Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2016-86

Security vulnerabilities fixed in Firefox ESR 45.4

Announced
September 20, 2016
Impact
critical
Products
Firefox ESR
Fixed in
  • Firefox ESR 45.4

#CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString

Reporter
Atte Kettunen
Impact
high
Description

An out-of-bounds write of a boolean value during text conversion with some unicode characters

References

#CVE-2016-5272: Bad cast in nsImageGeometryMixin

Reporter
Abhishek Arya
Impact
high
Description

A bad cast when processing layout with input elements can result in a potentially exploitable crash.

References

#CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList

Reporter
Nils
Impact
high
Description

A use-after-free vulnerability triggered by setting a aria-owns attribute.

References

#CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState

Reporter
Nils
Impact
high
Description

A use-after-free issue in web animations during restyling.

References

#CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick

Reporter
Nils
Impact
high
Description

A use-after-free vulnerability with web animations when destroying a timeline.

References

#CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame

Reporter
Nils
Impact
critical
Description

A potentially exploitable crash caused by a buffer overflow while encoding image frames to images.

References

#CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap

Reporter
Mei Wang
Impact
high
Description

Use-after-free vulnerability when changing text direction.

References

#CVE-2016-5281: use-after-free in DOMSVGLength

Reporter
Brian Carpenter
Impact
high
Description

Use-after-free vulnerability when manipulating SVG format content through script.

References

#CVE-2016-5284: Add-on update site certificate pin expiration

Reporter
Multiple people
Impact
high
Description

Due to flaws in the process we used to update "Preloaded Public Key Pinning" in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected.

References

#CVE-2016-5250: Timing API is storing resources sent by the previous page

Reporter
Catalin Dumitru
Impact
moderate
Description

URLs of resources loaded after a navigation started can leak to the following page through the Resource Timing API, leading to potential information disclosure.

References

#CVE-2016-5261: Integer overflow and memory corruption in WebSocketChannel

Reporter
Samuel Groß
Impact
high
Description

An integer overflow error in WebSockets during data buffering on incoming packets resulting in attacker controlled data being written at a known offset in the allocated buffer.

References

#CVE-2016-5257: Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4

Reporter
Mozilla developers
Impact
critical
Description

Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory safety bugs present in Firefox 48 and Firefox ESR 45.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

References