远程 Mac OS X 主机上安装的 Firefox ESR 版本低于 38.2。因此，它受到以下漏洞的影响：

- 存在多种内存损坏问题，远程攻击者可利用这些问题通过特别构建的网页损坏内存或执行任意代码。
 (CVE-2015-4473)

- 由于未正确处理不匹配的示例格式，PlayFromAudioQueue() 函数中存在越界读取错误。远程攻击者可利用此缺陷，通过特别构建的 MP3 文件泄露内存内容或执行任意代码。
 (CVE-2015-4475)

- 由于在 JSON 解析期间重新定义不可配置属性时违反了 ECMAScript 6 标准，存在同源策略绕过漏洞。远程攻击者可利用此漏洞，通过将这些属性编辑为任意值绕过同源策略。(CVE-2015-4478)

- 由于处理 MPEG4 视频中的“saio”区块时未正确验证用户提供的输入，存在多种整数溢出情况。远程攻击者可利用此缺陷，通过特别构建的 MPEG4 文件执行任意代码。(CVE-2015-4479)

- 处理 H.264 媒体内容时，捆绑的 libstagefright 组件中存在整数溢出情况。远程攻击者可利用此缺陷，通过特别构建的 MPEG4 文件执行任意代码。
 (CVE-2015-4480)

- 由于处理 MAR 文件中的索引名称时，mar_consume_index() 函数中存在数组索引缺陷，导致越界写入错误。攻击者可利用此缺陷执行任意代码。(CVE-2015-4482)

- 由于使用共享内存处理 JavaScript 时未能正确访问 Atomics 和 SharedArrayBuffer 视图，存在拒绝服务漏洞。攻击者可利用此漏洞造成程序崩溃，从而导致拒绝服务。
 (CVE-2015-4484)

- 由于未能正确验证用户提供的输入，resize_context_buffers() 函数中存在基于堆的缓冲区溢出情况。远程攻击者可利用此漏洞，通过特别构建的 WebM 内容，造成基于堆的缓冲区溢出，从而导致执行任意代码。(CVE-2015-4485)

- 由于没有正确验证用户提供的输入，decrease_ref_count() 函数中存在基于堆的缓冲区溢出情况。远程攻击者可利用此漏洞，通过特别构建的 WebM 内容，造成基于堆的缓冲区溢出，从而导致执行任意代码。(CVE-2015-4486)

- ReplacePrep() 函数中存在缓冲区溢出情况。远程攻击者可利用此漏洞造成缓冲区溢出，从而导致执行任意代码。(CVE-2015-4487)

- operator=() 函数中存在一个释放后使用错误。攻击者可利用此问题取消引用已经释放的内存，从而导致执行任意代码。(CVE-2015-4488)

- 由于在自赋值期间未正确验证用户提供的输入，nsTArray_Impl() 函数中存在内存损坏问题。远程攻击者可利用此问题造成内存损坏，因此导致执行任意代码。(CVE-2015-4489)

- 由于未正确处理递归调用，XMLHttpRequest::Open() 函数中存在一个释放后使用错误。攻击者可利用此问题取消引用已经释放的内存，从而导致执行任意代码。(CVE-2015-4492)

- 捆绑的 libstagefright 库中存在整数下溢情况。攻击者可利用此缺陷造成应用程序崩溃，从而导致拒绝服务情况。(CVE-2015-4493)

远程主机受到 GLSA-201605-06 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Firefox、NSS、NSPR 和 Thunderbird 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、欺骗地址栏、执行点击劫持攻击、绕过安全限制和保护机制，或造成其他不明影响。
 变通方案：

目前无任何已知的变通方案。

Mozilla 项目报告：

MFSA 2015-79 各种内存安全危害 (rv:40.0 / rv:38.2)

MFSA 2015-80 使用畸形 MP3 文件时发生越界读取

MFSA 2015-81 MediaStream 回放中存在释放后使用

MFSA 2015-82 重新定义不可配置的 JavaScript 对象属性

MFSA 2015-83 libstagefright 中的溢出问题

MFSA 2015-84 通过包含硬链接的 Mozilla Maintenance Service 进行的任意文件改写

MFSA 2015-85 更新程序和恶意 MAR 文件的越界写入

MFSA 2015-86 为协议提供混合了 POST 绕过的内容保护

MFSA 2015-87 在 JavaScript 中使用共享内存时发生崩溃

MFSA 2015-88 缩放位图图像时 gdk-pixbuf 中存在堆溢出

MFSA 2015-90 通过代码检查发现了多种漏洞

MFSA 2015-91 Mozilla 内容安全策略允许违反 CSP 规范使用星号通配符

MFSA 2015-92 包含共享线程的 XMLHttpRequest 中存在释放后使用

在对畸形 Web 内容的处理中发现多个缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。（CVE-2015-4473、CVE-2015-4475、CVE-2015-4478、CVE-2015-4479、CVE-2015-4480、CVE-2015-4493、CVE-2015-4484、CVE-2015-4491、CVE-2015-4485、CVE-2015-4486、CVE-2015-4487、CVE-2015-4488、CVE-2015-4489、CVE-2015-4492）

安装更新后，必须重新启动 Firefox 才能使更改生效。

The version of Mozilla Firefox is prior to 40.0 and is affected by multiple vulnerabilities : 

