file manipulation by local user through     Mozilla updater

  - MFSA 2015-101/CVE-2015-4506 (bmo#1192226) Buffer     overflow in libvpx while parsing vp9 format video

  - MFSA 2015-102/CVE-2015-4507 (bmo#1192401) Crash when     using debugger with SavedStacks in JavaScript

  - MFSA 2015-103/CVE-2015-4508 (bmo#1195976) URL spoofing     in reader mode

  - MFSA 2015-104/CVE-2015-4510 (bmo#1200004) Use-after-free     with shared workers and IndexedDB

  - MFSA 2015-105/CVE-2015-4511 (bmo#1200148) Buffer     overflow while decoding WebM video

  - MFSA 2015-106/CVE-2015-4509 (bmo#1198435) Use-after-free     while manipulating HTML media content

  - MFSA 2015-107/CVE-2015-4512 (bmo#1170390) Out-of-bounds     read during 2D canvas display on Linux 16-bit color     depth systems

  - MFSA 2015-108/CVE-2015-4502 (bmo#1105045) Scripted     proxies can access inner window

  - MFSA 2015-109/CVE-2015-4516 (bmo#904886) JavaScript     immutable property enforcement can be bypassed

  - MFSA 2015-110/CVE-2015-4519 (bmo#1189814) Dragging and     dropping images exposes final URL after redirects

  - MFSA 2015-111/CVE-2015-4520 (bmo#1200856, bmo#1200869)     Errors in the handling of CORS preflight request headers

  - MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522/     CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177/     CVE-2015-7180 Vulnerabilities found through code     inspection

  - MFSA 2015-113/CVE-2015-7178/CVE-2015-7179 (bmo#1189860,     bmo#1190526) (Windows only) Memory safety errors in     libGLES in the ANGLE graphics library

  - MFSA 2015-114 (bmo#1167498, bmo#1153672) (Windows only)     Information disclosure via the High Resolution Time API

The version of Mozilla Firefox is prior to 41.0 and is affected by multiple vulnerabilities : 

 - A flaw exists in ReadbackResultWriterD3D11::Run(). The issue is triggered as user-supplied input is not properly validated when handling return statuses. This may potentially allow a context-dependent attacker to corrupt memory and have an unspecified impact. (CVE-2015-7180) 
 - A flaw exists in InitTextures(). The issue is triggered as user-supplied input is not properly validated. This may potentially allow a context-dependent attacker to corrupt memory and have an unspecified impact. (CVE-2015-7117) 
 - An overflow condition exists in AnimationThread(). The issue is triggered as user-supplied input is not properly validated when handling sscanf arguments. This may allow a context-dependent attacker to cause a stack overflow, resulting in an unspecified impact. (CVE-2015-7176) 
 - An overflow condition exists in XULContentSinkImpl::AddText(). The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact. (CVE-2015-7175) 
 - An overflow condition exists in the nsAttrAndChildArray::GrowBy() function in 'dom/base/nsAttrAndChildArray.cpp'. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code. (CVE-2015-7174) 
 - An overflow condition exists in the nsUnicode*::GetMaxLength() functions that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code. (CVE-2015-4522) 
 - A flaw exists in ConvertDialogOptions(). The issue is triggered as user-supplied input is not properly validated. This may potentially allow a context-dependent attacker to corrupt memory and have an unspecified impact. (CVE-2015-4521) 
 - A flaw exists in NetworkUtils.cpp. The issue is triggered as user-supplied input is not properly validated. This may potentially allow a context-dependent attacker to corrupt memory and have an unspecified impact. (CVE-2015-4517) 
 - An out-of-bounds read flaw exists in 'gfx/2d/DataSurfaceHelpers.cpp' that is triggered during the rendering of 2D canvases. This may allow a context-dependent attacker to potentially disclose sensitive memory contents. (CVE-2015-4512) 
 - A flaw exists that is triggered when identical cache keys may be generated for distinct preflight requests on a site. This may potentially allow a subsequent request to bypass intended cross-origin resource sharing (CORS) checks. (CVE-2015-4520) 
 - A flaw exists that is triggered when handling images that have been "dragged and dropped" after a redirect. The redirected URL of the image may be available to scripts, potentially allowing a context-dependent attacker to gain unauthorized access to it. (CVE-2015-4519) 
 - A use-after-free error exists in 'dom/html/HTMLMediaElement.cpp' that is triggered during the handling of HTML media elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-4509) 
 - nestegg contains an overflow condition. The issue is triggered as user-supplied input is not properly validated when decoding WebM videos. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2015-4511) 
 - A flaw related to scratch register scope handling exists. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in the cloneLeftHandSide() function in 'frontend/ParseNode.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in 'memory/mozjemalloc/jemalloc.c' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in the stagefright component that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists that is triggered when handling generator function groups, as they have an improper prototype. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in the nsXBLService::GetBinding() function in 'dom/xbl/nsXBLService.cpp' that is triggered when loading bindings. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500) 
 - A flaw exists in the IndexedDB component that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4500)
 - A use-after-free error exists in 'nsIPresShell' that is triggered when handling a restyling operation during the resizing of a canvas element. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-4497)
 - A flaw exists that is triggered when handling add-on installation using 'data:' URLs. With a specially crafted web page, a context-dependent attacker can bypass the install permission prompt for add-ons and install add-ons from malicious sources. (CVE-2015-4498)

