Executive Summary
Summary | |
---|---|
Title | Firefox vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-2936-1 | First vendor Publication | 2016-04-27 |
Vendor | Ubuntu | Last vendor Modification | 2016-04-27 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 15.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Firefox could be made to crash or run programs as your login if it opened a malicious website. Software Description: - firefox: Mozilla Open Source web browser Details: Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup, Andrew McCreight, and Steve Fink discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2804, CVE-2016-2806, CVE-2016-2807) An invalid write was discovered when using the JavaScript .watch() method in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2808) Looben Yang discovered a use-after-free and buffer overflow in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2811, CVE-2016-2812) Sascha Just discovered a buffer overflow in libstagefright in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2814) Muneaki Nishimura discovered that CSP is not applied correctly to web content sent with the multipart/x-mixed-replace MIME type. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks when they would otherwise be prevented. (CVE-2016-2816) Muneaki Nishimura discovered that the chrome.tabs.update API for web extensions allows for navigation to javascript: URLs. A malicious extension could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-2817) Mark Goodwin discovered that about:healthreport accepts certain events from any content present in the remote-report iframe. If another vulnerability allowed the injection of web content in the remote-report iframe, an attacker could potentially exploit this to change the user's sharing preferences. (CVE-2016-2820) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: Ubuntu 15.10: Ubuntu 14.04 LTS: Ubuntu 12.04 LTS: After a standard system update you need to restart Firefox to make all the necessary changes. References: Package Information: |
Original Source
Url : http://www.ubuntu.com/usn/USN-2936-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
56 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
22 % | CWE-284 | Access Control (Authorization) Issues |
11 % | CWE-362 | Race Condition |
11 % | CWE-264 | Permissions, Privileges, and Access Controls |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2019-01-03 | Name : The remote Fedora host is missing a security update. File : fedora_2018-2513b888a4.nasl - Type : ACT_GATHER_INFO |
2019-01-03 | Name : The remote Fedora host is missing a security update. File : fedora_2018-00e90783d2.nasl - Type : ACT_GATHER_INFO |
2018-11-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-4341.nasl - Type : ACT_GATHER_INFO |
2018-10-26 | Name : The remote EulerOS Virtualization host is missing multiple security updates. File : EulerOS_SA-2018-1346.nasl - Type : ACT_GATHER_INFO |
2018-10-26 | Name : The remote EulerOS Virtualization host is missing multiple security updates. File : EulerOS_SA-2018-1337.nasl - Type : ACT_GATHER_INFO |
2018-09-27 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1303.nasl - Type : ACT_GATHER_INFO |
2018-09-27 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1302.nasl - Type : ACT_GATHER_INFO |
2018-09-19 | Name : The remote Amazon Linux 2 host is missing a security update. File : al2_ALAS-2018-1078.nasl - Type : ACT_GATHER_INFO |
2018-08-21 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2018-2439.nasl - Type : ACT_GATHER_INFO |
2018-07-24 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2018-2_0-0040.nasl - Type : ACT_GATHER_INFO |
2018-07-02 | Name : The remote Debian host is missing a security update. File : debian_DLA-1407.nasl - Type : ACT_GATHER_INFO |
2018-06-25 | Name : The remote Fedora host is missing a security update. File : fedora_2018-86026275ea.nasl - Type : ACT_GATHER_INFO |
2018-05-30 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2018-1026.nasl - Type : ACT_GATHER_INFO |
2018-05-30 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2018-1027.nasl - Type : ACT_GATHER_INFO |
2018-05-30 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2018-1028.nasl - Type : ACT_GATHER_INFO |
2018-05-23 | Name : The remote Fedora host is missing a security update. File : fedora_2018-d955395c08.nasl - Type : ACT_GATHER_INFO |
2018-05-11 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2018-130-01.nasl - Type : ACT_GATHER_INFO |
2018-05-04 | Name : The remote Fedora host is missing a security update. File : fedora_2018-8b920c2b00.nasl - Type : ACT_GATHER_INFO |
2018-05-04 | Name : The remote Fedora host is missing a security update. File : fedora_2018-7025a5c25d.nasl - Type : ACT_GATHER_INFO |
