Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Mozilla Firefox before 48.0 allows remote attackers to     obtain sensitive information about the previously     retrieved page via Resource Timing API     calls.(CVE-2016-5250)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 49.0 and Firefox ESR     45.x before 45.4 allow remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unknown     vectors.(CVE-2016-5257)

  - Integer overflow in the WebSocketChannel class in the     WebSockets subsystem in Mozilla Firefox before 48.0     allows remote attackers to execute arbitrary code or     cause a denial of service (memory corruption) via     crafted packets that trigger incorrect buffer-resize     operations during buffering.(CVE-2016-5261)

  - Heap-based buffer overflow in the     nsCaseTransformTextRunFactory::TransformString function     in Mozilla Firefox before 49.0 and Firefox ESR 45.x     before 45.4 allows remote attackers to cause a denial     of service (boolean out-of-bounds write) or possibly     have unspecified other impact via Unicode characters     that are mishandled during text     conversion.(CVE-2016-5270)

  - The nsImageGeometryMixin class in Mozilla Firefox     before 49.0 and Firefox ESR 45.x before 45.4 does not     properly perform a cast of an unspecified variable     during handling of INPUT elements, which allows remote     attackers to execute arbitrary code via a crafted web     site.(CVE-2016-5272)

  - Use-after-free vulnerability in the     nsFrameManager::CaptureFrameState function in Mozilla     Firefox before 49.0 and Firefox ESR 45.x before 45.4     allows remote attackers to execute arbitrary code by     leveraging improper interaction between restyling and     the Web Animations model implementation.(CVE-2016-5274)

  - Use-after-free vulnerability in the     mozilla::a11y::DocAccessible::ProcessInvalidationList     function in Mozilla Firefox before 49.0 and Firefox ESR     45.x before 45.4 allows remote attackers to execute     arbitrary code or cause a denial of service (heap     memory corruption) via an aria-owns     attribute.(CVE-2016-5276)

  - Use-after-free vulnerability in the     nsRefreshDriver::Tick function in Mozilla Firefox     before 49.0 and Firefox ESR 45.x before 45.4 allows     remote attackers to execute arbitrary code or cause a     denial of service (heap memory corruption) by     leveraging improper interaction between timeline     destruction and the Web Animations model     implementation.(CVE-2016-5277)

  - Heap-based buffer overflow in the     nsBMPEncoder::AddImageFrame function in Mozilla Firefox     before 49.0 and Firefox ESR 45.x before 45.4 allows     remote attackers to execute arbitrary code via a     crafted image data that is mishandled during the     encoding of an image frame to an image.(CVE-2016-5278)

  - Use-after-free vulnerability in the     mozilla::nsTextNodeDirectionalityMap::RemoveElementFrom     Map function in Mozilla Firefox before 49.0 and Firefox     ESR 45.x before 45.4 allows remote attackers to execute     arbitrary code via bidirectional text.(CVE-2016-5280)

  - Use-after-free vulnerability in the DOMSVGLength class     in Mozilla Firefox before 49.0 and Firefox ESR 45.x     before 45.4 allows remote attackers to execute     arbitrary code by leveraging improper interaction     between JavaScript code and an SVG     document.(CVE-2016-5281)

  - Mozilla Firefox before 49.0 and Firefox ESR 45.x before     45.4 rely on unintended expiration dates for Preloaded     Public Key Pinning, which allows man-in-the-middle     attackers to spoof add-on updates by leveraging     possession of an X.509 server certificate for     addons.mozilla.org signed by an arbitrary built-in     Certification Authority.(CVE-2016-5284)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-15 (Mozilla Firefox, Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition via       multiple vectors.
  Workaround :

    There is no known workaround at this time.

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors may lead to the execution of arbitrary code or denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 45.4.0-1~deb7u1.

