Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.

Mozilla Firefox was updated to 49.0.2 to fix two security issues and some bugs.

The following vulnerabilities were fixed :

  - CVE-2016-5287: Crash in nsTArray_base (bsc#1006475)

  - CVE-2016-5288: Web content can read cache entries     (bsc#1006476)

    The following changes and fixes are included :

  - Asynchronous rendering of the Flash plugins is now     enabled by default

  - Change D3D9 default fallback preference to prevent     graphical artifacts

  - Network issue prevents some users from seeing the     Firefox UI on startup

  - Web compatibility issue with file uploads

  - Web compatibility issue with Array.prototype.values

  - Diagnostic information on timing for tab switching

  - Fix a Canvas filters graphics issue affecting HTML5 apps

Versions of Mozilla Firefox prior to 49.0.2 are unpatched for the following vulnerabilities :

 - An error is triggered during actor destruction with 'service workers'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5287)
 - An unspecified flaw is triggered when e10s is disabled. This may allow a context-dependent attacker to use specially crafted web content to disclose potentially sensitive information in the HTTP cache related to page visits and content. (CVE-2016-5288)

Mozilla Firefox was updated to 49.0.2 to fix two security issues a some bugs.

The following vulnerabilities were fixed :

  - CVE-2016-5287: Crash in nsTArray_base (bsc#1006475)

  - CVE-2016-5288: Web content can read cache entries     (bsc#1006476)

The following changes and fixes are included :

  - Asynchronous rendering of the Flash plugins is now     enabled by default

  - Change D3D9 default fallback preference to prevent     graphical artifacts

  - Network issue prevents some users from seeing the     Firefox UI on startup

  - Web compatibility issue with file uploads

  - Web compatibility issue with Array.prototype.values

  - Diagnostic information on timing for tab switching

  - Fix a Canvas filters graphics issue affecting HTML5 apps

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3111-1 advisory.

    A use-after-free was discovered in service workers. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via program     crash, or execute arbitrary code. (CVE-2016-5287)

    It was discovered that web content could access information in the HTTP cache in some circumstances. An     attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5288)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox installed on the remote Windows host is 48.x or 49.x prior to 49.0.2. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in the     nsTArray_base<T>::SwapArrayElements() function during     actor destruction with service workers. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. Note that this     vulnerability only affects version 49.x prior to     49.0.2. (CVE-2016-5287)

  - An information disclosure vulnerability exists due to an     unspecified flaw when e10s is disabled. An     unauthenticated, remote attacker can exploit this, via     specially crafted web content, to disclose sensitive     information in the HTTP cache regarding visited URLs and     their content. Note that this vulnerability only affects     version 48.x or 49.x prior to 49.0.2. (CVE-2016-5288)

The version of Mozilla Firefox installed on the remote macOS host is 48.x or 49.x prior to 49.0.2. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in the     nsTArray_base<T>::SwapArrayElements() function during     actor destruction with service workers. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. Note that this     vulnerability only affects version 49.x prior to     49.0.2. (CVE-2016-5287)

  - An information disclosure vulnerability exists due to an     unspecified flaw when e10s is disabled. An     unauthenticated, remote attacker can exploit this, via     specially crafted web content, to disclose sensitive     information in the HTTP cache regarding visited URLs and     their content. Note that this vulnerability only affects     version 48.x or 49.x prior to 49.0.2. (CVE-2016-5288)

Mozilla Foundation reports :

CVE-2016-5287: Crash in nsTArray_base<T>::SwapArrayElements

CVE-2016-5288: Web content can read cache entries

ID	Name	Product	Family	Severity
94602	openSUSE Security Update : Mozilla Firefox (openSUSE-2016-1271)	Nessus	SuSE Local Security Checks	critical
9751	Mozilla Firefox < 49.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
94427	openSUSE Security Update : Mozilla Firefox (openSUSE-2016-2639)	Nessus	SuSE Local Security Checks	critical
94351	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3111-1)	Nessus	Ubuntu Local Security Checks	critical
94232	Mozilla Firefox 48.x / 49.x < 49.0.2 Multiple Vulnerabilities	Nessus	Windows	critical
94231	Mozilla Firefox 48.x / 49.x < 49.0.2 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
94214	FreeBSD : mozilla -- multiple vulnerabilities (aaa9f3db-13b5-4a0e-9ed7-e5ab287098fa)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-5288

medium

Tenable Plugins

critical

high

critical

critical

critical

critical

critical