2018-04-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_57aec168453e11e88777b499baebfeaf.nasl - Type : ACT_GATHER_INFO |
2018-04-23 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-4176.nasl - Type : ACT_GATHER_INFO |
2018-04-20 | Name : The remote Debian host is missing a security update. File : debian_DLA-1355.nasl - Type : ACT_GATHER_INFO |
2018-04-19 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_7_22_rpm.nasl - Type : ACT_GATHER_INFO |
2018-04-19 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_7_22.nasl - Type : ACT_GATHER_INFO |
2018-04-19 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_6_40_rpm.nasl - Type : ACT_GATHER_INFO |
2018-04-19 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_6_40.nasl - Type : ACT_GATHER_INFO |
2018-04-19 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_5_60_rpm.nasl - Type : ACT_GATHER_INFO |
2018-04-19 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_5_60.nasl - Type : ACT_GATHER_INFO |
2017-01-04 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201701-15.nasl - Type : ACT_GATHER_INFO |
2016-07-11 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-851.nasl - Type : ACT_GATHER_INFO |
2016-07-11 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-848.nasl - Type : ACT_GATHER_INFO |
2016-06-23 | Name : The remote Debian host is missing a security update. File : debian_DLA-519.nasl - Type : ACT_GATHER_INFO |
2016-06-15 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3601.nasl - Type : ACT_GATHER_INFO |
2016-06-09 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160512_thunderbird_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2016-05-23 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1374-1.nasl - Type : ACT_GATHER_INFO |
2016-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1352-1.nasl - Type : ACT_GATHER_INFO |
2016-05-19 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2973-1.nasl - Type : ACT_GATHER_INFO |
2016-05-19 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2936-3.nasl - Type : ACT_GATHER_INFO |
2016-05-19 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1342-1.nasl - Type : ACT_GATHER_INFO |
2016-05-18 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160512_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2016-05-16 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3576.nasl - Type : ACT_GATHER_INFO |
2016-05-16 | Name : The remote Debian host is missing a security update. File : debian_DLA-472.nasl - Type : ACT_GATHER_INFO |
2016-05-13 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2016-1041.nasl - Type : ACT_GATHER_INFO |
2016-05-13 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2016-1041.nasl - Type : ACT_GATHER_INFO |
2016-05-12 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-566.nasl - Type : ACT_GATHER_INFO |
2016-05-12 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1041.nasl - Type : ACT_GATHER_INFO |
2016-05-09 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1258-1.nasl - Type : ACT_GATHER_INFO |
2016-05-06 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-541.nasl - Type : ACT_GATHER_INFO |
2016-05-03 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2936-2.nasl - Type : ACT_GATHER_INFO |
2016-05-02 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2936-1.nasl - Type : ACT_GATHER_INFO |
2016-04-29 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_46.nasl - Type : ACT_GATHER_INFO |
2016-04-29 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_45_1_esr.nasl - Type : ACT_GATHER_INFO |
2016-04-29 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_38_8_esr.nasl - Type : ACT_GATHER_INFO |
2016-04-29 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_46.nasl - Type : ACT_GATHER_INFO |
2016-04-29 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_45_1_esr.nasl - Type : ACT_GATHER_INFO |
2016-04-29 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_38_8_esr.nasl - Type : ACT_GATHER_INFO |
2016-04-28 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3559.nasl - Type : ACT_GATHER_INFO |
2016-04-27 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_92d44f83a7bf41cf91ee3d1b8ecf579f.nasl - Type : ACT_GATHER_INFO |
2016-04-27 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2016-0695.nasl - Type : ACT_GATHER_INFO |
2016-04-27 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-0695.nasl - Type : ACT_GATHER_INFO |
2016-04-27 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160426_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2016-04-27 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2016-0695.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2018-07-31 01:03:47 |
|
2016-06-17 09:58:15 |
|
2016-05-20 13:27:35 |
|
2016-05-04 13:29:44 |
|
2016-05-03 21:42:11 |
|
2016-05-03 13:30:32 |
|
2016-05-02 22:15:27 |
|
2016-04-27 17:24:10 |
|