ArchLinux: 201609-22: firefox: multiple issues
Summary
- CVE-2016-5256 (arbitrary code execution)
Mozilla developers Christoph Diehl, Christian Holler, Gary Kwong,
Nathan Froyd, Honza Bambas, Seth Fowler, and Michael Smith reported
memory safety bugs present in Firefox 48. Some of these bugs showed
evidence of memory corruption under certain circumstances could
potentially exploited to run arbitrary code.
- CVE-2016-5257 (arbitrary code execution)
Mozilla developers and community members Christoph Diehl, Andrew
McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson
Smith, Philipp, and Carsten Book reported memory safety bugs present in
Firefox 48 and Firefox ESR 45.3. Some of these bugs showed evidence of
memory corruption and we presume that with enough effort at least some
of these could be exploited to run arbitrary code.
- CVE-2016-5270 (arbitrary code execution)
An out-of-bounds write of a boolean value during text conversion with
some unicode characters.
- CVE-2016-5271 (information disclosure)
An out-of-bounds read during the processing of text runs in some pages
using display:contents.
- CVE-2016-5272 (arbitrary code execution)
A bad cast when processing layout with input elements can result in a
potentially exploitable crash.
- CVE-2016-5273 (arbitrary code execution)
A potentially exploitable crash in accessibility in the
mozilla::a11y::HyperTextAccessible::GetChildOffset function.
- CVE-2016-5274 (arbitrary code execution)
A use-after-free vulnerability has been discovered in the
nsFrameManager::CaptureFrameState function in web animations during
restyling.
- CVE-2016-5275 (arbitrary code execution)
A buffer overflow vulnerability has been discovered in the
mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function when
working with empty filters during canvas rendering.
- CVE-2016-5276 (arbitrary code execution)
A use-after-free vulnerability has been discovered in the
mozilla::a11y::DocAccessible::ProcessInvalidationList function
triggered by setting a aria-owns attribute.
- CVE-2016-5277 (arbitrary code execution)
A user-after-free vulnerability has been disconvered in the
nsRefreshDriver::Tick function with web animations when destroying a
timeline.
- CVE-2016-5278 (arbitrary code execution)
A potentially exploitable crash caused by a heap based buffer overflow
has been discovered in the nsBMPEncoder::AddImageFrame function while
encoding image frames to images.
- CVE-2016-5279 (information disclosure)
The full path to local files is available to scripts when local files
are drag and dropped into Firefox.
- CVE-2016-5280 (arbitrary code execution)
A use-after-free vulnerability has been discovered in the
mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function
when changing text direction.
- CVE-2016-5281 (arbitrary code execution)
A use-after-free vulnerability has been discovered in the DOMSVGLength
when manipulating SVG format content through a script.
- CVE-2016-5282 (access restriction bypass)
Favicons can be loaded through non-whitelisted protocols, such as jar.
- CVE-2016-5283 (information disclosure)
A timing attack vulnerability was discovered using iframes to
potentially reveal private cross-origin data using document resizes and
link colors.
- CVE-2016-5284 (certificate verification bypass)
Due to flaws in the process used to update "Preloaded Public Key
Pinning", the pinning for add-on updates became ineffective in early
September. An attacker who was able to get a mis-issued certificate for
a Mozilla web site could send malicious add-on updates to users on
networks controlled by the attacker. Users who have not installed any
add-ons are not affected.
Resolution
Upgrade to 49.0-1.
# pacman -Syu "firefox>=49.0-1"
The problems have been fixed upstream in version 49.0.
References
https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/ https://access.redhat.com/security/cve/CVE-2016-5256 https://access.redhat.com/security/cve/CVE-2016-5257 https://access.redhat.com/security/cve/CVE-2016-5270 https://access.redhat.com/security/cve/CVE-2016-5271 https://access.redhat.com/security/cve/CVE-2016-5272 https://access.redhat.com/security/cve/CVE-2016-5273 https://access.redhat.com/security/cve/CVE-2016-5274 https://access.redhat.com/security/cve/CVE-2016-5275 https://access.redhat.com/security/cve/CVE-2016-5276 https://access.redhat.com/security/cve/CVE-2016-5277 https://access.redhat.com/security/cve/CVE-2016-5278 https://access.redhat.com/security/cve/CVE-2016-5279 https://access.redhat.com/security/cve/CVE-2016-5280 https://access.redhat.com/security/cve/CVE-2016-5281 https://access.redhat.com/security/cve/CVE-2016-5282 https://access.redhat.com/security/cve/CVE-2016-5283 https://access.redhat.com/security/cve/CVE-2016-5284
Workaround
None.