Mozilla Foundation Security Advisory 2016-85
Security vulnerabilities fixed in Firefox 49
- Announced
- September 20, 2016
- Impact
- critical
- Products
- Firefox
- Fixed in
-
- Firefox 49
#CVE-2016-2827: Out-of-bounds read in mozilla::net::IsValidReferrerPolicy
- Reporter
- Atte Kettunen
- Impact
- low
Description
A content security policy (CSP) containing a referrer directive with no values can cause a non-exploitable crash.
References
#CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString
- Reporter
- Atte Kettunen
- Impact
- high
Description
An out-of-bounds write of a boolean value during text conversion with some unicode characters
References
#CVE-2016-5271: Out-of-bounds read in PropertyProvider::GetSpacingInternal
- Reporter
- Abhishek Arya
- Impact
- low
Description
An out-of-bounds read during the processing of text runs in some pages using display:contents.
References
#CVE-2016-5272: Bad cast in nsImageGeometryMixin
- Reporter
- Abhishek Arya
- Impact
- high
Description
A bad cast when processing layout with input elements can result in a potentially exploitable crash.
References
#CVE-2016-5273: crash in mozilla::a11y::HyperTextAccessible::GetChildOffset
- Reporter
- Nils
- Impact
- high
Description
A potentially exploitable crash in accessibility.
References
#CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList
- Reporter
- Nils
- Impact
- high
Description
A use-after-free vulnerability triggered by setting a aria-owns attribute.
References
#CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState
- Reporter
- Nils
- Impact
- high
Description
A use-after-free issue in web animations during restyling.
References
#CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick
- Reporter
- Nils
- Impact
- high
Description
A use-after-free vulnerability with web animations when destroying a timeline.
References
#CVE-2016-5275: Buffer overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions
- Reporter
- Nils
- Impact
- critical
Description
A buffer overflow when working with empty filters during canvas rendering.
References
#CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame
- Reporter
- Nils
- Impact
- critical
Description
A potentially exploitable crash caused by a buffer overflow while encoding image frames to images.
References
#CVE-2016-5279: Full local path of files is available to web pages after drag and drop
- Reporter
- Rafael Gieschke
- Impact
- moderate
Description
The full path to local files is available to scripts when local files are drag and dropped into Firefox.
References
#CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap
- Reporter
- Mei Wang
- Impact
- high
Description
Use-after-free vulnerability when changing text direction.
References
#CVE-2016-5281: use-after-free in DOMSVGLength
- Reporter
- Brian Carpenter
- Impact
- high
Description
Use-after-free vulnerability when manipulating SVG format content through script.
References
#CVE-2016-5282: Don't allow content to request favicons from non-whitelisted schemes
- Reporter
- Richard Newman
- Impact
- moderate
Description
Favicons can be loaded through non-whitelisted protocols, such as jar:.
References
#CVE-2016-5283: Iframe src fragment timing attack can reveal cross-origin data
- Reporter
- Gavin Sharp
- Impact
- high
Description
A timing attack vulnerability using iframes to potentially reveal private data using document resizes and link colors.
References
#CVE-2016-5284: Add-on update site certificate pin expiration
- Reporter
- Multiple people
- Impact
- high
Description
Due to flaws in the process we used to update "Preloaded Public Key Pinning" in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected.
References
#CVE-2016-5256: Memory safety bugs fixed in Firefox 49
- Reporter
- Mozilla developers
- Impact
- critical
Description
Mozilla developers Christoph Diehl, Christian Holler, Gary Kwong, Nathan Froyd, Honza Bambas, Seth Fowler, and Michael Smith reported memory safety bugs present in Firefox 48. Some of these bugs showed evidence of memory corruption under certain circumstances could potentially exploited to run arbitrary code.
References
#CVE-2016-5257: Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4
- Reporter
- Mozilla developers
- Impact
- critical
Description
Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory safety bugs present in Firefox 48 and Firefox ESR 45.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code.