The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

This update for Mozilla Firefox, Thunderbird, and NSS fixes the following issues :

Mozilla Firefox was updated to 52.2esr (boo#1043960) MFSA 2017-16 :

  - CVE-2017-5472 (bmo#1365602) Use-after-free using     destroyed node when regenerating trees

  - CVE-2017-7749 (bmo#1355039) Use-after-free during     docshell reloading

  - CVE-2017-7750 (bmo#1356558) Use-after-free with track     elements

  - CVE-2017-7751 (bmo#1363396) Use-after-free with content     viewer listeners

  - CVE-2017-7752 (bmo#1359547) Use-after-free with IME     input

  - CVE-2017-7754 (bmo#1357090) Out-of-bounds read in WebGL     with ImageInfo object

  - CVE-2017-7755 (bmo#1361326) Privilege escalation through     Firefox Installer with same directory DLL files (Windows     only)

  - CVE-2017-7756 (bmo#1366595) Use-after-free and     use-after-scope logging XHR header errors

  - CVE-2017-7757 (bmo#1356824) Use-after-free in IndexedDB

  - CVE-2017-7778, CVE-2017-7778, CVE-2017-7771,     CVE-2017-7772, CVE-2017-7773, CVE-2017-7774,     CVE-2017-7776, CVE-2017-7777     Vulnerabilities in the Graphite 2 library

  - CVE-2017-7758 (bmo#1368490) Out-of-bounds read in Opus     encoder

  - CVE-2017-7760 (bmo#1348645) File manipulation and     privilege escalation via callback parameter in Mozilla     Windows Updater and Maintenance Service (Windows only)

  - CVE-2017-7761 (bmo#1215648) File deletion and privilege     escalation through Mozilla Maintenance Service     helper.exe application (Windows only)

  - CVE-2017-7764 (bmo#1364283) Domain spoofing with     combination of Canadian Syllabics and other unicode     blocks

  - CVE-2017-7765 (bmo#1273265) Mark of the Web bypass when     saving executable files (Windows only)

  - CVE-2017-7766 (bmo#1342742) File execution and privilege     escalation through updater.ini, Mozilla Windows Updater,     and Mozilla Maintenance Service (Windows only)

  - CVE-2017-7767 (bmo#1336964) Privilege escalation and     arbitrary file overwrites through Mozilla Windows     Updater and Mozilla Maintenance Service (Windows only)

  - CVE-2017-7768 (bmo#1336979) 32 byte arbitrary file read     through Mozilla Maintenance Service (Windows only)

  - CVE-2017-5470 Memory safety bugs fixed in Firefox 54 and     Firefox ESR 52.2

  - remove -fno-inline-small-functions and explicitely     optimize with

    -O2 for openSUSE > 13.2/Leap 42 to work with gcc7     (boo#1040105)

Mozilla NSS was updated to NSS 3.28.5

  - Implemented domain name constraints for CA: TUBITAK Kamu     SM SSL Kok Sertifikasi - Surum 1. (bmo#1350859)

  - March 2017 batch of root CA changes (bmo#1350859)     (version 2.14) CA certificates removed: O = Japanese     Government, OU = ApplicationCA CN = WellsSecure Public     Root Certificate Authority CN = TURKTRUST Elektronik     Sertifika Hizmet H6 CN = Microsec e-Szigno Root CA     certificates added: CN = D-TRUST Root CA 3 2013 CN =     TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1     java-1_8_0-openjdk was rebuild against NSS 3.28.5 to     satisfy a runtime dependency.

The version of Mozilla Firefox installed on the remote Windows host is prior to 54. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code by convincing a user to visit a specially crafted     website. (CVE-2017-5470, CVE-2017-5471)

  - A use-after-free error exists in the EndUpdate()     function in nsCSSFrameConstructor.cpp that is triggered     when reconstructing trees during regeneration of CSS     layouts. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-5472)

  - A use-after-free error exists in the Reload() function     in nsDocShell.cpp that is triggered when using an     incorrect URL during the reload of a docshell. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7749)

  - A use-after-free error exists in the Hide() function in     nsDocumentViewer.cpp that is triggered when handling     track elements. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2017-7750)

