KLA10748
Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, spoof user interface and execute arbitrary code.

Below is a complete list of vulnerabilities

1. Multiple memory safety bugs can be exploited remotely to cause denial of service or execute arbitrary code;
2. Improper image parsing can be exploited remotely via a specially designed GIF image to cause denial of service;
3. Buffer overflow can be exploited remotely via a specially designed WebGL content to execute arbitrary code;
4. Lack of RFC enforcement can be exploited remotely via a specially designed cookies to cause denial of service;
5. Improper URLs and bookmarks handling can be exploited remotely to spoof user interface; (Android)
6. Double click mishandle can be exploited remotely via a specially designed dialog to spoof user interface;
7. Improper Network Security Services handling can be exploited to bypass security restrictions;
8. Improper dialog handling can be exploited remotely via clickjacking to spoof user interface; (OS X)
9. Improper scroll-to realization can be exploited remotely to spoof user interface; (Android)
10. Improper address bar protocol handling can be exploited remotely to spoof user interface;
11. Memory safety bug at ANGLE can be exploited remotely to cause denial of service;
12. Improper pointer handling while handling zip files can be exploited remotely via a specially designed zip archive;
13. Integer overflow at libstagefright can be exploited remotely via a specially designed MP4 file to execute arbitrary code;
14. Unavailability of Application Reputation service can be exploited remotely to spoof user interface;
15. Lack of https enforcement at lightweight themes installation can be exploited remotely via man-in-the-middle attack.

Technical details

Vulnerability (1) related to uninitialized memory encountered during brotli data compression.

Vulnerability (3) related to the BufferSubData function.

Vulnerability (4) related to violation of RFC6265: storing cookies with vertical tab characters. This vulnerability exists beacause of an incomplete fix for CVE-2015-7208.

Vulnerability (5) related to data: URLs opened from bookmark or saved shortcut. Improper host handling in this case cause data: URL still showed even after redirect.

Vulnerability (6) related to lack of delay between protocol handler dialog appears and dialog action can be conducted. This can lead double click interpreted as two single clicks let complete some action in new dialog.

Vulnerability (7) related to s_mp_div function in lib/freebl/mpi/mpi.c which improperly manipulates with mp_div or mp_exptmod functions.

Vulnerability (8) related to lack of delay between download dialog getting focus and download button getting enabled. So attacker caused user to make double click can open download dialog by first and accept it by second click.

Vulnerability (9) related to scrollTo() function. By using this function attacker can scroll address bar out of view and replace it with a fake address bar.

Vulnerability (10) related to situation where invalid URL with wyciwyg: or resource: protocols pasted to address bar. In this case address bar content can be manipulated to show improper location.

Vulnerability (11) related to Buffer11::NativeBuffer11::map function.

Vulnerability (12) related to nsZipArchive function.

Vulnerability (13) related to MoofParser::Metadata function in binding/MoofParser.cpp. This vulnerability can be triggered via specially designed metadata in MP4 file.

Vulnerability (14) caused by mishandling of reputation data absence which can easier to trigger unintended download.

Mozilla Firefox versions earlier than 44
Mozilla Firefox ESR versions earlier than 38.6

Update to the latest version
Download Firefox ESR
Download Firefox