USN-3124-1: Firefox vulnerabilities

Ubuntu Security Notice USN-3124-1

18th November, 2016

firefox vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10



• Ubuntu 16.04 LTS



• Ubuntu 14.04 LTS



• Ubuntu 12.04 LTS

Summary

Firefox could be made to crash or run programs as your login if it
opened a malicious website.

Software description

• firefox
  - Mozilla Open Source web browser
  
  

Details

Christian Holler, Andrew McCreight, Dan Minor, Tyson Smith, Jon Coppeard,
Jan-Ivar Bruaroey, Jesse Ruderman, Markus Stange, Olli Pettay, Ehsan
Akhgari, Gary Kwong, Tooru Fujisawa, and Randell Jesup discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary
code. ()

A same-origin policy bypass was discovered with local HTML files in some
circumstances. An attacker could potentially exploit this to obtain
sensitive information. ()

A heap buffer-overflow was discovered in Cairo when processing SVG
content. If a user were tricked in to opening a specially crafted website,
an attacker could potentially exploit this to cause a denial of service
via application crash, or execute arbitrary code. ()

An integer overflow was discovered in the Expat library. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via application
crash. ()

A buffer overflow was discovered in nsScriptLoadHandler. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via application
crash, or execute arbitrary code. (,
)

It was discovered that a page loaded in to the sidebar through a bookmark
could reference a privileged chrome window. An attacker could potentially
exploit this to bypass same origin restrictions. ()

An issue was discovered with the windows.create() WebExtensions API. If a
user were tricked in to installing a malicious extension, an attacker
could potentially exploit this to escape the WebExtensions sandbox.
()

It was discovered that <select> element dropdown menus can cover location
bar content when e10s is enabled. An attacker could potentially exploit
this to conduct UI spoofing attacks. ()

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

Ubuntu 16.04 LTS:

Ubuntu 14.04 LTS:

Ubuntu 12.04 LTS:

To update your system, please follow these instructions:
,

,

,

,

,

,

,

,

,

CVE-2016-9077