We recommend that you upgrade your icedove packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox was updated to 45.4.0 ESR to fix the following issues (bsc#999701): The following security issue were fixed :

  - MFSA 2016-86/CVE-2016-5270: Heap-buffer-overflow in     nsCaseTransformTextRunFactory::TransformString

  - MFSA 2016-86/CVE-2016-5272: Bad cast in     nsImageGeometryMixin

  - MFSA 2016-86/CVE-2016-5276: Heap-use-after-free in     mozilla::a11y::DocAccessible::ProcessInvalidationList

  - MFSA 2016-86/CVE-2016-5274: use-after-free in     nsFrameManager::CaptureFrameState

  - MFSA 2016-86/CVE-2016-5277: Heap-use-after-free in     nsRefreshDriver::Tick

  - MFSA 2016-86/CVE-2016-5278: Heap-buffer-overflow in     nsBMPEncoder::AddImageFrame

  - MFSA 2016-86/CVE-2016-5280: Use-after-free in     mozilla::nsTextNodeDirectionalityMap::RemoveElementFromM     ap

  - MFSA 2016-86/CVE-2016-5281: use-after-free in     DOMSVGLength

  - MFSA 2016-86/CVE-2016-5284: Add-on update site     certificate pin expiration

  - MFSA 2016-86/CVE-2016-5250: Resource Timing API is     storing resources sent by the previous page

  - MFSA 2016-86/CVE-2016-5261: Integer overflow and memory     corruption in WebSocketChannel

  - MFSA 2016-86/CVE-2016-5257: Various memory safety bugs     fixed in Firefox 49 and Firefox ESR 45.4

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox was updated to version 45.4.0 ESR to fix the following issues: Security issues fixed: (bsc#999701 MFSA 2016-86) :

  - CVE-2016-5270: Heap-buffer-overflow in     nsCaseTransformTextRunFactory::TransformString

  - CVE-2016-5272: Bad cast in nsImageGeometryMixin

  - CVE-2016-5276: Heap-use-after-free in     mozilla::a11y::DocAccessible::ProcessInvalidationList

  - CVE-2016-5274: use-after-free in     nsFrameManager::CaptureFrameState

  - CVE-2016-5277: Heap-use-after-free in     nsRefreshDriver::Tick

  - CVE-2016-5278: Heap-buffer-overflow in     nsBMPEncoder::AddImageFrame

  - CVE-2016-5280: Use-after-free in     mozilla::nsTextNodeDirectionalityMap::RemoveElementFromM     ap

  - CVE-2016-5281: use-after-free in DOMSVGLength

  - CVE-2016-5284: Add-on update site certificate pin     expiration

  - CVE-2016-5250: Resource Timing API is storing resources     sent by the previous page

  - CVE-2016-5261: Integer overflow and memory corruption in     WebSocketChannel

  - CVE-2016-5257: Memory safety bugs fixed in Firefox 49     and Firefox ESR 45.4 Bug fixed :

  - Fix for aarch64 Firefox startup crash (bsc#991344)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or information disclosure.

An update for firefox is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 45.4.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-5257, CVE-2016-5278, CVE-2016-5270, CVE-2016-5272, CVE-2016-5274, CVE-2016-5276, CVE-2016-5277, CVE-2016-5280, CVE-2016-5281, CVE-2016-5284, CVE-2016-5250, CVE-2016-5261)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Samuel Gross, Brian Carpenter, Mei Wang, Ryan Duff, Catalin Dumitru, Mozilla developers, Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, Carsten Book, Abhishek Arya, Atte Kettunen, and Nils as the original reporters.

The version of Mozilla Firefox ESR installed on the remote Windows host is 45.x prior to 45.4. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the HttpBaseChannel::GetPerformance()     function in netwerk/protocol/http/HttpBaseChannel.cpp     due to the program leaking potentially sensitive     resources of URLs through the Resource Timing API     during page navigation. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information. (CVE-2016-5250)

  - Multiple memory safety issues exist that allow an     unauthenticated, remote attacker to potentially execute     arbitrary code. (CVE-2016-5257)

  - An integer overflow condition exists in the     WebSocketChannel::ProcessInput() function within file     netwerk/protocol/websocket/WebSocketChannel.cpp when     handling specially crafted WebSocketChannel packets due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-5261)

  - A heap buffer overflow condition exists in the     nsCaseTransformTextRunFactory::TransformString()     function in layout/generic/nsTextRunTransformations.cpp     when converting text containing certain Unicode     characters. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2016-5270)

  - A type confusion error exists within file     layout/forms/nsRangeFrame.cpp when handling layout with     input elements. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2016-5272)

  - A use-after-free error exists within file     layout/style/nsRuleNode.cpp when handling web animations     during restyling. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5274)

  - A use-after-free error exists in the     DocAccessible::ProcessInvalidationList() function within     file accessible/generic/DocAccessible.cpp when setting     an aria-owns attribute. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2016-5276)

  - A use-after-free error exists in the     nsRefreshDriver::Tick() function when handling web     animations destroying a timeline. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code. (CVE-2016-5277)

