[3.4] firefox-esr: Security vulnerabilities (CVE-2016-5270, CVE-2016-5272, CVE-2016-5276, CVE-2016-5274, CVE-2016-5277, CVE-2016-5278, CVE-2016-5280, CVE-2016-5281, CVE-2016-5284, CVE-2016-5250, CVE-2016-5261, CVE-2016-5257)
Fixed in: Firefox ESR 45.4
CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString
An out-of-bounds write of a boolean value during text conversion with some unicode characters. [1291016]
CVE-2016-5272 - Bad cast in nsImageGeometryMixin
A bad cast when processing layout with input elements can result in a potentially exploitable crash. [1297934]
CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList
A use-after-free vulnerability triggered by setting a aria-owns attribute [1287721]
CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState
A use-after-free issue in web animations during restyling. [1282076]
CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick
A use-after-free vulnerability with web animations when destroying a timeline [1291665]
CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame
A potentially exploitable crash caused by a buffer overflow while encoding image frames to images [1294677]
CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap
Use-after-free vulnerability when changing text direction [1289970]
CVE-2016-5281 - use-after-free in DOMSVGLength
Use-after-free vulnerability when manipulating SVG format content through script [1284690]
CVE-2016-5284 - Add-on update site certificate pin expiration
Due to flaws in the process we used to update “Preloaded Public Key
Pinning” in our releases, the pinning for add-on updates became
ineffective in early September.
An attacker who was able to get a mis-issued certificate for a Mozilla
web site could send malicious add-on updates to users on networks
controlled by the attacker. Users who have not installed any add-ons are
not affected. [1303127]
CVE-2016-5250 - Resource Timing API is storing resources sent by the previous page
URLs of resources loaded after a navigation started can leak to the following page through the Resource Timing API, leading to potential information disclosure. [1254688]
CVE-2016-5261 - Integer overflow and memory corruption in WebSocketChannel
An integer overflow error in WebSockets during data buffering on incoming packets resulting in attacker controlled data being written at a known offset in the allocated buffer. [1287266]
CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4
Memory safety bugs present in Firefox 48 and Firefox ESR 45.3. Some of
these bugs showed evidence of memory corruption and we presume that with
enough effort at least some of
these could be exploited to run arbitrary code. [Memory safety bugs
fixed in Firefox 49 and Firefox ESR 45.4]
Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2016-86/
(from redmine: issue id 6239, created on 2016-09-28, closed on 2016-10-04)
- Relations:
- parent #6238 (closed)
- Changesets:
- Revision 77d84e1e by Natanael Copa on 2016-09-28T18:37:12Z:
community/firefox-esr: upgrade to 45.4.0
fixes #6239