Дата обнаружения
|
22/09/2015 |
Уровень угрозы
|
Critical |
Описание
|
Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, gain privileges, spoof user interface, impact local files, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities
Technical details Vulnerability (2) related to leaking data past the end of array. Feature that leads to vulnerability used by Firefox OS and disabled by default for other operating systems. (3) related to QCMS color management library and can be triggered by specific attributes at ICC V4 profile of image. If URL is pasted with unknown protocol, pasted URL is shown but no navigation occurs. Other addressbar attributes present before URL pasting will continue rendering. Which cause vulnerability (4). This vulnerability affects only Firefox for Android. (5) caused by possibility of conducting Mozilla updater to load updated files from working directory which is under user control. This vulnerability actual only for Windows systems. Vulnerability (7) occurs only when debugger is in use but may be potentially exploitable. (8) allows to spoof URL but potential effects mitigated with restrictions of reader mode. (10) caused by nestegg library and can be triggered via specially designed headers in WebM video. Vulnerability (12) caused cairo graphics library when surfaces created with 32-bit color depth but displayed on a 16-bit color depth system. In this way attacker can obtain information in memory following 16-bit surface memory heap. This vulnerability can be exploited only on Linux. (13) occurs when web page created a scripted proxy for window with a specially designed handler reference for the inner window will be passed. Vulnerability (14) caused by ECMAScript 5 API, which enforces non-configurable properties with logic specific to each API. Script which bypassing API van bypass protection and make changes to the immutable properties. (15) caused by situation when previously loaded image drag-n-dropped into content after redirect. In this case redirected URL available to scripts. In some circumstances the same cache key can be generated for two preflight requests on a site. As a result request matches cached key will bypass CORS check leading to (16). (17) related to Access-Control- headers, which values can be improperly reused if missed from CORS responses. (18) describes multiple vulnerabilities at Network Utils.cpp, ConvertFialogOptinos, nsUnicodeToUTF8::GetMaxLength, nsAttrAndChildArray::GrowBy, XULContentSinkImpl::AddText, AnimationThread, InitTextures and ReadbackResultWriterD3D11:Run. (19) caused by missing bounds check and insufficient memory allocation at libGLES portions of the ANGLE graphics library used for WebGL and OpenGL content. This vulnerability affects only Windows systems. performance.now() uses single nanosecond resolution for timing, which making possible tracking access to the last-level cache and other sensitive information like Windows counter frequency. Vulnerability (20) caused by circumstances listed above was addressed by reducing resolution to 5 microseconds. Windows counter frequency does affect non-Windows systems. |
Пораженные продукты
|
Mozilla Firefox versions earlier than 41 |
Решение
|
Update to the latest version |
Первичный источник обнаружения
|
Mozilla Foundation security advisories |
Оказываемое влияние
?
|
ACE
[?]
OSI
[?]
DoS
[?]
SB
[?]
WLF
[?]
PE
[?]
SUI
[?]
|
Связанные продукты
|
Mozilla Firefox Mozilla Firefox ESR |
CVE-IDS
|
CVE-2015-73274.3Warning
CVE-2015-71807.5Critical CVE-2015-71797.5Critical CVE-2015-71787.5Critical CVE-2015-71777.5Critical CVE-2015-71767.5Critical CVE-2015-71757.5Critical CVE-2015-71747.5Critical CVE-2015-45227.5Critical CVE-2015-45217.5Critical CVE-2015-45206.4High CVE-2015-45194.3Warning CVE-2015-45177.5Critical CVE-2015-45169.3Critical CVE-2015-45126.4High CVE-2015-45116.8High CVE-2015-45106.8High CVE-2015-45097.5Critical CVE-2015-45082.6Warning CVE-2015-45075.1High CVE-2015-45066.8High CVE-2015-45056.6High CVE-2015-45046.4High CVE-2015-45035.0Critical CVE-2015-45024.3Warning CVE-2015-45017.5Critical CVE-2015-45007.5Critical CVE-2015-44764.3Warning |
Узнай статистику распространения уязвимостей в твоем регионе |