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, integer overflows, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, information disclosure or denial of service.

From Red Hat Security Advisory 2015:1834 :

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Updated 25 August 2014] This erratum previously included an incorrect list of fixed issues. The issue list has been updated to reflect the CVEs that were fixed in this update. The firefox packages provided by this advisory have not been modified in any way.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-4500, CVE-2015-4506, CVE-2015-4509, CVE-2015-4511, CVE-2015-4517, CVE-2015-4521, CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176, CVE-2015-7177, CVE-2015-7180)

Two information leak flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to disclose sensitive information or, in certain cases, crash.
(CVE-2015-4519, CVE-2015-4520)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, Cameron McCormack, Khalil Zhani, Atte Kettunen, Ronald Crane, Mario Gomes, and Ehsan Akhgari as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.3.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The version of Firefox installed on the remote Windows host is prior to 41. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory corruption issues exist due     to improper validation of user-supplied input. A remote     attacker can exploit these issues to corrupt memory and     execute arbitrary code. (CVE-2015-4500)

  - Multiple unspecified memory corruption issues exist due     to improper validation of user-supplied input. A remote     attacker can exploit these issues to corrupt memory and     execute arbitrary code. (CVE-2015-4501)

  - A flaw exists that allows scripted proxies to access the     inner window. (CVE-2015-4502)

  - An out-of-bounds read issue exists in TCPSocket.js     related to the sending of strings over TCPSocket. A     remote attacker can exploit this disclose memory     contents. (CVE-2015-4503)

  - An out-of-bounds read error exists in the QCMS color     management library that is triggered when manipulating     an image with specific attributes in its ICC V4 profile.
    A remote attacker can exploit this to cause a denial of     service condition or to disclose sensitive information.
    (CVE-2015-4504)

  - A flaw exists in the Mozilla updater that allows a local     attacker to replace arbitrary files on the system,     resulting in the execution of arbitrary code.
    (CVE-2015-4505)

  - A buffer overflow condition exists in the libvpx     component when parsing vp9 format video. A remote     attacker can exploit this, via a specially crafted vp9     format video, to execute arbitrary code. (CVE-2015-4506)

  - A flaw exists in the debugger API that is triggered when     using the debugger with SavedStacks in JavaScript. An     attacker can exploit this to cause a denial of service     condition. (CVE-2015-4507)

  - A flaw exists in reader mode that allows an attacker to     spoof the URL displayed in the address bar.
    (CVE-2015-4508)

  - A user-after-free error exists when manipulating HTML     media elements on a page during script manipulation of     the URI table of these elements. An attacker can exploit     this to cause a denial of service condition.
    (CVE-2015-4509)

  - A use-after-free error exists when using a shared worker     with IndexedDB due to a race condition with the worker.
    A remote attacker can exploit this, via specially     crafted content, to cause a denial of service condition.
    (CVE-2015-4510)

