CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
94.6%
A content security policy (CSP) containing a referrer directive with no values can cause a non-exploitable crash.
An out-of-bounds write of a boolean value during text conversion with some unicode characters
An out-of-bounds read during the processing of text runs in some pages using display:contents.
A bad cast when processing layout with input elements can result in a potentially exploitable crash.
A potentially exploitable crash in accessibility.
A use-after-free vulnerability triggered by setting a aria-owns attribute.
A use-after-free issue in web animations during restyling.
A use-after-free vulnerability with web animations when destroying a timeline.
A buffer overflow when working with empty filters during canvas rendering.
A potentially exploitable crash caused by a buffer overflow while encoding image frames to images.
The full path to local files is available to scripts when local files are drag and dropped into Firefox.
Use-after-free vulnerability when changing text direction.
Use-after-free vulnerability when manipulating SVG format content through script.
Favicons can be loaded through non-whitelisted protocols, such as jar:.
A timing attack vulnerability using iframes to potentially reveal private data using document resizes and link colors.
Due to flaws in the process we used to update “Preloaded Public Key Pinning” in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected.
Mozilla developers Christoph Diehl, Christian Holler, Gary Kwong, Nathan Froyd, Honza Bambas, Seth Fowler, and Michael Smith reported memory safety bugs present in Firefox 48. Some of these bugs showed evidence of memory corruption under certain circumstances could potentially exploited to run arbitrary code.
Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory safety bugs present in Firefox 48 and Firefox ESR 45.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
blog.mozilla.org/security/2016/09/16/update-on-add-on-pinning-vulnerability/
bugzilla.mozilla.org/buglist.cgi?bug_id=1288588%2C1287204%2C1294407%2C1293347%2C1288780%2C1288555%2C1289280%2C1294095%2C1277213
bugzilla.mozilla.org/buglist.cgi?bug_id=1290244%2C1282746%2C1268034%2C1296078%2C1297099%2C1276413%2C1296087
bugzilla.mozilla.org/show_bug.cgi?id=1249522
bugzilla.mozilla.org/show_bug.cgi?id=1280387
bugzilla.mozilla.org/show_bug.cgi?id=1282076
bugzilla.mozilla.org/show_bug.cgi?id=1284690
bugzilla.mozilla.org/show_bug.cgi?id=1287316
bugzilla.mozilla.org/show_bug.cgi?id=1287721
bugzilla.mozilla.org/show_bug.cgi?id=1288946
bugzilla.mozilla.org/show_bug.cgi?id=1289085
bugzilla.mozilla.org/show_bug.cgi?id=1289970
bugzilla.mozilla.org/show_bug.cgi?id=1291016
bugzilla.mozilla.org/show_bug.cgi?id=1291665
bugzilla.mozilla.org/show_bug.cgi?id=1294677
bugzilla.mozilla.org/show_bug.cgi?id=129793
bugzilla.mozilla.org/show_bug.cgi?id=1303127
bugzilla.mozilla.org/show_bug.cgi?id=928187
bugzilla.mozilla.org/show_bug.cgi?id=932335
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
94.6%