  - A use-after-free error exists in the nsDocumentViewer     class in nsDocumentViewer.cpp that is triggered when     handling content viewer listeners. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7751)

  - A use-after-free error exists that is triggered when     handling events while specific user interaction occurs     with the input method editor (IME). An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7752)

  - An out-of-bounds read error exists in the IsComplete()     function in WebGLTexture.cpp that is triggered when     handling textures. An unauthenticated, remote attacker     can exploit this to disclose memory contents.
    (CVE-2017-7754)

  - A privilege escalation vulnerability exists due to     improper loading of dynamic-link library (DLL) files. A     local attacker can exploit this, via a specially crafted     DLL file in the installation path, to inject and execute     arbitrary code. (CVE-2017-7755)

  - A use-after-free error exists in the SetRequestHead()     function in XMLHttpRequestMainThread.cpp that is     triggered when logging XML HTTP Requests (XHR). An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7756)

  - A use-after-free error exists in ActorsParent.cpp due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7757)

  - An out-of-bounds read error exists in the     AppendAudioSegment() function in TrackEncoder.cpp that     is triggered when the number of channels in an audio     stream changes while the Opus encoder is in use. An     unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-7758)

  - A flaw exists in the NS_main() function in updater.cpp     due to improper validation of input when handling     callback file path parameters. A local attacker can     exploit this to manipulate files in the installation     directory. (CVE-2017-7760)

  - A flaw exists in the Maintenance Service helper.exe     application that is triggered as permissions for a     temporary directory are set to writable by     non-privileged users. A local attacker can exploit this     to delete arbitrary files on the system. (CVE-2017-7761)

  - A flaw exists that is triggered when displaying URLs     including authentication sections in reader mode. An     unauthenticated, remote attacker can exploit this, via a     specially crafted URL, to spoof domains in the address     bar. (CVE-2017-7762)

  - A flaw exists in the isLabelSafe() function in     nsIDNService.cpp that is triggered when handling     characters from different unicode blocks. An     unauthenticated, remote attacker can exploit this, via a     specially crafted IDN domain, to spoof a valid URL and     conduct phishing attacks. (CVE-2017-7764)

  - A flaw exists that is triggered due to improper parsing     of long filenames when handling downloaded files. An     unauthenticated, remote attacker can exploit this to     cause a file to be downloaded without the     'mark-of-the-web' applied, resulting in security     warnings for executables not being displayed.
    (CVE-2017-7765)

  - A flaw exists in the Mozilla Maintenance Service that is     triggered when handling paths for the 'patch',     'install', and 'working' directories. A local attacker     can exploit this to execute arbitrary code with elevated     privileges. (CVE-2017-7766)

  - A flaw exists in the Mozilla Maintenance Service that is     triggered when being invoked using the Mozilla Windows     Updater. A local attacker can exploit this to overwrite     arbitrary files with random data. (CVE-2017-7767)

  - A flaw exists in the IsStatusApplying() function in     workmonitor.cpp that is triggered when logging the     update status. A local attacker can exploit this to read     32 bytes of arbitrary files. (CVE-2017-7768)

  - Multiple integer overflow conditions exist in the     Graphite component in the decompress() function in     Decompressor.cpp due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2017-7772,     CVE-2017-7778)

  - An out-of-bounds read error exists in the Graphite     component in the readGraphite() function in Silf.cpp. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or disclose memory     contents. (CVE-2017-7774)

  - An out-of-bounds read error exists in the Graphite     component in getClassGlyph() function in Silf.cpp due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-7776)

  - A flaw exists in the Graphite component in the     read_glyph() function in GlyphCache.cpp related to use     of uninitialized memory. An unauthenticated, remote     attacker can exploit this to have an unspecified impact.
    (CVE-2017-7777)

The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 52.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code by convincing a user to visit a specially crafted     website. (CVE-2017-5470)

  - A use-after-free error exists in the EndUpdate()     function in nsCSSFrameConstructor.cpp that is triggered     when reconstructing trees during regeneration of CSS     layouts. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-5472)

  - A use-after-free error exists in the Reload() function     in nsDocShell.cpp that is triggered when using an     incorrect URL during the reload of a docshell. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7749)

  - A use-after-free error exists in the Hide() function in     nsDocumentViewer.cpp that is triggered when handling     track elements. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2017-7750)

