[arch-security] [ASA-201604-15] firefox: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201604-15
==========================================

Severity: Critical
Date    : 2016-04-30
CVE-ID  : CVE-2016-2804 CVE-2016-2805 CVE-2016-2806 CVE-2016-2807
CVE-2016-2808 CVE-2016-2811 CVE-2016-2812 CVE-2016-2814 CVE-2016-2816
CVE-2016-2817 CVE-2016-2820
Package : firefox
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package firefox before version 46.0-2 is vulnerable to multiple
issues, up to arbitrary code execution.

Resolution
==========

Upgrade to 46.0-2.

# pacman -Syu "firefox>=46.0-2"

The problem has been fixed upstream in version 46.0.

Workaround
==========

None.

Description
===========

- CVE-2016-2804:

Gary Kwong, Christian Holler, Andrew McCreight, Boris Zbarsky, and Steve
Fink reported memory safety problems and crashes that are fixed in
Firefox 46.

- CVE-2016-2805:

Christian Holler reported a memory safety problem that is fixed in
Firefox ESR 38.8.

- CVE-2016-2806:

Gary Kwong, Christian Holler, Jesse Ruderman, Mats Palmgren, Carsten
Book, Boris Zbarsky, David Bolter, and Randell Jesup reported memory
safety problems and crashes that are fixed in Firefox ESR 45.1 and
Firefox 46.

- CVE-2016-2807:

Christian Holler, Tyson Smith, and Phil Ringalda reported memory safety
problems and crashes that are fixed in Firefox ESR 45.1, Firefox ESR
38.8 and Firefox 46.

- CVE-2016-2808:

The CESG, the Information Security Arm of GCHQ, reported that the
JavaScript .watch() method could be used to overflow the 32-bit
generation count of the underlying HashMap, resulting in a write to an
invalid entry. Under the right conditions this write could lead to
arbitrary code execution. The overflow takes considerable time and a
malicious page would require a user to keep it open for the duration of
the attack.

- CVE-2016-2811, CVE-2016-2812:

Security researcher Looben Yang reported two issues discovered in
Service Workers using Address Sanitizer.

The first of these is a use-after-free vulnerability caused by a
ServiceWorkerInfo object being kept active beyond the life its owning
registration. When it is later called through this registration, a
use-after-free results.

In the second issue, a race condition leading to a buffer overflow was
found in the ServiceWorkerManager. This leads to a potentially
exploitable crash when triggered.

- CVE-2016-2814:

Using Address Sanitizer, security researcher Sascha Just reported a
buffer overflow in the libstagefright library due to issues with the
handling of CENC offsets and the sizes table. This results in a
potentially exploitable crash triggerable through web content.

- CVE-2016-2816:

Security researcher Muneaki Nishimura (nishimunea) of Recruit
Technologies Co., Ltd. reported that Content Security Policy (CSP) is
not applied correctly to web content sent with the
multipart/x-mixed-replace MIME type. This allows for script to run in
instances where CSP should block it, leading to a failure to prevent
potential cross-site scripting (XSS) and other attacks against the web page.

- CVE-2016-2817:

Security researcher Muneaki Nishimura (nishimunea) of Recruit
Technologies Co., Ltd. reported that the chrome.tabs.update API for web
extensions allows for navigation to javascript: URLs without additional
permissions. This can used to elevate privilege for a universal
cross-site scripting (XSS) attack by a malicious web extension. It can
also be used to inject content into other extensions if they load
content within browser tabs.

- CVE-2016-2820:

Mozilla engineer Mark Goodwin discovered that the Firefox Health Report
(about:healthreport) accepts certain events from any content document
present in the remote-report iframe. If there were another vulnerability
that allowed the injection of web content into the Firefox Health Report
iframe, this content could change the sharing preferences of a user by
firing the appropriate events at it s containing page.


Impact
======

A remote attacker can bypass security policies, cause a denial of
service or execute arbitrary code on the affected host.

References
==========

https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox46
https://www.mozilla.org/en-US/security/advisories/mfsa2016-39/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-42/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-44/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-45/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-46/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-47/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-48/
https://access.redhat.com/security/cve/CVE-2016-2804
https://access.redhat.com/security/cve/CVE-2016-2805
https://access.redhat.com/security/cve/CVE-2016-2806
https://access.redhat.com/security/cve/CVE-2016-2807
https://access.redhat.com/security/cve/CVE-2016-2808
https://access.redhat.com/security/cve/CVE-2016-2811
https://access.redhat.com/security/cve/CVE-2016-2812
https://access.redhat.com/security/cve/CVE-2016-2814
https://access.redhat.com/security/cve/CVE-2016-2816
https://access.redhat.com/security/cve/CVE-2016-2817
https://access.redhat.com/security/cve/CVE-2016-2820

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20160430/5582a682/attachment.asc>