CVE-2015-0816

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Mozilla Firefox was updated to 31.6.0 ESR to fix five security issues.

The following vulnerabilities were fixed:

• Miscellaneous memory safety hazards (MFSA 2015-30/CVE-2015-0814/CVE-2015-0815)
• Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA 2015-31/CVE-2015-0813)
• resource:// documents can load privileged pages (MFSA 2015-33/CVE-2015-0816)
• CORS requests should not follow 30x redirections after preflight (MFSA 2015-37/CVE-2015-0807)
• Same-origin bypass through anchor navigation (MFSA 2015-40/CVE-2015-0801)

Mozilla Firefox was updated to 31.6.0 ESR to fix five security issues.

The following vulnerabilities were fixed:

• Miscellaneous memory safety hazards (MFSA 2015-30/CVE-2015-0814/CVE-2015-0815)
• Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA 2015-31/CVE-2015-0813)
• resource:// documents can load privileged pages (MFSA 2015-33/CVE-2015-0816)
• CORS requests should not follow 30x redirections after preflight (MFSA 2015-37/CVE-2015-0807)
• Same-origin bypass through anchor navigation (MFSA 2015-40/CVE-2015-0801)

Mozilla Firefox was updated to 31.6.0 ESR to fix five security issues.

The following vulnerabilities have been fixed:

* Miscellaneous memory safety hazards (MFSA
  2015-30/CVE-2015-0814/CVE-2015-0815)
* Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA
  2015-31/CVE-2015-0813)
* resource:// documents can load privileged pages (MFSA
  2015-33/CVE-2015-0816)
* CORS requests should not follow 30x redirections after preflight
  (MFSA 2015-37/CVE-2015-0807)
* Same-origin bypass through anchor navigation (MFSA
  2015-40/CVE-2015-0801)

Security Issues:

* CVE-2015-0801
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0801>
* CVE-2015-0807
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0807>
* CVE-2015-0813
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0813>
* CVE-2015-0814
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0814>
* CVE-2015-0816
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0816>

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.

Olli Pettay and Boris Zbarsky discovered an issue during anchor navigations in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin policy restrictions. (CVE-2015-0801)

Bobby Holley discovered that windows created to hold privileged UI content retained access to privileged internal methods if navigated to unprivileged content. An attacker could potentially exploit this in combination with another flaw, in order to execute arbitrary script in a privileged context. (CVE-2015-0802)

Several type confusion issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0803, CVE-2015-0804)

Abhishek Arya discovered memory corruption issues during 2D graphics rendering. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0805, CVE-2015-0806)

Christoph Kerschbaumer discovered that CORS requests from navigator.sendBeacon() followed 30x redirections after preflight. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2015-0807)

Mitchell Harper discovered an issue with memory management of simple-type arrays in WebRTC. An attacker could potentially exploit this to cause undefined behaviour. (CVE-2015-0808)

Felix Gröbert discovered an out-of-bounds read in the QCMS colour management library. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0811)

Armin Razmdjou discovered that lightweight themes could be installed in Firefox without a user approval message, from Mozilla subdomains over HTTP without SSL. A remote attacker could potentially exploit this by conducting a Machine-In-The-Middle (MITM) attack to install themes without user approval. (CVE-2015-0812)

Aki Helin discovered a use-after-free when playing MP3 audio files using the Fluendo MP3 GStreamer plugin in certain circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0813)

Christian Holler, Andrew McCreight, Gary Kwong, Karl Tomlinson, Randell Jesup, Shu-yu Guo, Steve Fink, Tooru Fujisawa, and Byron Campen discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0814, CVE-2015-0815)

Mariusz Mlynski discovered that documents loaded via resource: URLs (such as PDF.js) could load privileged chrome pages. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in combination with another flaw, in order to execute arbitrary script in a privileged context. (CVE-2015-0816)

Olli Pettay and Boris Zbarsky discovered an issue during anchor navigations in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to bypass same-origin policy restrictions. (CVE-2015-0801)

Christoph Kerschbaumer discovered that CORS requests from navigator.sendBeacon() followed 30x redirections after preflight. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2015-0807)

Aki Helin discovered a use-after-free when playing MP3 audio files using the Fluendo MP3 GStreamer plugin in certain circumstances. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-0813)

Christian Holler, Steve Fink, and Byron Campen discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-0815)

Mariusz Mlynski discovered that documents loaded via resource: URLs (such as PDF.js) could load privileged chrome pages. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this in combination with another flaw, in order to execute arbitrary script in a privileged context. (CVE-2015-0816)