  - A use-after-free error exists in the nsDocumentViewer     class in nsDocumentViewer.cpp that is triggered when     handling content viewer listeners. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7751)

  - A use-after-free error exists that is triggered when     handling events while specific user interaction occurs     with the input method editor (IME). An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7752)

  - An out-of-bounds read error exists in the IsComplete()     function in WebGLTexture.cpp that is triggered when     handling textures. An unauthenticated, remote attacker     can exploit this to disclose memory contents.
    (CVE-2017-7754)

  - A privilege escalation vulnerability exists due to     improper loading of dynamic-link library (DLL) files. A     local attacker can exploit this, via a specially crafted     DLL file in the installation path, to inject and execute     arbitrary code. (CVE-2017-7755)

  - A use-after-free error exists in the SetRequestHead()     function in XMLHttpRequestMainThread.cpp that is     triggered when logging XML HTTP Requests (XHR). An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7756)

  - A use-after-free error exists in ActorsParent.cpp due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7757)

  - An out-of-bounds read error exists in the     AppendAudioSegment() function in TrackEncoder.cpp that     is triggered when the number of channels in an audio     stream changes while the Opus encoder is in use. An     unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-7758)

  - A flaw exists in the NS_main() function in updater.cpp     due to improper validation of input when handling     callback file path parameters. A local attacker can     exploit this to manipulate files in the installation     directory. (CVE-2017-7760)

  - A flaw exists in the Maintenance Service helper.exe     application that is triggered as permissions for a     temporary directory are set to writable by     non-privileged users. A local attacker can exploit this     to delete arbitrary files on the system. (CVE-2017-7761)

  - A flaw exists in the isLabelSafe() function in     nsIDNService.cpp that is triggered when handling     characters from different unicode blocks. An     unauthenticated, remote attacker can exploit this, via a     specially crafted IDN domain, to spoof a valid URL and     conduct phishing attacks. (CVE-2017-7764)

  - A flaw exists that is triggered due to improper parsing     of long filenames when handling downloaded files. An     unauthenticated, remote attacker can exploit this to     cause a file to be downloaded without the     'mark-of-the-web' applied, resulting in security     warnings for executables not being displayed.
    (CVE-2017-7765)

  - A flaw exists in the Mozilla Maintenance Service that is     triggered when handling paths for the 'patch',     'install', and 'working' directories. A local attacker     can exploit this to execute arbitrary code with elevated     privileges. (CVE-2017-7766)

  - A flaw exists in the Mozilla Maintenance Service that is     triggered when being invoked using the Mozilla Windows     Updater. A local attacker can exploit this to overwrite     arbitrary files with random data. (CVE-2017-7767)

  - A flaw exists in the IsStatusApplying() function in     workmonitor.cpp that is triggered when logging the     update status. A local attacker can exploit this to read     32 bytes of arbitrary files. (CVE-2017-7768)

  - Multiple integer overflow conditions exist in the     Graphite component in the decompress() function in     Decompressor.cpp due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2017-7772,     CVE-2017-7773, CVE-2017-7778)

  - An out-of-bounds read error exists in the Graphite     component in the readGraphite() function in Silf.cpp. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or disclose memory     contents. (CVE-2017-7774)

  - An out-of-bounds read error exists in the Graphite     component in getClassGlyph() function in Silf.cpp due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-7776)

  - A flaw exists in the Graphite component in the     read_glyph() function in GlyphCache.cpp related to use     of uninitialized memory. An unauthenticated, remote     attacker can exploit this to have an unspecified impact.
    (CVE-2017-7777)

Mozilla Foundation reports :

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
100885	openSUSE Security Update : Mozilla based packages (openSUSE-2017-712)	Nessus	SuSE Local Security Checks	critical
100810	Mozilla Firefox < 54 Multiple Vulnerabilities	Nessus	Windows	critical
100809	Mozilla Firefox ESR < 52.2 Multiple Vulnerabilities	Nessus	Windows	critical
100775	FreeBSD : mozilla -- multiple vulnerabilities (6cec1b0a-da15-467d-8691-1dea392d4c8d)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-7767

medium

Tenable Plugins

critical

critical

critical

critical