  - A buffer overflow condition exists in the     nsBMPEncoder::AddImageFrame() function within file     dom/base/ImageEncoder.cpp when encoding image frames to     images. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2016-5278)

  - A use-after-free error exists in the     nsTextNodeDirectionalityMap::RemoveElementFromMap()     function within file dom/base/DirectionalityUtils.cpp     when handling changing of text direction. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-5280)

  - A use-after-free error exists when handling SVG format     content that is being manipulated through script code.
    An unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-5281)

  - A flaw exists due to the certificate pinning policy for     built-in sites (e.g., addons.mozilla.org) not being     honored when pins have expired. A man-in-the-middle     (MitM) attacker can exploit this to generate a trusted     certificate, which could be used to conduct spoofing     attacks. (CVE-2016-5284)

The version of Mozilla Firefox ESR installed on the remote Mac OS X host is 45.x prior to 45.4. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the HttpBaseChannel::GetPerformance()     function in netwerk/protocol/http/HttpBaseChannel.cpp     due to the program leaking potentially sensitive     resources of URLs through the Resource Timing API     during page navigation. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information. (CVE-2016-5250)

  - Multiple memory safety issues exist that allow an     unauthenticated, remote attacker to potentially execute     arbitrary code. (CVE-2016-5257)

  - An integer overflow condition exists in the     WebSocketChannel::ProcessInput() function within file     netwerk/protocol/websocket/WebSocketChannel.cpp when     handling specially crafted WebSocketChannel packets due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-5261)

  - A heap buffer overflow condition exists in the     nsCaseTransformTextRunFactory::TransformString()     function in layout/generic/nsTextRunTransformations.cpp     when converting text containing certain Unicode     characters. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2016-5270)

  - A type confusion error exists within file     layout/forms/nsRangeFrame.cpp when handling layout with     input elements. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2016-5272)

  - A use-after-free error exists within file     layout/style/nsRuleNode.cpp when handling web animations     during restyling. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5274)

  - A use-after-free error exists in the     DocAccessible::ProcessInvalidationList() function within     file accessible/generic/DocAccessible.cpp when setting     an aria-owns attribute. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2016-5276)

  - A use-after-free error exists in the     nsRefreshDriver::Tick() function when handling web     animations destroying a timeline. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code. (CVE-2016-5277)

  - A buffer overflow condition exists in the     nsBMPEncoder::AddImageFrame() function within file     dom/base/ImageEncoder.cpp when encoding image frames to     images. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2016-5278)

  - A use-after-free error exists in the     nsTextNodeDirectionalityMap::RemoveElementFromMap()     function within file dom/base/DirectionalityUtils.cpp     when handling changing of text direction. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-5280)

  - A use-after-free error exists when handling SVG format     content that is being manipulated through script code.
    An unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-5281)

  - A flaw exists due to the certificate pinning policy for     built-in sites (e.g., addons.mozilla.org) not being     honored when pins have expired. A man-in-the-middle     (MitM) attacker can exploit this to generate a trusted     certificate, which could be used to conduct spoofing     attacks. (CVE-2016-5284)

This update upgrades Firefox to version 45.4.0 ESR.

Security Fix(es) :

  - Multiple flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Firefox to crash or, potentially, execute     arbitrary code with the privileges of the user running     Firefox. (CVE-2016-5257, CVE-2016-5278, CVE-2016-5270,     CVE-2016-5272, CVE-2016-5274, CVE-2016-5276,     CVE-2016-5277, CVE-2016-5280, CVE-2016-5281,     CVE-2016-5284, CVE-2016-5250, CVE-2016-5261)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-1912 advisory.

    [45.4.0-1.0.1]
    - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html       and remove the corresponding Red Hat files

    [45.4.0-1]
    - Update to 45.4.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Foundation reports :

Please reference CVE/URL list for details

Versions of Mozilla Firefox prior to 48.0 are unpatched for the following vulnerabilities :

