Security Bulletin: Mozilla Firefox vulnerability issues in IBM SONAS

Summary

There are security vulnerabilities in versions of Mozilla Firefox that are shipped with versions 1.5.0.0 to 1.5.2.1 of IBM SONAS

Vulnerability Details

IBM SONAS is shipped with Mozilla Firefox. There are vulnerabilities in certain versions of Mozilla Firefox shipped in certain versions of IBM SONAS. These vulnerabilities concern the potential ability of a remote attacker to execute arbitrary code on a vulnerable system or cause a denial of service.

CVEID: CVE-2015-2722 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error when using XMLHttpRequest in conjunction with shared or dedicated workers. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104384&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2724 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2725 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104355&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2727 DESCRIPTION: Mozilla Firefox could allow a local attacker to gain elevated privileges on the system. By persuading a victim to open a link on a page using the mouse and specific keyboard key combinations, an attacker could exploit this vulnerability to open a Chrome privileges URL without the preservation of context restrictions.
CVSS Base Score: 7.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104380&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2728 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a type confusion error in the Indexed Database Manager. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104381&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2729 DESCRIPTION: Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds memory read in one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to obtain the contents of four bytes of memory.
CVSS Base Score: 3.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104382&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:L/UI:R/S:U/CI:L/I:N/A:N)

CVEID: CVE-2015-2731 DESCRIPTION: Mozilla Firefox and Thunderbird could allow a remote attacker to execute arbitrary code on the system, caused by an issue in one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104383&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2733 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an use-after-free error when using XMLHttpRequest in conjunction with shared or dedicated workers. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104385&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2734 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an error in one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104388&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2735 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an error in nsZipArchive.cpp. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104389&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2736 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an error in one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104390&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2737 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an error in one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104391&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2738 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an error in one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104392&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2739 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an error in one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104393&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2740 DESCRIPTION: Mozilla Firefox is vulnerable to a buffer overflow, caused by improper bounds checking by one of its functions. By persuading a victim to visit a specially crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104394&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-2741 DESCRIPTION: Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by the failure to enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using man-in-the-middle techniques to bypass access restrictions.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104395&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:N/I:L/A:N)

CVEID: CVE-2015-2743 DESCRIPTION: Mozilla Firefox could allow a remote attacker to gain elevated privileges on the system, caused by the enablement of excessive privileges for internal Workers. By leveraging a Same Origin Policy bypass, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system with elevated privileges.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/104397&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4495 DESCRIPTION: Mozilla Firefox could allow a remote attacker to bypass security restrictions. By persuading a victim to open a specially crafted PDF file, an attacker could exploit this vulnerability to bypass same-origin policy and inject arbitrary JavaScript into the built-in PDF Viewer and obtain local files on the victim’s computer.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105389&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-0797 DESCRIPTION: Mozilla Firefox is vulnerable to a buffer overflow. By persuading a victim to open a specially crafted H.264 video file, a remote attacker could execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105235&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/PR:N/UI:R/S:U/CI:P/I:P/A:P)

CVEID: CVE-2015-4473 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105486&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4475 DESCRIPTION: Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read during playback of a malformed MP3 format audio file. By persuading a victim to specially crafted MP3 audio file, a remote attacker could exploit this vulnerability to read portions of system memory.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105491&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:L/I:N/A:N)

CVEID: CVE-2015-4478 DESCRIPTION: Mozilla Firefox could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability to bypass same-origin policy restrictions and gain access to the system.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105576&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:N/I:L/A:N)

CVEID: CVE-2015-4479 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing MPEG4 video files. By persuading a victim to open a specially-crafted MPEG4 file, a remote attacker could exploit this vulnerability to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105573&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4480 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing MPEG4 video files. By persuading a victim to open a specially-crafted MPEG4 file, a remote attacker could exploit this vulnerability to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105574&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4484 DESCRIPTION: Mozilla Firefox is vulnerable to a denial of service, caused by the failure to properly gate access to Atomics or SharedArrayBuffer views. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the browser to crash.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105545&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:N/I:N/A:H)

CVEID: CVE-2015-4485 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow. By persuading a victim to visit a specially-crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105526&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4486 DESCRIPTION: Mozilla Firefox is vulnerable to a buffer overflow. By persuading a victim to visit a specially-crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105527&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4487 DESCRIPTION: Mozilla Firefox is vulnerable to a buffer overflow. By sending a specially crafted data, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105523&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4488 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105524&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4489 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105525&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4491 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper bounds checking bygdk-pixbuf affecting Linux systems using Gnome. By persuading a victim to visit a specially-crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105544&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4492 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an error in one of its functions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105521&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

CVEID: CVE-2015-4493 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow. By persuading a victim to open a specially-crafted MPEG4 file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/105575&gt;[](&lt;https://exchange.xforce.ibmcloud.com/vulnerabilities/104354&gt;) for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/PR:N/UI:R/S:U/CI:H/I:H/A:H)

Affected Products and Versions

IBM SONAS
The product is affected when running code releases 1.5.0.0 to 1.5.2.1

Remediation/Fixes

A fix for these issues is in version 1.5.2.2 of IBM SONAS. Customers running an affected version of IBM SONAS should upgrade to 1.5.2.2 or a later version, so that the fix gets applied.

Please contact IBM support for assistance in upgrading your system.

Workarounds and Mitigations

Workaround(s) :
Normal operation of IBM SONAS does not require or call for customers to use Firefox to access the Internet. Although IBM recommends that you install a level of IBM SONAS code with a fix, you can avoid these vulnerabilities by not using Mozilla Firefox within your IBM SONAS system to access the Internet.