Kaspersky ID:
KLA10748
Дата обнаружения:
26/01/2016
Обновлено:
22/01/2024

Описание

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, spoof user interface and execute arbitrary code.

Below is a complete list of vulnerabilities

  1. Multiple memory safety bugs can be exploited remotely to cause denial of service or execute arbitrary code;
  2. Improper image parsing can be exploited remotely via a specially designed GIF image to cause denial of service;
  3. Buffer overflow can be exploited remotely via a specially designed WebGL content to execute arbitrary code;
  4. Lack of RFC enforcement can be exploited remotely via a specially designed cookies to cause denial of service;
  5. Improper URLs and bookmarks handling can be exploited remotely to spoof user interface; (Android)
  6. Double click mishandle can be exploited remotely via a specially designed dialog to spoof user interface;
  7. Improper Network Security Services handling can be exploited to bypass security restrictions;
  8. Improper dialog handling can be exploited remotely via clickjacking to spoof user interface; (OS X)
  9. Improper scroll-to realization can be exploited remotely to spoof user interface; (Android)
  10. Improper address bar protocol handling can be exploited remotely to spoof user interface;
  11. Memory safety bug at ANGLE can be exploited remotely to cause denial of service;
  12. Improper pointer handling while handling zip files can be exploited remotely via a specially designed zip archive;
  13. Integer overflow at libstagefright can be exploited remotely via a specially designed MP4 file to execute arbitrary code;
  14. Unavailability of Application Reputation service can be exploited remotely to spoof user interface;
  15. Lack of https enforcement at lightweight themes installation can be exploited remotely via man-in-the-middle attack.

Technical details

Vulnerability (1) related to uninitialized memory encountered during brotli data compression.

Vulnerability (3) related to the BufferSubData function.

Vulnerability (4) related to violation of RFC6265: storing cookies with vertical tab characters. This vulnerability exists beacause of an incomplete fix for CVE-2015-7208.

Vulnerability (5) related to data: URLs opened from bookmark or saved shortcut. Improper host handling in this case cause data: URL still showed even after redirect.

Vulnerability (6) related to lack of delay between protocol handler dialog appears and dialog action can be conducted. This can lead double click interpreted as two single clicks let complete some action in new dialog.

Vulnerability (7) related to s_mp_div function in lib/freebl/mpi/mpi.c which improperly manipulates with mp_div or mp_exptmod functions.

Vulnerability (8) related to lack of delay between download dialog getting focus and download button getting enabled. So attacker caused user to make double click can open download dialog by first and accept it by second click.

Vulnerability (9) related to scrollTo() function. By using this function attacker can scroll address bar out of view and replace it with a fake address bar.

Vulnerability (10) related to situation where invalid URL with wyciwyg: or resource: protocols pasted to address bar. In this case address bar content can be manipulated to show improper location.

Vulnerability (11) related to Buffer11::NativeBuffer11::map function.

Vulnerability (12) related to nsZipArchive function.

Vulnerability (13) related to MoofParser::Metadata function in binding/MoofParser.cpp. This vulnerability can be triggered via specially designed metadata in MP4 file.

Vulnerability (14) caused by mishandling of reputation data absence which can easier to trigger unintended download.

Первичный источник обнаружения

Связанные продукты

Список CVE

  • CVE-2016-1948
    warning
  • CVE-2016-1947
    warning
  • CVE-2016-1946
    critical
  • CVE-2016-1945
    critical
  • CVE-2016-1944
    critical
  • CVE-2016-1943
    warning
  • CVE-2016-1942
    warning
  • CVE-2016-1941
    warning
  • CVE-2016-1940
    warning
  • CVE-2016-1939
    warning
  • CVE-2016-1938
    high
  • CVE-2016-1937
    warning
  • CVE-2016-1935
    critical
  • CVE-2016-1933
    warning
  • CVE-2016-1931
    critical
  • CVE-2016-1930
    critical

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com

Нашли неточность в описании этой уязвимости? Дайте нам знать!
Kaspersky IT Security Calculator:
Оцените ваш профиль кибербезопасности
Узнать больше
Встречай новый Kaspersky!
Каждая минута твоей онлайн-жизни заслуживает топовой защиты.
Узнать больше
Confirm changes?
Your message has been sent successfully.