Firefox < 42 Multiple Vulnerabilities

high Nessus Plugin ID 86764

Language:

Synopsis

The remote Windows host contains a web browser that is affected by multiple vulnerabilities.

Description

The version of Firefox installed on the remote Windows host is prior to 42. It is, therefore, affected by the following vulnerabilities :

- Multiple memory corruption issues exist due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to cause a denial of service condition or the execution of arbitrary code.
(CVE-2015-4513, CVE-2015-4514)

- An information disclosure vulnerability exists when handling type 3 messages as part of the NTLM authentication exchange. A remote attacker can exploit this, via a specially crafted web page that sends an NTLM request, to disclose system hostname and windows domain information. (CVE-2015-4515)

- A security bypass vulnerability exists due to the whitelist used by Reader View to disable scripts for rendered pages being too permissive. A remote attacker can exploit this, via specially crafted web page, to bypass Content Security Policy (CSP) protections.
(CVE-2015-4518)

- An unspecified use-after-poison flaw exists in the sec_asn1d_parse_leaf() function in Mozilla Network Security Services (NSS) due to improper restriction of access to an unspecified data structure. A remote attacker can exploit this, via crafted OCTET STRING data, to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-7181)
- A heap buffer overflow condition exists in the ASN.1 decoder in Mozilla Network Security Services (NSS) due to improper validation of user-supplied input. A remote attacker can exploit this, via crafted OCTET STRING data, to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-7182)

- An integer overflow condition exists in the PL_ARENA_ALLOCATE macro in the Netscape Portable Runtime (NSPR) due to improper validation of user-supplied input. A remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-7183)

- A security bypass vulnerability exists due to a failure to enforce settings when disabling scripts in the Add-on SDK panel. A remote attacker can exploit this, via a crafted web page, to bypass security restrictions and conduct a cross-site scripting attack. (CVE-2015-7187)

- A same-origin bypass vulnerability exists due to improper handling of trailing whitespaces in the IP address hostname. A remote attacker can exploit this, by appending whitespace characters to an IP address string, to bypass the same-origin policy and conduct a cross-site scripting attack. (CVE-2015-7188)

- A race condition exists in the JPEGEncoder() function due to improper validation of user-supplied input when handling canvas elements. A remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-7189)

- A cross-origin resource sharing (CORS) request bypass vulnerability exists due to improper implementation of the CORS cross-origin request algorithm for the POST method in situations involving an unspecified Content-Type header manipulation. A remote attacker can exploit this to perform a simple request instead of a 'preflight' request. (CVE-2015-7193)

- A buffer underflow condition exists in libjar due to improper validation of user-supplied input when handling ZIP archives. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-7194)

- An information disclosure vulnerability exists due to improper parsing of escaped characters in the hostname of location headers. A remote attacker can exploit this to gain access to arbitrary site-specific token information. (CVE-2015-7195)

- A memory corruption issue exists in the _releaseobject() function in dom/plugins/base/nsNPAPIPlugin.cpp due to improper deallocation of JavaScript wrappers. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.
(CVE-2015-7196)

- A security bypass vulnerability exists due to improperly controlling the ability of a web worker to create a WebSocket object in the WebSocketImpl::Init() method.
A remote attacker can exploit this to bypass intended mixed-content restrictions. (CVE-2015-7197)

- A buffer overflow condition exists in TextureStorage11 in ANGLE due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-7198)

- A flaw exists in the AddWeightedPathSegLists() function due to missing return value checks during SVG rendering.
A remote attacker can exploit this, via a crafted SVG document, to corrupt memory, resulting in a denial of service condition or the execution of arbitrary code.
(CVE-2015-7199)

- A flaw exists in the CryptoKey interface implementation due to missing status checks. A remote attacker can exploit this to make changes to cryptographic keys and execute arbitrary code. (CVE-2015-7200)

Solution

Upgrade to Firefox 42 or later.

Plugin Details

Severity: High

ID: 86764

File Name: mozilla_firefox_42.nasl

Version: 1.10

Type: local

Agent: windows

Family: Windows

Published: 11/5/2015

Updated: 11/20/2019

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2015-7200

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Required KB Items: Mozilla/Firefox/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 11/3/2015

Vulnerability Publication Date: 11/3/2015

Reference Information

CVE: CVE-2015-4513, CVE-2015-4514, CVE-2015-4515, CVE-2015-4518, CVE-2015-7181, CVE-2015-7182, CVE-2015-7183, CVE-2015-7187, CVE-2015-7188, CVE-2015-7189, CVE-2015-7193, CVE-2015-7194, CVE-2015-7195, CVE-2015-7196, CVE-2015-7197, CVE-2015-7198, CVE-2015-7199, CVE-2015-7200

BID: 77412, 77415, 77416

Detections

Analytics