KLA10672
Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, gain privileges, spoof user interface, impact local files, execute arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Improper memory handling can be exploited remotely via an unknown vectors to cause denial of service or execute arbitrary code;
2. Improper memory handling at mozTCPSocket implementation can be exploited remotely via an unknown vectors to obtain sensitive information;
3. Out of bounds read at color management can be exploited remotely via specially designed image to cause denial of service or obtain sensitive information;
4. Improper URL rendering at Firefox for Android can be exploited remotely via a specially designed URL to spoof user interface;
5. Lack of restrictions at updater can be exploited locally via files manipulation to overwrite arbitrary files or execute arbitrary code;
6. An unknown vulnerability at video parser can be exploited remotely via a specially designed vp9 video to cause denial of service or execute arbitrary code;
7. Unknown vulnerability at JavaScript engine can be exploited remotely via a specially designed javascript to cause denial of service;
8. An unknown vulnerability at reader mode can be exploited remotely via URL manipulations to spoof user interface;
9. Use-after-free vulnerability at IndexedDB can be exploited remotely via a specially designed web content to cause denial of service;
10. Buffer overflow vulnerability at video codec library can be exploited remotely via a specially designed WebM video to cause denial of service;
11. Use-after-free at HTML media elements can be exploited remotely via URI table manipulations to cause denial of service;
12. Improper memory handling at 2D canvas can be exploited remotely via a specially designed surfaces to obtain sensitive information;
13. Improper scripted proxy handling can be exploited remotely via a specially designed handler to bypass security restrictions;
14. Improper API’s implementation at Gecko can be exploited remotely via a specially designed script to execute arbitrary code or gain privileges;
15. Improper image drag-n-drop handling can be exploited via an unknown vectors to obtain sensitive information;
16. Improper key generation at CORS can be exploited remotely via an unknwon vectors to bypass security restrictions;
17. An improper headers handling at CORS can be exploited remotely via a specially designed requests to bypass security restrictions;
18. Multiple memory safety vulnerabilities can be exploited remotely via an unknown vectors;
19. Improper memory handling at ANGLE graphics library can be exploited remotely via shaders manipulations to cause denial of service or execute arbitrary code;
20. Too fine timing resolution at High Resolution Time API can be exploited remotely via an unknown vectors to obtain sensitive information.

Technical details

Vulnerability (2) related to leaking data past the end of array. Feature that leads to vulnerability used by Firefox OS and disabled by default for other operating systems.

(3) related to QCMS color management library and can be triggered by specific attributes at ICC V4 profile of image.

If URL is pasted with unknown protocol, pasted URL is shown but no navigation occurs. Other addressbar attributes present before URL pasting will continue rendering. Which cause vulnerability (4). This vulnerability affects only Firefox for Android.

(5) caused by possibility of conducting Mozilla updater to load updated files from working directory which is under user control. This vulnerability actual only for Windows systems.

Vulnerability (7) occurs only when debugger is in use but may be potentially exploitable.

(8) allows to spoof URL but potential effects mitigated with restrictions of reader mode.

(10) caused by nestegg library and can be triggered via specially designed headers in WebM video.

Vulnerability (12) caused cairo graphics library when surfaces created with 32-bit color depth but displayed on a 16-bit color depth system. In this way attacker can obtain information in memory following 16-bit surface memory heap. This vulnerability can be exploited only on Linux.

(13) occurs when web page created a scripted proxy for window with a specially designed handler reference for the inner window will be passed.

Vulnerability (14) caused by ECMAScript 5 API, which enforces non-configurable properties with logic specific to each API. Script which bypassing API van bypass protection and make changes to the immutable properties.

(15) caused by situation when previously loaded image drag-n-dropped into content after redirect. In this case redirected URL available to scripts.

In some circumstances the same cache key can be generated for two preflight requests on a site. As a result request matches cached key will bypass CORS check leading to (16).

(17) related to Access-Control- headers, which values can be improperly reused if missed from CORS responses.

(18) describes multiple vulnerabilities at Network Utils.cpp, ConvertFialogOptinos, nsUnicodeToUTF8::GetMaxLength, nsAttrAndChildArray::GrowBy, XULContentSinkImpl::AddText, AnimationThread, InitTextures and ReadbackResultWriterD3D11:Run.

(19) caused by missing bounds check and insufficient memory allocation at libGLES portions of the ANGLE graphics library used for WebGL and OpenGL content. This vulnerability affects only Windows systems.

performance.now() uses single nanosecond resolution for timing, which making possible tracking access to the last-level cache and other sensitive information like Windows counter frequency. Vulnerability (20) caused by circumstances listed above was addressed by reducing resolution to 5 microseconds. Windows counter frequency does affect non-Windows systems.

Mozilla Firefox versions earlier than 41
Mozilla Firefox ESR versions earlier than 38.3

Update to the latest version
Get Firefox ESR
Get Firefox

Mozilla Foundation security advisories