The Updater in Mozilla Firefox before 48.0 on Windows allows local users to write to arbitrary files via vectors involving the callback application-path parameter and a hard link.

The remote host is affected by the vulnerability described in GLSA-201701-15 (Mozilla Firefox, Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition via       multiple vectors.
  Workaround :

    There is no known workaround at this time.

Mozilla Foundation reports :

Please reference CVE/URL list for details

Versions of Mozilla Firefox prior to 48.0 are unpatched for the following vulnerabilities :

 - A flaw is triggered as certain input is not properly validated when handling the 'BitmapInfoHeader' in icons. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/frontend/Parser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::array_splice_impl()' function in 'js/src/jsarray.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw is triggered as certain unspecified user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'OSXNotificationCenter::ShowAlertWithIconData()' function in 'widget/cocoa/OSXNotificationCenter.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Http2Session::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/Http2Session.cpp' and 'SpdySession31::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/SpdySession31.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in the 'Assembler::bind()' function in 'js/src/jit/arm/Assembler-arm.cpp' that is triggered when handling certain labels. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CodeGeneratorShared::assignBailoutId()' function in 'js/src/jit/shared/CodeGenerator-shared.cpp' that is triggered when handling allocation errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in 'woff2_dec.cc' that is triggered as certain input is not properly validated when decompressing files. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'SetPaintPattern()' function in 'gfx/2d/DrawTargetSkia.cpp' that is triggered when handling gradients with non-finite endpoints. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'PeerConnectionMedia::ProtocolProxyQueryHandler::OnProxyAvailable()' function in 'media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'media/mtransport/nr_timer.cpp' that is triggered when handling timers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A race condition exists in the 'MatchKeyHash()' function in 'security/pkix/lib/pkixocsp.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'ClearKeyDecryptor::Decrypt()' function in 'media/gmp-clearkey/0.1/ClearKeyDecryptionManager.cpp' used by the Encrypted Media Extensions (EME) API. The issue is triggered as user-supplied input is not properly validated when handling video files. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw is triggered as file URIs dragged from a web page to a different piece of software failed to have the contents properly filtered. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw is triggered when handling right-to-left character sets with left-to-right character sets. This may allow a context-dependent attacker to spoof the address bar.
 - A flaw is triggered when handling certain specific 'about:' URLs. This may allow a context-dependent attacker to spoof the contents of system information or error messages.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' due to the program leaking potentially sensitive resources of URLs through the Resource Timing API during page navigation. This may allow a context-dependent attacker to potentially disclose sensitive information.
 - An integer overflow condition exists in the 'WebSocketChannel::ProcessInput()' function in 'netwerk/protocol/websocket/WebSocketChannel.cpp'. The issue is triggered as user-supplied input is not properly validated when handling specially crafted 'WebSocketChannel' packets. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::NativeAnonymousChildListChange()' function. The issue is triggered when applying effects to SVG element. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'js::PreliminaryObjectArray::sweep()' function in JavaScript. The issue is triggered when handling objects and pointers during incremental garbage collection. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'WebRTC'. The issue is triggered when handling DTLS objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the r'estorableFormNodes()' function in 'toolkit/modules/sessionstore/XPathGenerator.jsm' that is due to the program persistently storing passwords in in plaintext in session restore data. This may allow a context-dependent attacker to potentially gain access to password information.
 - A use-after-free error exists in the 'WorkerPrivate::DestroySyncLoop()' function in 'dom/workers/WorkerPrivate.cpp'. The issue is triggered when handling nested sync event loops in Service Workers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'nsDisplayList::HitTest()' function in 'layout/base/nsDisplayList.cpp' that is triggered during the handling of display transformations. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'nsBaseChannel::Redirect()' function in 'netwerk/base/nsBaseChannel.cpp' that is triggered when a malicious shortcut is called from the same directory as a local HTML file. This may allow a local attacker to bypass the same-origin policy.
 - An underflow condition exists in the 'mozilla::gfx::BasePoint4d()' function in 'gfx/2d/Matrix.h'. The issue is triggered as user-supplied input is not properly validated when calculating clipping regions in 2D graphics. This may allow a context-dependent attacker to cause a stack buffer underflow, potentially allowing the execution of arbitrary code.
 - An overflow condition exists in the 'nsBidi::BracketData::ProcessPDI()' function in 'layout/base/nsBidi.cpp'. The issue is triggered as user-supplied input is not properly validated when rendering SVG format graphics with directional content. This may allow a context-dependent attacker to cause a heap-based buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'Cairo' graphics layer that is triggered when allocating the 'LibAV' header during video decoding. This may allow a context-dependent attacker to crash the Cairo graphics layer.
 - A flaw is due to event handler attributes on a 'marquee' tag being executed inside a sandboxed iframe that does not have the allow-scripts flag set. This may allow a context-dependent attacker to bypass XSS protection mechanisms.
 - A flaw is due to the program failing to close connections after requesting favicons. This may allow a context-dependent attacker to continue to send requests to the user's browser and gain access to potentially sensitive information.
 - A use-after-free error exists in the 'nsXULPopupManager::KeyDown()' function in 'layout/xul/nsXULPopupManager.cpp'. The issue is triggered when using the alt key in conjunction with top level menu items in Firefox. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw is triggered when decoding url-encoded values in 'data:' URLs. This may allow a context-dependent attacker to use non-ASCII or emoji characters to spoof the address bar.
 - A flaw exists in 'toolkit/mozapps/update/updater/updater.cpp' that is due to the 'Updater', when opened using the callback application path parameter, creating a copy of a user specified file as a callback file with a locked hardlink. This may allow a local attacker to run the target file and gain elevated privileges.
 - An unspecified flaw exists that is triggered during the handling of TTC detection. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided.
 - An out-of-bounds access flaw exists in the 'ReconstructTransformedHmtx()' function in 'woff2_dec.cc' that may allow a context-dependent attacker to have an unspecified impact.
 - An unspecified flaw exists in 'woff2_dec.cc' that may allow a context-dependent attacker to have an unspecified impact.
 - An unspecified flaw exists in 'woff2_dec.cc' that is triggered during memory allocation, which may allow a context-dependent attacker to crash a process linked against the library.

The version of Firefox installed on the remote Windows host is prior to 48. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists in the expat XML parser due     to improper validation of user-supplied input when     handling malformed input documents. An attacker can     exploit this to cause a buffer overflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-0718)

  - An information disclosure vulnerability exists due to a     failure to close connections after requesting favicons.
    An attacker can exploit this to continue to send     requests to the user's browser and disclose sensitive     information.(CVE-2016-2830)

  - Multiple memory corruption issues exist due to improper     validation of user-supplied input. An attacker can     exploit these issues to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-2835, CVE-2016-2836)

  - An overflow condition exists in the ClearKey Content     Decryption Module (CDM) used by the Encrypted Media     Extensions (EME) API due to improper validation of     user-supplied input. An attacker can exploit this to     cause a buffer overflow, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-2837)

  - An overflow condition exists in the ProcessPDI()     function in layout/base/nsBidi.cpp due to improper     validation of user-supplied input. An attacker can     exploit this to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-2838)

  - A flaw exists in the Resource Timing API during page     navigation. An attacker can exploit this to disclose     sensitive information. (CVE-2016-5250)

  - A flaw exists that is triggered when decoding     url-encoded values in 'data:' URLs. An attacker can     exploit this, via non-ASCII or emoji characters, to     spoof the address in the address bar. (CVE-2016-5251)

  - An underflow condition exists in the BasePoint4d()     function in gfx/2d/Matrix.h due to improper validation     of user-supplied input when calculating clipping regions     in 2D graphics. A remote attacker can exploit this to     cause a stack-based buffer underflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-5252)

  - A flaw in the updater service exists when launched using     the callback application path parameter that allows an     attacker to escalate privileges. (CVE-2016-5253)

  - A use-after-free error exists in the KeyDown() function     in layout/xul/nsXULPopupManager.cpp when using the alt     key in conjunction with top level menu items. An     attacker can exploit this to dereference already freed     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2016-5254)

  - A use-after-free error exists in the sweep() function     that is triggered when handling objects and pointers     during incremental garbage collection. An attacker can     exploit this to dereference already freed memory,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-5255)

  - A use-after-free error exists in WebRTC that is     triggered when handling DTLS objects. An attacker can     exploit this to dereference already freed memory,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-5258)

  - A use-after-free error exists in the DestroySyncLoop()     function in dom/workers/WorkerPrivate.cpp that is     triggered when handling nested sync event loops in     Service Workers. An attacker can exploit this to     dereference already freed memory, resulting in a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-5259)

  - An information disclosure vulnerability exists in the     restorableFormNodes() function in XPathGenerator.jsm due     to persistently storing passwords in plaintext in     session restore data. An attacker can exploit this to     disclose password information. (CVE-2016-5260)

  - An integer overflow condition exists in the     ProcessInput() function in WebSocketChannel.cpp due to     improper validation of user-supplied input when handling     specially crafted WebSocketChannel packets. An attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5261)

  - A security bypass vulnerability exists due to event     handler attributes on a <marquee> tag being executed     inside a sandboxed iframe that does not have the     allow-scripts flag set. An attacker can exploit this to     bypass cross-site scripting protection mechanisms.
    (CVE-2016-5262)

  - A type confusion flaw exists in the HitTest() function     in nsDisplayList.cpp when handling display     transformations. An attacker can exploit this to execute     arbitrary code. (CVE-2016-5263)

  - A use-after-free error exists in the     NativeAnonymousChildListChange() function when applying     effects to SVG elements. An attacker can exploit this to     dereference already freed memory, resulting in a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-5264)

  - A flaw exists in the Redirect() function in     nsBaseChannel.cpp that is triggered when a malicious     shortcut is called from the same directory as a local     HTML file. An attacker can exploit this to bypass the     same-origin policy. (CVE-2016-5265)

  - A flaw exists due to a failure to properly filter file     URIs dragged from a web page to a different piece of     software. An attacker can exploit this to disclose     sensitive information. (CVE-2016-5266)

  - A flaw exists that is triggered when handling certain     specific 'about:' URLs that allows an attacker to spoof     the contents of system information or error messages     (CVE-2016-5268)

  - A flaw exists in woff2 that is triggered during the     handling of TTC detection. An attacker can exploit this     to have an unspecified impact.

  - Multiple unspecified flaws exist in woff2 that allow an     attacker to cause a denial of service condition.

ID	Name	Product	Family	Severity
96276	GLSA-201701-15 : Mozilla Firefox, Thunderbird: Multiple vulnerabilities (SWEET32)	Nessus	Gentoo Local Security Checks	critical
93429	FreeBSD : Mozilla -- multiple vulnerabilities (aa1aefe3-6e37-47db-bfda-343ef4acb1b5)	Nessus	FreeBSD Local Security Checks	critical
9484	Mozilla Firefox < 48.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
92755	Firefox < 48 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-5253

medium

Tenable Plugins

critical

critical

medium

high