 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4473) 
 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4474) 
 - An out-of-bounds read error exists in the 'PlayFromAudioQueue()' function due to improper handling of mismatched sample formats. A remote attacker can exploit this, via a specially crafted MP3 file, to disclose memory contents or execute arbitrary code. (CVE-2015-4475) 
 - A use-after-free error exists in the Web Audio API during MediaStream playback. A remote attacker can exploit this to dereference already freed memory, resulting in the potential execution of arbitrary code. (CVE-2015-4477) 
 - A same-origin policy bypass vulnerability exists due to non-configurable properties being redefined in violation of the ECMAScript 6 standard during JSON parsing. A remote attacker can exploit this, by editing these properties to arbitrary values, to bypass the same-origin policy. (CVE-2015-4478) 
 - Multiple integer overflow conditions exist due to improper validation of user-supplied input when handling 'saio' chunks in MPEG4 video. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4479) 
 - An integer overflow condition exists in the bundled libstagefright component when handling H.264 media content. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4480) 
 - An arbitrary file overwrite vulnerability exists in the Mozilla Maintenance Service due to a race condition. An attacker can exploit this, via the use of a hard link, to overwrite arbitrary files with log output. (CVE-2015-4481) 
 - An out-of-bounds write error exists due to an array indexing flaw in the 'mar_consume_index()' function when handling index names in MAR files. An attacker can exploit this to execute arbitrary code. (CVE-2015-4482) 
 - A security bypass vulnerability exists due to a flaw in the 'ShouldLoad()' function that occurs during the handling of POST requests to URLs using the 'feed:' URI handler. An attacker can exploit this to bypass the mixed content blocker. (CVE-2015-4483) 
 - A denial of service vulnerability exists when handling JavaScript using shared memory without properly gating access to Atomics and SharedArrayBuffer views. An attacker can exploit this to crash the program, resulting in a denial of service condition. (CVE-2015-4484) 
 - A heap-based buffer overflow condition exists in the  'resize_context_buffers()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4485) 
 - A heap-based buffer overflow condition exists in the 'decrease_ref_count()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4486) 
 - A buffer overflow condition exists in the 'ReplacePrep()' function. A remote attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4487) 
 - A use-after-free error exists in the 'operator=()' function. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4488) 
 - A memory corruption issue exists in the 'nsTArray_Impl()' function due to improper validation of user-supplied input during self-assignment. An attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2015-4489) 
 - A security bypass vulnerability exists due to a discrepancy in the implementation of Content Security Policy and the CSP specification. The specification states that 'blob:', 'data:', and 'filesystem:' URLs should be excluded in case of a wildcard when matching source expressions, but Mozilla's implementation allows these in the case of an asterisk wildcard. A remote attacker can exploit this to bypass restrictions. (CVE-2015-4490) 
 - A use-after-free error exists in the 'XMLHttpRequest::Open()' function due to improper handling of recursive calls. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4492) 
 - An integer underflow condition exists in the bundled libstagefright library. An attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-4493) 
 - A flaw in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files. (CVE-2015-4495)

Versions of Firefox OS prior to 2.2 are outdated and thus unpatched for the following vulnerabilities : 

 - A logic error in 'apps/system/js/usb_storage.js' that is triggered during the handling of USB mass storage. This may allow a local attacker with access to the USB host to gain access to USB media volumes that are locked with a passcode after a reboot or certain unspecified screen saver state changes. (CVE-2015-5960) 
 - A flaw exists in the SharedBufferManagerParent::RecvAllocateGrallocBuffer() function in 'gfx/layers/ipc/SharedBufferManagerParent.cpp'. This may allow an attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2015-5960) 
 - A flaw exists in the 'FxAccounts signup dialog' that is triggered as input passed via the COPPA error screen is not properly sanitized before being passed to the B2G root process. This may allow a remote attacker to inject arbitrary web content into the B2G root process. (CVE-2015-5961) 
 - A flaw exists in 'dom/messages/SystemMessagePermissionsChecker.jsm' within the WiFi-related system message, as the system fails to restrict system messages to applications with the 'wifi-manage' permissions. With an unprivileged application, a local attacker can gain access to limited information from system messages. (CVE-2015-4494) 
 - A use-after-free error affects the StyleAnimationValue::operator=() function in 'layout/style/StyleAnimationValue.cpp'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-4488) 
 - An unspecified flaw exists in the nsTArray_Impl() function. The issue is triggered as user-supplied input is not properly validated during self-assignment. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4489) 
 - An overflow condition affects the nsTSubstring::ReplacePrep() function. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2015-4487) 
 - Gaia contains a flaw in the search app within 'apps/search/js/providers/provider.js' that is triggered during the handling of a specially crafted search link. When the link is opened in the browser and the browser is re-opened or a new tab is opened, a context-dependent attacker can potentially inject HTML content. (CVE-2015-2744) 
 - Gaia contains a flaw in 'apps/system/js/card.js' that is triggered when handling titles. When the link is opened in the browser and the HOME button is pressed or the Show Windows function is used, a context-dependent attacker can potentially inject HTML content. (CVE-2015-2745) 
 - A flaw affects the nsDocShell::LoadURI() function in 'docshell/base/nsDocShell.cpp' that is triggered when converting an expanded principal into inheriting the current principal. This may allow a context-dependent attacker to bypass the same-origin policy and disclose the contents of local files. (CVE-2015-4495)

ID	Name	Product	Family	Published	Updated	Severity
85383	Firefox ESR < 38.2 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	8/13/2015	11/22/2019	critical
91379	GLSA-201605-06：Mozilla 产品：多种漏洞	Nessus	Gentoo Local Security Checks	5/31/2016	12/5/2022	critical
85338	FreeBSD：mozilla -- 多种漏洞 (c66a5632-708a-4727-8236-d65b2d5b2739)	Nessus	FreeBSD Local Security Checks	8/12/2015	1/6/2021	critical
85343	Scientific Linux 安全更新：SL5.x、SL6.x、SL7.x i386/x86_64 中的 firefox	Nessus	Scientific Linux Local Security Checks	8/12/2015	1/14/2021	critical
8856	Mozilla Firefox < 40.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/9/2015	3/6/2019	critical
8878	Firefox OS < 2.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	9/24/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical