Дата обнаружения
|
07/06/2016 |
Уровень угрозы
|
Critical |
Описание
|
Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, elevate privileges, cause denial of service, conduct XSS or obtain sensitive information. Below is a complete list of vulnerabilities:
Technical details Vulnerability (2) caused by improper parsing of HTML5 fragments in a foreign context such as under an <svg> node. Vulnerability (5) caused by improper size checking while writing to an array during some WebGL shader operations. Vulnerability (6) can be exploited to set location.host value to an arbitrary string. Vulnerability (7) related to files extracted by the Mozilla updater from a MAR archive. This files are not locked for writing and can be overwritten by other processes while the updater is running. To exploit vulnerability (8) malicious user has to conduct series of permissions in a short timespan. As result permission notifications can show the icon for the wrong permission request. Vulnerability (9) can be exploited when paired fullscreen and pointerlock requests are done in combination with closing windows. As result a pointerlock can be created within a fullscreen window without user permission and cannot then be cancelled without terminating the browser. Vulnerability (10) caused because CSS pseudo-classes can be used by web content to leak information on plugins that are installed but disabled. It can be exploited to disclosure all of the installed plugins. |
Пораженные продукты
|
Mozilla Firefox versions earlier than 47 |
Решение
|
Update to the latest version |
Первичный источник обнаружения
|
Mozilla Foundation Security Advisory 2016-50 Mozilla Foundation Security Advisory 2016-49 Mozilla Foundation Security Advisory 2016-55 Mozilla Foundation Security Advisory 2016-57 Mozilla Foundation Security Advisory 2016-56 Mozilla Foundation Security Advisory 2016-59 Mozilla Foundation Security Advisory 2016-58 Mozilla Foundation Security Advisory 2016-54 Mozilla Foundation Security Advisory 2016-60 Mozilla Foundation Security Advisory 2016-61 Mozilla Foundation Security Advisory 2016-53 Mozilla Foundation Security Advisory 2016-52 Mozilla Foundation Security Advisory 2016-51 |
Оказываемое влияние
?
|
ACE
[?]
OSI
[?]
DoS
[?]
SB
[?]
PE
[?]
XSS/CSS
[?]
|
Связанные продукты
|
Mozilla Firefox Mozilla Firefox ESR |
CVE-IDS
|
CVE-2016-28156.8High
CVE-2016-28186.8High CVE-2016-28196.8High CVE-2016-28216.8High CVE-2016-28224.3Warning CVE-2016-28246.8High CVE-2016-28254.3Warning CVE-2016-28267.2High CVE-2016-28286.8High CVE-2016-28294.3Warning CVE-2016-28315.8High CVE-2016-28324.3Warning CVE-2016-28334.3Warning CVE-2016-28349.3Critical |
Эксплуатация
|
The following public exploits exists for this vulnerability: |
Узнай статистику распространения уязвимостей в твоем регионе |