 - A flaw is triggered as certain input is not properly validated when handling the 'BitmapInfoHeader' in icons. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/frontend/Parser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::array_splice_impl()' function in 'js/src/jsarray.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw is triggered as certain unspecified user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'OSXNotificationCenter::ShowAlertWithIconData()' function in 'widget/cocoa/OSXNotificationCenter.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Http2Session::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/Http2Session.cpp' and 'SpdySession31::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/SpdySession31.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in the 'Assembler::bind()' function in 'js/src/jit/arm/Assembler-arm.cpp' that is triggered when handling certain labels. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CodeGeneratorShared::assignBailoutId()' function in 'js/src/jit/shared/CodeGenerator-shared.cpp' that is triggered when handling allocation errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in 'woff2_dec.cc' that is triggered as certain input is not properly validated when decompressing files. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'SetPaintPattern()' function in 'gfx/2d/DrawTargetSkia.cpp' that is triggered when handling gradients with non-finite endpoints. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'PeerConnectionMedia::ProtocolProxyQueryHandler::OnProxyAvailable()' function in 'media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'media/mtransport/nr_timer.cpp' that is triggered when handling timers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A race condition exists in the 'MatchKeyHash()' function in 'security/pkix/lib/pkixocsp.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'ClearKeyDecryptor::Decrypt()' function in 'media/gmp-clearkey/0.1/ClearKeyDecryptionManager.cpp' used by the Encrypted Media Extensions (EME) API. The issue is triggered as user-supplied input is not properly validated when handling video files. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw is triggered as file URIs dragged from a web page to a different piece of software failed to have the contents properly filtered. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw is triggered when handling right-to-left character sets with left-to-right character sets. This may allow a context-dependent attacker to spoof the address bar.
 - A flaw is triggered when handling certain specific 'about:' URLs. This may allow a context-dependent attacker to spoof the contents of system information or error messages.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' due to the program leaking potentially sensitive resources of URLs through the Resource Timing API during page navigation. This may allow a context-dependent attacker to potentially disclose sensitive information.
 - An integer overflow condition exists in the 'WebSocketChannel::ProcessInput()' function in 'netwerk/protocol/websocket/WebSocketChannel.cpp'. The issue is triggered as user-supplied input is not properly validated when handling specially crafted 'WebSocketChannel' packets. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::NativeAnonymousChildListChange()' function. The issue is triggered when applying effects to SVG element. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'js::PreliminaryObjectArray::sweep()' function in JavaScript. The issue is triggered when handling objects and pointers during incremental garbage collection. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'WebRTC'. The issue is triggered when handling DTLS objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the r'estorableFormNodes()' function in 'toolkit/modules/sessionstore/XPathGenerator.jsm' that is due to the program persistently storing passwords in in plaintext in session restore data. This may allow a context-dependent attacker to potentially gain access to password information.
 - A use-after-free error exists in the 'WorkerPrivate::DestroySyncLoop()' function in 'dom/workers/WorkerPrivate.cpp'. The issue is triggered when handling nested sync event loops in Service Workers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'nsDisplayList::HitTest()' function in 'layout/base/nsDisplayList.cpp' that is triggered during the handling of display transformations. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'nsBaseChannel::Redirect()' function in 'netwerk/base/nsBaseChannel.cpp' that is triggered when a malicious shortcut is called from the same directory as a local HTML file. This may allow a local attacker to bypass the same-origin policy.
 - An underflow condition exists in the 'mozilla::gfx::BasePoint4d()' function in 'gfx/2d/Matrix.h'. The issue is triggered as user-supplied input is not properly validated when calculating clipping regions in 2D graphics. This may allow a context-dependent attacker to cause a stack buffer underflow, potentially allowing the execution of arbitrary code.
 - An overflow condition exists in the 'nsBidi::BracketData::ProcessPDI()' function in 'layout/base/nsBidi.cpp'. The issue is triggered as user-supplied input is not properly validated when rendering SVG format graphics with directional content. This may allow a context-dependent attacker to cause a heap-based buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'Cairo' graphics layer that is triggered when allocating the 'LibAV' header during video decoding. This may allow a context-dependent attacker to crash the Cairo graphics layer.
 - A flaw is due to event handler attributes on a 'marquee' tag being executed inside a sandboxed iframe that does not have the allow-scripts flag set. This may allow a context-dependent attacker to bypass XSS protection mechanisms.
 - A flaw is due to the program failing to close connections after requesting favicons. This may allow a context-dependent attacker to continue to send requests to the user's browser and gain access to potentially sensitive information.
 - A use-after-free error exists in the 'nsXULPopupManager::KeyDown()' function in 'layout/xul/nsXULPopupManager.cpp'. The issue is triggered when using the alt key in conjunction with top level menu items in Firefox. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw is triggered when decoding url-encoded values in 'data:' URLs. This may allow a context-dependent attacker to use non-ASCII or emoji characters to spoof the address bar.
 - A flaw exists in 'toolkit/mozapps/update/updater/updater.cpp' that is due to the 'Updater', when opened using the callback application path parameter, creating a copy of a user specified file as a callback file with a locked hardlink. This may allow a local attacker to run the target file and gain elevated privileges.
 - An unspecified flaw exists that is triggered during the handling of TTC detection. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided.
 - An out-of-bounds access flaw exists in the 'ReconstructTransformedHmtx()' function in 'woff2_dec.cc' that may allow a context-dependent attacker to have an unspecified impact.
 - An unspecified flaw exists in 'woff2_dec.cc' that may allow a context-dependent attacker to have an unspecified impact.
 - An unspecified flaw exists in 'woff2_dec.cc' that is triggered during memory allocation, which may allow a context-dependent attacker to crash a process linked against the library.

Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements.

The following major changes are included :

  - Process separation (e10s) is enabled for some users

  - Add-ons that have not been verified and signed by     Mozilla will not load

  - WebRTC enhancements

  - The media parser has been redeveloped using the Rust     programming language

  - better Canvas performance with speedy Skia support

  - Now requires NSS 3.24

The following security issues were fixed: (boo#991809)

  - CVE-2016-2835/CVE-2016-2836: Miscellaneous memory safety     hazards

  - CVE-2016-2830: Favicon network connection can persist     when page is closed

  - CVE-2016-2838: Buffer overflow rendering SVG with     bidirectional content

  - CVE-2016-2839: Cairo rendering crash due to memory     allocation issue with FFmpeg 0.10

  - CVE-2016-5251: Location bar spoofing via data URLs with     malformed/invalid mediatypes

  - CVE-2016-5252: Stack underflow during 2D graphics     rendering

  - CVE-2016-0718: Out-of-bounds read during XML parsing in     Expat library

  - CVE-2016-5254: Use-after-free when using alt key and     toplevel menus

  - CVE-2016-5255: Crash in incremental garbage collection     in JavaScript

  - CVE-2016-5258: Use-after-free in DTLS during WebRTC     session shutdown

  - CVE-2016-5259: Use-after-free in service workers with     nested sync events

  - CVE-2016-5260: Form input type change from password to     text can store plain text password in session restore     file

  - CVE-2016-5261: Integer overflow in WebSockets during     data buffering

  - CVE-2016-5262: Scripts on marquee tag can execute in     sandboxed iframes

  - CVE-2016-2837: Buffer overflow in ClearKey Content     Decryption Module (CDM) during video playback

  - CVE-2016-5263: Type confusion in display transformation

  - CVE-2016-5264: Use-after-free when applying SVG effects

  - CVE-2016-5265: Same-origin policy violation using local     HTML file and saved shortcut file

  - CVE-2016-5266: Information disclosure and local file     manipulation through drag and drop

  - CVE-2016-5268: Spoofing attack through text injection     into internal error pages

  - CVE-2016-5250: Information disclosure through Resource     Timing API during page navigation

The following non-security changes are included :

  - The AppData description and screenshots were updated.

  - Fix Firefox crash on startup on i586 (boo#986541)

  - The Selenium WebDriver may have caused Firefox to crash     at startup

  - fix build issues with gcc/binutils combination used in     Leap 42.2 (boo#984637)

  - Fix running on 48bit va aarch64 (boo#984126)

  - fix XUL dialog button order under KDE session     (boo#984403)

Mozilla NSS was updated to 3.24 as a dependency.

Changes in mozilla-nss :

  - NSS softoken updated with latest NIST guidance

  - NSS softoken updated to allow NSS to run in FIPS Level 1     (no password)

  - Various added and deprecated functions 

  - Remove most code related to SSL v2, including the     ability to actively send a SSLv2-compatible client     hello.

  - Protect against the Cachebleed attack.

  - Disable support for DTLS compression.

  - Improve support for TLS 1.3. This includes support for     DTLS 1.3. (experimental)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3044-1 advisory.

    Gustavo Grieco discovered an out-of-bounds read during XML parsing in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or obtain sensitive information. (CVE-2016-0718)

    Toni Huttunen discovered that once a favicon is requested from a site, the remote server can keep the     network connection open even after the page is closed. A remote attacked could potentially exploit this to     track users, resulting in information disclosure. (CVE-2016-2830)

    Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, Julian Seward, Carsten Book, Gary Kwong, Jesse     Ruderman, Andrew McCreight, and Phil Ringnalda discovered multiple memory safety issues in Firefox. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit these     to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2835,     CVE-2016-2836)

    A buffer overflow was discovered in the ClearKey Content Decryption Module (CDM) during video playback. If     a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this     to cause a denial of service via plugin process crash, or, in combination with another vulnerability to     escape the GMP sandbox, execute arbitrary code. (CVE-2016-2837)

    Atte Kettunen discovered a buffer overflow when rendering SVG content in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2838)

    Bert Massop discovered a crash in Cairo with version 0.10 of FFmpeg. If a user were tricked in to opening     a specially crafted website, an attacker could potentially exploit this to execute arbitrary code.
    (CVE-2016-2839)

    Catalin Dumitru discovered that URLs of resources loaded after a navigation start could be leaked to the     following page via the Resource Timing API. An attacker could potentially exploit this to obtain sensitive     information. (CVE-2016-5250)

    Firas Salem discovered an issue with non-ASCII and emoji characters in data: URLs. An attacker could     potentially exploit this to spoof the addressbar contents. (CVE-2016-5251)

    Georg Koppen discovered a stack buffer underflow during 2D graphics rendering in some circumstances. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5252)

    Abhishek Arya discovered a use-after-free when the alt key is used with top-level menus. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code. (CVE-2016-5254)

    Jukka Jylnki discovered a crash during garbage collection. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to execute arbitrary code.
    (CVE-2016-5255)

    Looben Yang discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash, or execute arbitrary code. (CVE-2016-5258)

    Looben Yang discovered a use-after-free when working with nested sync events in service workers. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5259)

    Mike Kaply discovered that plain-text passwords can be stored in session restore if an input field type is     changed from password to text during a session, leading to information disclosure. (CVE-2016-5260)

    Samuel Gro discovered an integer overflow in WebSockets during data buffering in some circumstances. If     a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this     to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5261)

    Nikita Arykov discovered that JavaScript event handlers on a <marquee> element can execute in a sandboxed     iframe without the allow-scripts flag set. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks.
    (CVE-2016-5262)

    A type confusion bug was discovered in display transformation during rendering. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code. (CVE-2016-5263)

    A use-after-free was discovered when applying effects to SVG elements in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5264)

    Abdulrahman Alqabandi discovered a same-origin policy violation relating to local HTML files and saved     shortcut files. An attacker could potentially exploit this to obtain sensitive information.
    (CVE-2016-5265)

    Rafael Gieschke discovered an information disclosure issue related to drag and drop. An attacker could     potentially exploit this to obtain sensitive information. (CVE-2016-5266)

    A text injection issue was discovered with about: URLs. An attacker could potentially exploit this to     spoof internal error pages. (CVE-2016-5268)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 48. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists in the expat XML parser due     to improper validation of user-supplied input when     handling malformed input documents. An attacker can     exploit this to cause a buffer overflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-0718)

  - An information disclosure vulnerability exists due to a     failure to close connections after requesting favicons.
    An attacker can exploit this to continue to send     requests to the user's browser and disclose sensitive     information.(CVE-2016-2830)

  - Multiple memory corruption issues exist due to improper     validation of user-supplied input. An attacker can     exploit these issues to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-2835, CVE-2016-2836)

  - An overflow condition exists in the ClearKey Content     Decryption Module (CDM) used by the Encrypted Media     Extensions (EME) API due to improper validation of     user-supplied input. An attacker can exploit this to     cause a buffer overflow, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-2837)

  - An overflow condition exists in the ProcessPDI()     function in layout/base/nsBidi.cpp due to improper     validation of user-supplied input. An attacker can     exploit this to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-2838)

  - A flaw exists in the Resource Timing API during page     navigation. An attacker can exploit this to disclose     sensitive information. (CVE-2016-5250)

  - A flaw exists that is triggered when decoding     url-encoded values in 'data:' URLs. An attacker can     exploit this, via non-ASCII or emoji characters, to     spoof the address in the address bar. (CVE-2016-5251)

  - An underflow condition exists in the BasePoint4d()     function in gfx/2d/Matrix.h due to improper validation     of user-supplied input when calculating clipping regions     in 2D graphics. A remote attacker can exploit this to     cause a stack-based buffer underflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-5252)

  - A flaw in the updater service exists when launched using     the callback application path parameter that allows an     attacker to escalate privileges. (CVE-2016-5253)

  - A use-after-free error exists in the KeyDown() function     in layout/xul/nsXULPopupManager.cpp when using the alt     key in conjunction with top level menu items. An     attacker can exploit this to dereference already freed     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2016-5254)