  - A buffer overflow condition exists in the nestegg     library when decoding a WebM format video with     maliciously formatted headers. An attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4511)

  - An out-of-bounds read error exists during 2D canvas     rendering due to an issue in the cairo graphics library.
    An attacker can exploit this to read random memory,     resulting in the disclosure of sensitive information.
    (CVE-2015-4512)

  - A security bypass vulnerability exists due to a flaw in     Gecko's implementation of the ECMAScript 5 API. An     attacker can exploit this to run web content in a     privileged context, resulting in the execution of     arbitrary code. (CVE-2015-4516)

  - A memory corruption issue exists in NetworkUtils.cpp. An     attacker can potentially exploit this issue to cause a     denial of service condition or to execute arbitrary     code. (CVE-2015-4517)

  - An information disclosure vulnerability exists due to a     flaw that occurs when a previously loaded image on a     page is dropped into content after a redirect, resulting     in the redirected URL being available to scripts.
    (CVE-2015-4519)

  - Multiple security bypass vulnerabilities exist due to     errors in the handling of CORS preflight request     headers. (CVE-2015-4520)

  - A memory corruption issue exists in the     ConvertDialogOptions() function. An attacker can     potentially exploit this issue to cause a denial of     service condition or to execute arbitrary code.
    (CVE-2015-4521)

  - An overflow condition exists in the GetMaxLength()     function. An attacker can potentially exploit this to     cause a denial of service condition or to execute     arbitrary code. (CVE-2015-4522)

  - An overflow condition exists in the GrowBy() function.
    An attacker can potentially exploit this to cause a     denial of service condition or to execute arbitrary     code. (CVE-2015-7174)

  - An overflow condition exists in the AddText() function.
    An attacker can potentially exploit this to cause a     denial of service condition or to execute arbitrary     code. (CVE-2015-7175)

  - A stack overflow condition exists in the     AnimationThread() function due to a bad sscanf     argument. An attacker can potentially exploit this to     cause a denial of service condition or to execute     arbitrary code. (CVE-2015-7176)

  - A memory corruption issue exists in the InitTextures()     function. An attacker can potentially exploit this issue     to cause a denial of service condition or to execute     arbitrary code. (CVE-2015-7177)

  - An out-of-bounds memory error exists in the     linkAttributes() function when manipulating shaders. An     attacker can potentially exploit this issue to cause a     denial of service condition or to execute arbitrary     code. (CVE-2015-7178)

  - An overflow condition exists in the reserveVertexSpace()     function due to an insufficient allocation of memory for     a shader attribute array. An attacker can potentially     exploit this issue to cause a denial of service     condition or to execute arbitrary code. (CVE-2015-7179)

  - A memory corruption issue exists in     ReadbackResultWriterD3D11::Run due to mishandling of the     return status. An attacker can potentially exploit this     issue to cause a denial of service condition or to     execute arbitrary code. (CVE-2015-7180)

  - An unspecified flaw exists in the nsPerformance::Now()     function in dom/base/nsPerformance.cpp that allows an     attacker to use a side-channel attack to disclose     sensitive information. (CVE-2015-7327)

The version of Firefox ESR installed on the remote Windows host is prior to 38.3. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory corruption issues exist due     to improper validation of user-supplied input. A remote     attacker can exploit these issues to corrupt memory and     execute arbitrary code. (CVE-2015-4500)

  - Multiple unspecified memory corruption issues exist due     to improper validation of user-supplied input. A remote     attacker can exploit these issues to corrupt memory and     execute arbitrary code. (CVE-2015-4501)

  - A flaw exists in the Mozilla updater that allows a local     attacker to replace arbitrary files on the system,     resulting in the execution of arbitrary code.
    (CVE-2015-4505)

  - A buffer overflow condition exists in the libvpx     component when parsing vp9 format video. A remote     attacker can exploit this, via a specially crafted vp9     format video, to execute arbitrary code. (CVE-2015-4506)

  - A user-after-free error exists when manipulating HTML     media elements on a page during script manipulation of     the URI table of these elements. An attacker can exploit     this to cause a denial of service condition.
    (CVE-2015-4509)

