Detections
Analytics

Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3124-1)

critical Nessus Plugin ID 95025

Language:

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3124-1 advisory.

 Christian Holler, Andrew McCreight, Dan Minor, Tyson Smith, Jon Coppeard, Jan-Ivar Bruaroey, Jesse Ruderman, Markus Stange, Olli Pettay, Ehsan Akhgari, Gary Kwong, Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5289, CVE-2016-5290)

 A same-origin policy bypass was discovered with local HTML files in some circumstances. An attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5291)

 A crash was discovered when parsing URLs in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code.
 (CVE-2016-5292)

 A heap buffer-overflow was discovered in Cairo when processing SVG content. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5296)

 An error was discovered in argument length checking in Javascript. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5297)

 An integer overflow was discovered in the Expat library. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2016-9063)

 It was discovered that addon updates failed to verify that the addon ID inside the signed package matched the ID of the addon being updated. An attacker that could perform a machine-in-the-middle (MITM) attack could potentially exploit this to provide malicious addon updates. (CVE-2016-9064)

 A buffer overflow was discovered in nsScriptLoadHandler. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9066)

 2 use-after-free bugs were discovered during DOM operations in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9067, CVE-2016-9069)

 A heap use-after-free was discovered during web animations in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9068)

 It was discovered that a page loaded in to the sidebar through a bookmark could reference a privileged chrome window. An attacker could potentially exploit this to bypass same origin restrictions.
 (CVE-2016-9070)

 An issue was discovered with Content Security Policy (CSP) in combination with HTTP to HTTPS redirection.
 An attacker could potentially exploit this to verify whether a site is within the user's browsing history.
 (CVE-2016-9071)

 An issue was discovered with the windows.create() WebExtensions API. If a user were tricked in to installing a malicious extension, an attacker could potentially exploit this to escape the WebExtensions sandbox. (CVE-2016-9073)

 It was discovered that WebExtensions can use the mozAddonManager API. An attacker could potentially exploit this to install additional extensions without user permission. (CVE-2016-9075)

 It was discovered that <select> element dropdown menus can cover location bar content when e10s is enabled. An attacker could potentially exploit this to conduct UI spoofing attacks. (CVE-2016-9076)

 It was discovered that canvas allows the use of the feDisplacementMap filter on cross-origin images. An attacker could potentially exploit this to conduct timing attacks. (CVE-2016-9077)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-3124-1

Plugin Details

Severity: Critical

ID: 95025

File Name: ubuntu_USN-3124-1.nasl

Version: 3.13

Type: local

Agent: unix

Published: 11/21/2016

Updated: 8/27/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2016-9075

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:firefox-locale-it, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ko, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ro, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-xh, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-pa, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-te, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-csb, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-gu, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-et, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-cy, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ar, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-pt, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ja, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ast, cpe:/o:canonical:ubuntu_linux:14.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-fr, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-bn, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-sv, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-zu, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ga, p-cpe:/a:canonical:ubuntu_linux:firefox-mozsymbols, cpe:/o:canonical:ubuntu_linux:16.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-fy, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-kn, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-lg, p-cpe:/a:canonical:ubuntu_linux:firefox, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-sk, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-he, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-bs, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-gl, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-da, p-cpe:/a:canonical:ubuntu_linux:firefox-testsuite, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-zh-hans, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-cak, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-cs, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-is, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-vi, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-gn, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ta, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-mai, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-hr, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-mr, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-as, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-an, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-en, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ca, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-uz, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-lv, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-af, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-sq, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ml, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-az, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ku, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-es, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-nn, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-mk, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-sr, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-gd, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-tr, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-or, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-hu, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-fi, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ms, p-cpe:/a:canonical:ubuntu_linux:firefox-globalmenu, p-cpe:/a:canonical:ubuntu_linux:firefox-dev, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-bg, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-lt, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-br, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-hy, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-nb, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-km, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-nso, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-th, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-zh-hant, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ka, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-el, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-si, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-kk, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-hsb, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-oc, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-de, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-pl, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-be, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-eo, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-nl, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-ru, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-fa, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-mn, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-eu, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-sw, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-uk, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-id, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-hi, p-cpe:/a:canonical:ubuntu_linux:firefox-locale-sl

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/18/2016

Vulnerability Publication Date: 6/11/2018

Reference Information

CVE: CVE-2016-5289, CVE-2016-5290, CVE-2016-5291, CVE-2016-5292, CVE-2016-5296, CVE-2016-5297, CVE-2016-9063, CVE-2016-9064, CVE-2016-9066, CVE-2016-9067, CVE-2016-9068, CVE-2016-9069, CVE-2016-9070, CVE-2016-9071, CVE-2016-9073, CVE-2016-9075, CVE-2016-9076, CVE-2016-9077

USN: 3124-1