Executive Summary
Summary | |
---|---|
Title | Firefox vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-2993-1 | First vendor Publication | 2016-06-09 |
Vendor | Ubuntu | Last vendor Modification | 2016-06-09 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 15.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Firefox could be made to crash or run programs as your login if it opened a malicious website. Software Description: - firefox: Mozilla Open Source web browser Details: Christian Holler, Gary Kwong, Jesse Ruderman, Tyson Smith, Timothy Nikkel, Sylvestre Ledru, Julian Seward, Olli Pettay, Karl Tomlinson, Christoph Diehl, Julian Hector, Jan de Mooij, Mats Palmgren, and Tooru Fujisawa discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2815, CVE-2016-2818) A buffer overflow was discovered when parsing HTML5 fragments in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2819) A use-after-free was discovered in contenteditable mode in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2821) Jordi Chancel discovered a way to use a persistent menu within a Armin Razmdjou that the location.host property can be set to an arbitrary string after creating an invalid data: URI. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass some same-origin protections. (CVE-2016-2825) A use-after-free was discovered when processing WebGL content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2828) Tim McCormack discovered that the permissions notification can show the wrong icon when a page requests several permissions in quick succession. An attacker could potentially exploit this by tricking the user in to giving consent for access to the wrong resource. (CVE-2016-2829) It was discovered that a pointerlock can be created in a fullscreen window without user consent in some circumstances, and this pointerlock cannot be cancelled without quitting Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service or conduct clickjacking attacks. (CVE-2016-2831) John Schoenick discovered that CSS pseudo-classes can leak information about plugins that are installed but disabled. An attacker could potentially exploit this to fingerprint users. (CVE-2016-2832) Matt Wobensmith discovered that Content Security Policy (CSP) does not block the loading of cross-domain Java applets when specified by policy. An attacker could potentially exploit this to bypass CSP protections and conduct cross-site scripting (XSS) attacks. (CVE-2016-2833) In addition, multiple unspecified security issues were discovered in NSS. (CVE-2016-2834) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: Ubuntu 15.10: Ubuntu 14.04 LTS: Ubuntu 12.04 LTS: After a standard system update you need to restart Firefox to make all the necessary changes. References: Package Information: |
Original Source
Url : http://www.ubuntu.com/usn/USN-2993-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
36 % | CWE-284 | Access Control (Authorization) Issues |
27 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
18 % | CWE-254 | Security Features |
9 % | CWE-200 | Information Exposure |
9 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2017-05-12 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-1248-1.nasl - Type : ACT_GATHER_INFO |
2017-05-12 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15479471.nasl - Type : ACT_GATHER_INFO |
2017-05-05 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-1175-1.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2016-1084.nasl - Type : ACT_GATHER_INFO |
2016-12-16 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-774.nasl - Type : ACT_GATHER_INFO |
2016-11-22 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20161116_nss_and_nss_util_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2016-11-21 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-2779.nasl - Type : ACT_GATHER_INFO |
2016-11-17 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-2779.nasl - Type : ACT_GATHER_INFO |
2016-11-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2779.nasl - Type : ACT_GATHER_INFO |
2016-10-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3688.nasl - Type : ACT_GATHER_INFO |
2016-09-02 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2061-1.nasl - Type : ACT_GATHER_INFO |
2016-08-29 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1799-1.nasl - Type : ACT_GATHER_INFO |
2016-08-29 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1691-1.nasl - Type : ACT_GATHER_INFO |
2016-08-15 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3647.nasl - Type : ACT_GATHER_INFO |
2016-08-01 | Name : The remote Debian host is missing a security update. File : debian_DLA-572.nasl - Type : ACT_GATHER_INFO |
2016-07-19 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3023-1.nasl - Type : ACT_GATHER_INFO |
2016-07-13 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160711_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2016-07-12 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2016-1392.nasl - Type : ACT_GATHER_INFO |
2016-07-12 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3029-1.nasl - Type : ACT_GATHER_INFO |
2016-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2016-1392.nasl - Type : ACT_GATHER_INFO |
2016-07-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1392.nasl - Type : ACT_GATHER_INFO |
2016-07-11 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-851.nasl - Type : ACT_GATHER_INFO |
2016-07-11 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-848.nasl - Type : ACT_GATHER_INFO |
2016-06-27 | Name : The remote Debian host is missing a security update. File : debian_DLA-527.nasl - Type : ACT_GATHER_INFO |
2016-06-20 | Name : The remote Debian host is missing a security update. File : debian_DLA-521.nasl - Type : ACT_GATHER_INFO |
2016-06-17 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160608_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2016-06-17 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2016-1217.nasl - Type : ACT_GATHER_INFO |
2016-06-14 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-704.nasl - Type : ACT_GATHER_INFO |
2016-06-14 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-714.nasl - Type : ACT_GATHER_INFO |
2016-06-10 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2993-1.nasl - Type : ACT_GATHER_INFO |
2016-06-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3600.nasl - Type : ACT_GATHER_INFO |
2016-06-09 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1217.nasl - Type : ACT_GATHER_INFO |
2016-06-09 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2016-1217.nasl - Type : ACT_GATHER_INFO |
2016-06-09 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_47.nasl - Type : ACT_GATHER_INFO |
2016-06-09 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_45_2_esr.nasl - Type : ACT_GATHER_INFO |
2016-06-09 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_47.nasl - Type : ACT_GATHER_INFO |
2016-06-09 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_45_2_esr.nasl - Type : ACT_GATHER_INFO |
2016-06-08 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3216608253fa41fab081207e7a989a0a.nasl - Type : ACT_GATHER_INFO |
2016-06-08 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_8065d37b8e7c4707a6081b0a2b8509c3.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-06-16 00:37:25 |
|
2016-06-13 17:35:51 |
|
2016-06-11 13:27:47 |
|
2016-06-09 21:25:19 |
|