Kaspersky Threats

CVSS

?

7.5

Detect date

?

12/13/2016

Severity

?

Critical

Description

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, execute arbitrary code, possibly cause denial of service, gain priveleges or make code injections.

Below is a complete list of vulnerabilities:

A buffer overflow in SkiaGL can possibly be exploited remotely to cause denial of service;
An unknown vulnerability can be exploited remotely via marquee tags to bypass security restrictions and allow inline JavaScript;
A use-after free vulnerability within WebVR can be exploited remotely with an unknown impact;
Memory corruption while using WebGL functions containing vector constructor with a varying array within libGLES can be exploited remotely and possibly cause denial of service;
Use-after-free vulnerability in Editor while performing manipulations with DOM subtrees can be exploited remotely and possibly cause denial of service;
An unknown vulnerability can be exploited remotely via crafted SVG images and use of data: URLs to bypass security restrictions and obtain sensitive information;
Malicious users can use a JavaScript Map/Set timing attack to find out whether an atom is used in specific contexts by another compartment or zone. This can be performed to obtain sensitive information (for example, usernames embedded in JavaScript code);
Improperly sanitized Data from Pocket Server before execution can result in the possibility of HTML injection and access to Pocket’s messaging API;
Due to improper validation of origin of incoming events received by Pocket extension, malicious users can fire events, inject code and commands;
An HTML injection vulnerability in Mozilla add-ons SDK can be exploited remotely to inject content and scripts into an add-on’s context;
Memory safety bugs can be exploited to execute arbitrary code.

Technical details

Vulnerability (9) does not affect users, who have enabled e10s.

NB: This vulnerability have no public CVSS rating so rating can be changed by the time.

NB: At this moment Mozilla just reserved CVE numbers for these vulnerabilities. Information can be changed soon.

Affected products

Mozilla Firefox 50.0.2

Solution

Update to the latest version
Download Mozilla Firefox

Original advisories

Mozilla Foundation Security Advisory 2016-94

Impacts

?

CI

[?]

ACE

[?]

OSI

[?]

XSSCSS

[?]

SB

[?]

PE

[?]

DoS

[?]

CVSS ?	7.5
Detect date ?	12/13/2016
Severity ?	Critical
Description	Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, execute arbitrary code, possibly cause denial of service, gain priveleges or make code injections. Below is a complete list of vulnerabilities: A buffer overflow in SkiaGL can possibly be exploited remotely to cause denial of service; An unknown vulnerability can be exploited remotely via marquee tags to bypass security restrictions and allow inline JavaScript; A use-after free vulnerability within WebVR can be exploited remotely with an unknown impact; Memory corruption while using WebGL functions containing vector constructor with a varying array within libGLES can be exploited remotely and possibly cause denial of service; Use-after-free vulnerability in Editor while performing manipulations with DOM subtrees can be exploited remotely and possibly cause denial of service; An unknown vulnerability can be exploited remotely via crafted SVG images and use of data: URLs to bypass security restrictions and obtain sensitive information; Malicious users can use a JavaScript Map/Set timing attack to find out whether an atom is used in specific contexts by another compartment or zone. This can be performed to obtain sensitive information (for example, usernames embedded in JavaScript code); Improperly sanitized Data from Pocket Server before execution can result in the possibility of HTML injection and access to Pocket’s messaging API; Due to improper validation of origin of incoming events received by Pocket extension, malicious users can fire events, inject code and commands; An HTML injection vulnerability in Mozilla add-ons SDK can be exploited remotely to inject content and scripts into an add-on’s context; Memory safety bugs can be exploited to execute arbitrary code. Technical details Vulnerability (9) does not affect users, who have enabled e10s. NB: This vulnerability have no public CVSS rating so rating can be changed by the time. NB: At this moment Mozilla just reserved CVE numbers for these vulnerabilities. Information can be changed soon.
Affected products	Mozilla Firefox 50.0.2
Solution	Update to the latest version Download Mozilla Firefox
Original advisories	Mozilla Foundation Security Advisory 2016-94
Impacts ?	CI [?] ACE [?] OSI [?] XSSCSS [?] SB [?] PE [?] DoS [?]
Related products	Mozilla Firefox
CVE-IDS ?	CVE-2016-9080 CVE-2016-9903 CVE-2016-9896 CVE-2016-9894 CVE-2016-9902 CVE-2016-9901 CVE-2016-9893 CVE-2016-9904 CVE-2016-9900 CVE-2016-9898 CVE-2016-9897 CVE-2016-9895 CVE-2016-9899