Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site, a similar issue to CVE-2016-1780.

The remote host is affected by the vulnerability described in GLSA-201701-15 (Mozilla Firefox, Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition via       multiple vectors.
  Workaround :

    There is no known workaround at this time.

This update to Mozilla Firefox 46.0 fixes several security issues and bugs (boo#977333).

The following vulnerabilities were fixed :

  - CVE-2016-2804: Miscellaneous memory safety hazards -     MFSA 2016-39 (boo#977373)

  - CVE-2016-2806: Miscellaneous memory safety hazards -     MFSA 2016-39 (boo#977375)

  - CVE-2016-2807: Miscellaneous memory safety hazards -     MFSA 2016-39 (boo#977376)

  - CVE-2016-2808: Write to invalid HashMap entry through     JavaScript.watch()

  - MFSA 2016-47 (boo#977386)

  - CVE-2016-2811: Use-after-free in Service Worker - MFSA     2016-42 (boo#977379)

  - CVE-2016-2812: Buffer overflow in Service Worker - MFSA     2016-42 (boo#977379)

  - CVE-2016-2814: Buffer overflow in libstagefright with     CENC offsets - MFSA 2016-44 (boo#977381)

  - CVE-2016-2816: CSP not applied to pages sent with     multipart/x-mixed-replace - MFSA 2016-45 (boo#977382)

  - CVE-2016-2817: Elevation of privilege with     chrome.tabs.update API in web extensions - MFSA 2016-46     (boo#977384)

  - CVE-2016-2820: Firefox Health Reports could accept     events from untrusted domains - MFSA 2016-48     (boo#977388)

    The following miscellaneous changes are included :

  - Improved security of the JavaScript Just In Time (JIT)     Compiler

  - WebRTC fixes to improve performance and stability

  - Added support for document.elementsFromPoint

  - Added HKDF support for Web Crypto API

The minimum requirements increased to NSPR 4.12 and NSS 3.22.3.

Mozilla NSS was updated to 3.22.3 as a dependency for Mozilla Firefox 46.0, with the following changes :

  - Increase compatibility of TLS extended master secret,     don't send an empty TLS extension last in the handshake     (bmo#1243641)

  - RSA-PSS signatures are now supported

  - Pseudorandom functions based on hashes other than SHA-1     are now supported

  - Enforce an External Policy on NSS from a config file

ID	Name	Product	Family	Severity
96276	GLSA-201701-15 : Mozilla Firefox, Thunderbird: Multiple vulnerabilities (SWEET32)	Nessus	Gentoo Local Security Checks	critical
91069	openSUSE Security Update : Firefox 46.0 (openSUSE-2016-566) (SWEET32)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-2813

medium

Tenable Plugins

critical

high