Дата обнаружения
|
26/01/2016 |
Уровень угрозы
|
Critical |
Описание
|
Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, spoof user interface and execute arbitrary code. Below is a complete list of vulnerabilities
Technical details Vulnerability (1) related to uninitialized memory encountered during brotli data compression. Vulnerability (3) related to the BufferSubData function. Vulnerability (4) related to violation of RFC6265: storing cookies with vertical tab characters. This vulnerability exists beacause of an incomplete fix for CVE-2015-7208. Vulnerability (5) related to data: URLs opened from bookmark or saved shortcut. Improper host handling in this case cause data: URL still showed even after redirect. Vulnerability (6) related to lack of delay between protocol handler dialog appears and dialog action can be conducted. This can lead double click interpreted as two single clicks let complete some action in new dialog. Vulnerability (7) related to s_mp_div function in lib/freebl/mpi/mpi.c which improperly manipulates with mp_div or mp_exptmod functions. Vulnerability (8) related to lack of delay between download dialog getting focus and download button getting enabled. So attacker caused user to make double click can open download dialog by first and accept it by second click. Vulnerability (9) related to scrollTo() function. By using this function attacker can scroll address bar out of view and replace it with a fake address bar. Vulnerability (10) related to situation where invalid URL with wyciwyg: or resource: protocols pasted to address bar. In this case address bar content can be manipulated to show improper location. Vulnerability (11) related to Buffer11::NativeBuffer11::map function. Vulnerability (12) related to nsZipArchive function. Vulnerability (13) related to MoofParser::Metadata function in binding/MoofParser.cpp. This vulnerability can be triggered via specially designed metadata in MP4 file. Vulnerability (14) caused by mishandling of reputation data absence which can easier to trigger unintended download. |
Пораженные продукты
|
Mozilla Firefox versions earlier than 44 |
Решение
|
Update to the latest version |
Первичный источник обнаружения
|
Mozilla foundation security advisories |
Оказываемое влияние
?
|
ACE
[?]
DoS
[?]
SB
[?]
SUI
[?]
|
Связанные продукты
|
Mozilla Firefox Mozilla Firefox ESR |
CVE-IDS
|
CVE-2016-19484.3Warning CVE-2016-19474.3Warning CVE-2016-19459.3Critical CVE-2016-19434.3Warning CVE-2016-19424.3Warning CVE-2016-19414.3Warning CVE-2016-19405.0Critical CVE-2016-19395.0Critical CVE-2016-19386.4High CVE-2016-19374.3Warning CVE-2016-19359.3Critical CVE-2016-19334.3Warning |
Узнай статистику распространения уязвимостей в твоем регионе |