  - A use-after-free error exists in the sweep() function     that is triggered when handling objects and pointers     during incremental garbage collection. An attacker can     exploit this to dereference already freed memory,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-5255)

  - A use-after-free error exists in WebRTC that is     triggered when handling DTLS objects. An attacker can     exploit this to dereference already freed memory,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-5258)

  - A use-after-free error exists in the DestroySyncLoop()     function in dom/workers/WorkerPrivate.cpp that is     triggered when handling nested sync event loops in     Service Workers. An attacker can exploit this to     dereference already freed memory, resulting in a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-5259)

  - An information disclosure vulnerability exists in the     restorableFormNodes() function in XPathGenerator.jsm due     to persistently storing passwords in plaintext in     session restore data. An attacker can exploit this to     disclose password information. (CVE-2016-5260)

  - An integer overflow condition exists in the     ProcessInput() function in WebSocketChannel.cpp due to     improper validation of user-supplied input when handling     specially crafted WebSocketChannel packets. An attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5261)

  - A security bypass vulnerability exists due to event     handler attributes on a <marquee> tag being executed     inside a sandboxed iframe that does not have the     allow-scripts flag set. An attacker can exploit this to     bypass cross-site scripting protection mechanisms.
    (CVE-2016-5262)

  - A type confusion flaw exists in the HitTest() function     in nsDisplayList.cpp when handling display     transformations. An attacker can exploit this to execute     arbitrary code. (CVE-2016-5263)

  - A use-after-free error exists in the     NativeAnonymousChildListChange() function when applying     effects to SVG elements. An attacker can exploit this to     dereference already freed memory, resulting in a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-5264)

  - A flaw exists in the Redirect() function in     nsBaseChannel.cpp that is triggered when a malicious     shortcut is called from the same directory as a local     HTML file. An attacker can exploit this to bypass the     same-origin policy. (CVE-2016-5265)

  - A flaw exists due to a failure to properly filter file     URIs dragged from a web page to a different piece of     software. An attacker can exploit this to disclose     sensitive information. (CVE-2016-5266)

  - A flaw exists that is triggered when handling certain     specific 'about:' URLs that allows an attacker to spoof     the contents of system information or error messages     (CVE-2016-5268)

  - A flaw exists in woff2 that is triggered during the     handling of TTC detection. An attacker can exploit this     to have an unspecified impact.

  - Multiple unspecified flaws exist in woff2 that allow an     attacker to cause a denial of service condition.

The version of Firefox installed on the remote Mac OS X host is prior to 48. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists in the expat XML parser due     to improper validation of user-supplied input when     handling malformed input documents. An attacker can     exploit this to cause a buffer overflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-0718)

  - An information disclosure vulnerability exists due to a     failure to close connections after requesting favicons.
    An attacker can exploit this to continue to send     requests to the user's browser and disclose sensitive     information.(CVE-2016-2830)

  - Multiple memory corruption issues exist due to improper     validation of user-supplied input. An attacker can     exploit these issues to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-2835, CVE-2016-2836)

  - An overflow condition exists in the ClearKey Content     Decryption Module (CDM) used by the Encrypted Media     Extensions (EME) API due to improper validation of     user-supplied input. An attacker can exploit this to     cause a buffer overflow, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-2837)

  - An overflow condition exists in the ProcessPDI()     function in layout/base/nsBidi.cpp due to improper     validation of user-supplied input. An attacker can     exploit this to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-2838)

  - A flaw exists in the Resource Timing API during page     navigation. An attacker can exploit this to disclose     sensitive information. (CVE-2016-5250)

  - A flaw exists that is triggered when decoding     url-encoded values in 'data:' URLs. An attacker can     exploit this, via non-ASCII or emoji characters, to     spoof the address in the address bar. (CVE-2016-5251)

  - An underflow condition exists in the BasePoint4d()     function in gfx/2d/Matrix.h due to improper validation     of user-supplied input when calculating clipping regions     in 2D graphics. A remote attacker can exploit this to     cause a stack-based buffer underflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-5252)

  - A use-after-free error exists in the KeyDown() function     in layout/xul/nsXULPopupManager.cpp when using the alt     key in conjunction with top level menu items. An     attacker can exploit this to dereference already freed     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2016-5254)

  - A use-after-free error exists in the sweep() function     that is triggered when handling objects and pointers     during incremental garbage collection. An attacker can     exploit this to dereference already freed memory,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-5255)

