Severity: Critical Date : 2016-09-22 CVE-ID : CVE-2016-5256 CVE-2016-5257 CVE-2016-5270 CVE-2016-5271 CVE-2016-5272 CVE-2016-5273 CVE-2016-5274 CVE-2016-5275 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5279 CVE-2016-5280 CVE-2016-5281 CVE-2016-5282 CVE-2016-5283 CVE-2016-5284 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE
The package firefox before version 49.0-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, information disclosure and certificate verification bypass.
Upgrade to 49.0-1.
The problems have been fixed upstream in version 49.0.
Mozilla developers Christoph Diehl, Christian Holler, Gary Kwong, Nathan Froyd, Honza Bambas, Seth Fowler, and Michael Smith reported memory safety bugs present in Firefox 48. Some of these bugs showed evidence of memory corruption under certain circumstances could potentially exploited to run arbitrary code.
Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory safety bugs present in Firefox 48 and Firefox ESR 45.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
An out-of-bounds write of a boolean value during text conversion with some unicode characters.
An out-of-bounds read during the processing of text runs in some pages using display:contents.
A bad cast when processing layout with input elements can result in a potentially exploitable crash.
A potentially exploitable crash in accessibility in the mozilla::a11y::HyperTextAccessible::GetChildOffset function.
A use-after-free vulnerability has been discovered in the nsFrameManager::CaptureFrameState function in web animations during restyling.
A buffer overflow vulnerability has been discovered in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function when working with empty filters during canvas rendering.
A use-after-free vulnerability has been discovered in the mozilla::a11y::DocAccessible::ProcessInvalidationList function triggered by setting a aria-owns attribute.
A user-after-free vulnerability has been disconvered in the nsRefreshDriver::Tick function with web animations when destroying a timeline.
A potentially exploitable crash caused by a heap based buffer overflow has been discovered in the nsBMPEncoder::AddImageFrame function while encoding image frames to images.
The full path to local files is available to scripts when local files are drag and dropped into Firefox.
A use-after-free vulnerability has been discovered in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function when changing text direction.
A use-after-free vulnerability has been discovered in the DOMSVGLength when manipulating SVG format content through a script.
Favicons can be loaded through non-whitelisted protocols, such as jar.
A timing attack vulnerability was discovered using iframes to potentially reveal private cross-origin data using document resizes and link colors.
Due to flaws in the process used to update "Preloaded Public Key Pinning", the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected.
A remote attacker is able to execute arbitrary code, disclose sensitive information and bypass certificate verification via various vectors.
https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/ https://access.redhat.com/security/cve/CVE-2016-5256 https://access.redhat.com/security/cve/CVE-2016-5257 https://access.redhat.com/security/cve/CVE-2016-5270 https://access.redhat.com/security/cve/CVE-2016-5271 https://access.redhat.com/security/cve/CVE-2016-5272 https://access.redhat.com/security/cve/CVE-2016-5273 https://access.redhat.com/security/cve/CVE-2016-5274 https://access.redhat.com/security/cve/CVE-2016-5275 https://access.redhat.com/security/cve/CVE-2016-5276 https://access.redhat.com/security/cve/CVE-2016-5277 https://access.redhat.com/security/cve/CVE-2016-5278 https://access.redhat.com/security/cve/CVE-2016-5279 https://access.redhat.com/security/cve/CVE-2016-5280 https://access.redhat.com/security/cve/CVE-2016-5281 https://access.redhat.com/security/cve/CVE-2016-5282 https://access.redhat.com/security/cve/CVE-2016-5283 https://access.redhat.com/security/cve/CVE-2016-5284