  - A buffer overflow condition exists in the nestegg     library when decoding a WebM format video with     maliciously formatted headers. An attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4511)

  - A memory corruption issue exists in NetworkUtils.cpp. An     attacker can potentially exploit this issue to cause a     denial of service condition or to execute arbitrary     code. (CVE-2015-4517)

  - An information disclosure vulnerability exists due to a     flaw that occurs when a previously loaded image on a     page is dropped into content after a redirect, resulting     in the redirected URL being available to scripts.
    (CVE-2015-4519)

  - Multiple security bypass vulnerabilities exist due to     errors in the handling of CORS preflight request     headers. (CVE-2015-4520)

  - A memory corruption issue exists in the     ConvertDialogOptions() function. An attacker can     potentially exploit this issue to cause a denial of     service condition or to execute arbitrary code.
    (CVE-2015-4521)

  - An overflow condition exists in the GetMaxLength()     function. An attacker can potentially exploit this to     cause a denial of service condition or to execute     arbitrary code. (CVE-2015-4522)

  - An overflow condition exists in the GrowBy() function.
    An attacker can potentially exploit this to cause a     denial of service condition or to execute arbitrary     code. (CVE-2015-7174)

  - An overflow condition exists in the AddText() function.
    An attacker can potentially exploit this to cause a     denial of service condition or to execute arbitrary     code. (CVE-2015-7175)

  - A stack overflow condition exists in the     AnimationThread() function due to a bad sscanf     argument. An attacker can potentially exploit this to     cause a denial of service condition or to execute     arbitrary code. (CVE-2015-7176)

  - A memory corruption issue exists in the InitTextures()     function. An attacker can potentially exploit this issue     to cause a denial of service condition or to execute     arbitrary code. (CVE-2015-7177)

  - An out-of-bounds memory error exists in the     linkAttributes() function when manipulating shaders. An     attacker can potentially exploit this issue to cause a     denial of service condition or to execute arbitrary     code. (CVE-2015-7178)

  - An overflow condition exists in the reserveVertexSpace()     function due to an insufficient allocation of memory for     a shader attribute array. An attacker can potentially     exploit this issue to cause a denial of service     condition or to execute arbitrary code. (CVE-2015-7179)

  - A memory corruption issue exists in     ReadbackResultWriterD3D11::Run due to mishandling of the     return status. An attacker can potentially exploit this     issue to cause a denial of service condition or to     execute arbitrary code. (CVE-2015-7180)

ID	Name	Product	Family	Severity
87063	SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2015:2081-1)	Nessus	SuSE Local Security Checks	critical
86514	CentOS 5 / 6 / 7 : firefox (CESA-2015:1834)	Nessus	CentOS Local Security Checks	high
86341	SUSE SLED11 / SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:1703-1)	Nessus	SuSE Local Security Checks	high
86307	SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nspr (SUSE-SU-2015:1680-1)	Nessus	SuSE Local Security Checks	high
86293	Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2754-1)	Nessus	Ubuntu Local Security Checks	critical
86282	openSUSE Security Update : seamonkey (openSUSE-2015-632)	Nessus	SuSE Local Security Checks	high
86281	openSUSE Security Update : MozillaThunderbird (openSUSE-2015-631)	Nessus	SuSE Local Security Checks	high
86238	openSUSE Security Update : MozillaFirefox (openSUSE-2015-619)	Nessus	SuSE Local Security Checks	high
8948	Mozilla Firefox < 41.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
86107	Debian DSA-3365-1 : iceweasel - security update	Nessus	Debian Local Security Checks	high
86099	RHEL 5 / 6 / 7 : firefox (RHSA-2015:1834)	Nessus	Red Hat Local Security Checks	high
86096	Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1834)	Nessus	Oracle Linux Local Security Checks	high
86071	Firefox < 41 Multiple Vulnerabilities	Nessus	Windows	high
86070	Firefox ESR < 38.3 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-4511

critical

Tenable Plugins

critical

high

high

high

critical

high

high

high

critical

high

high

high

high

high