  - A use-after-free error exists in WebRTC that is     triggered when handling DTLS objects. An attacker can     exploit this to dereference already freed memory,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2016-5258)

  - A use-after-free error exists in the DestroySyncLoop()     function in dom/workers/WorkerPrivate.cpp that is     triggered when handling nested sync event loops in     Service Workers. An attacker can exploit this to     dereference already freed memory, resulting in a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-5259)

  - An information disclosure vulnerability exists in the     restorableFormNodes() function in XPathGenerator.jsm due     to persistently storing passwords in plaintext in     session restore data. An attacker can exploit this to     disclose password information. (CVE-2016-5260)

  - An integer overflow condition exists in the     ProcessInput() function in WebSocketChannel.cpp due to     improper validation of user-supplied input when handling     specially crafted WebSocketChannel packets. An attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5261)

  - A security bypass vulnerability exists due to event     handler attributes on a <marquee> tag being executed     inside a sandboxed iframe that does not have the     allow-scripts flag set. An attacker can exploit this to     bypass cross-site scripting protection mechanisms.
    (CVE-2016-5262)

  - A type confusion flaw exists in the HitTest() function     in nsDisplayList.cpp when handling display     transformations. An attacker can exploit this to execute     arbitrary code. (CVE-2016-5263)

  - A use-after-free error exists in the     NativeAnonymousChildListChange() function when applying     effects to SVG elements. An attacker can exploit this to     dereference already freed memory, resulting in a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-5264)

  - A flaw exists in the Redirect() function in     nsBaseChannel.cpp that is triggered when a malicious     shortcut is called from the same directory as a local     HTML file. An attacker can exploit this to bypass the     same-origin policy. (CVE-2016-5265)

  - A flaw exists due to a failure to properly filter file     URIs dragged from a web page to a different piece of     software. An attacker can exploit this to disclose     sensitive information. (CVE-2016-5266)

  - A flaw exists that is triggered when handling certain     specific 'about:' URLs that allows an attacker to spoof     the contents of system information or error messages     (CVE-2016-5268)

  - A flaw exists that is triggered when handling certain     specific 'about:' URLs that allows an attacker to spoof     the contents of system information or error messages     (CVE-2016-5268)

  - A flaw exists in woff2 that is triggered during the     handling of TTC detection. An attacker can exploit this     to have an unspecified impact.

  - Multiple unspecified flaws exist in woff2 that allow an     attacker to cause a denial of service condition.

ID	Name	Product	Family	Severity
99809	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2016-1046)	Nessus	Huawei Local Security Checks	critical
96276	GLSA-201701-15 : Mozilla Firefox, Thunderbird: Multiple vulnerabilities (SWEET32)	Nessus	Gentoo Local Security Checks	critical
94078	Debian DLA-658-1 : icedove security update	Nessus	Debian Local Security Checks	critical
94043	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2016:2513-1)	Nessus	SuSE Local Security Checks	critical
93861	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2016:2434-1)	Nessus	SuSE Local Security Checks	critical
93860	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2016:2431-1)	Nessus	SuSE Local Security Checks	critical
93669	Debian DSA-3674-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
93666	CentOS 5 / 6 / 7 : firefox (CESA-2016:1912)	Nessus	CentOS Local Security Checks	critical
93661	Mozilla Firefox ESR 45.x < 45.4 Multiple Vulnerabilities	Nessus	Windows	critical
93659	Mozilla Firefox ESR 45.x < 45.4 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
93643	Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20160921)	Nessus	Scientific Linux Local Security Checks	critical
93642	RHEL 5 / 6 / 7 : firefox (RHSA-2016:1912)	Nessus	Red Hat Local Security Checks	critical
93641	Oracle Linux 5 / 6 / 7 : firefox (ELSA-2016-1912)	Nessus	Oracle Linux Local Security Checks	critical
93429	FreeBSD : Mozilla -- multiple vulnerabilities (aa1aefe3-6e37-47db-bfda-343ef4acb1b5)	Nessus	FreeBSD Local Security Checks	critical
9484	Mozilla Firefox < 48.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
92853	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-960)	Nessus	SuSE Local Security Checks	critical
92785	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3044-1)	Nessus	Ubuntu Local Security Checks	critical
92755	Firefox < 48 Multiple Vulnerabilities	Nessus	Windows	high
92753	Firefox < 48 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
92746	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-937)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2016-5261

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

high

high

critical