CVE-2016-2806

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Updated firefox packages fix security vulnerabilities:

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-2805, CVE-2016-2806, CVE-2016-2807, CVE-2016-2808, CVE-2016-2814).

This update contains Mozilla Thunderbird 45.2. (boo#983549)

It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail.

The following vulnerabilities were fixed:

• CVE-2016-2818, CVE-2016-2815: Memory safety bugs (boo#983549, MFSA2016-49)

Contains the following security fixes from the 45.1 release: (boo#977333)

• CVE-2016-2806, CVE-2016-2807: Miscellaneous memory safety hazards (boo#977375, boo#977376, MFSA 2016-39)

Contains the following security fixes from the 45.0 release: (boo#969894)

• CVE-2016-1952, CVE-2016-1953: Miscellaneous memory safety hazards (MFSA 2016-16)
• CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)
• CVE-2016-1955: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18)
• CVE-2016-1956: Linux video memory DOS with Intel drivers (MFSA 2016-19)
• CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20)
• CVE-2016-1960: Use-after-free in HTML5 string parser (MFSA 2016-23)
• CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24)
• CVE-2016-1964: Use-after-free during XML transformations (MFSA 2016-27)
• CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34)

The graphite font shaping library was disabled, addressing the following font vulnerabilities:

• MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

The following tracked packaging changes are included:

• fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637)
• gcc6 fixes (boo#986162)
• running on 48bit va aarch64 (boo#984126)

This update contains Mozilla Thunderbird 45.2. (boo#983549)

It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail.

The following vulnerabilities were fixed:

• CVE-2016-2818, CVE-2016-2815: Memory safety bugs (boo#983549, MFSA2016-49)

Contains the following security fixes from the 45.1 release: (boo#977333)

• CVE-2016-2806, CVE-2016-2807: Miscellaneous memory safety hazards (boo#977375, boo#977376, MFSA 2016-39)

Contains the following security fixes from the 45.0 release: (boo#969894)

• CVE-2016-1952, CVE-2016-1953: Miscellaneous memory safety hazards (MFSA 2016-16)
• CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)
• CVE-2016-1955: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18)
• CVE-2016-1956: Linux video memory DOS with Intel drivers (MFSA 2016-19)
• CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20)
• CVE-2016-1960: Use-after-free in HTML5 string parser (MFSA 2016-23)
• CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24)
• CVE-2016-1964: Use-after-free during XML transformations (MFSA 2016-27)
• CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34)

The graphite font shaping library was disabled, addressing the following font vulnerabilities:

• MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

The following tracked packaging changes are included:

• fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637)
• gcc6 fixes (boo#986162)
• running on 48bit va aarch64 (boo#984126)

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup, Andrew McCreight, and Steve Fink discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2804, CVE-2016-2806, CVE-2016-2807)

An invalid write was discovered when using the JavaScript .watch() method in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2808)

Looben Yang discovered a use-after-free and buffer overflow in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2811, CVE-2016-2812)

Sascha Just discovered a buffer overflow in libstagefright in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2814)

Muneaki Nishimura discovered that CSP is not applied correctly to web content sent with the multipart/x-mixed-replace MIME type. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks when they would otherwise be prevented. (CVE-2016-2816)

Muneaki Nishimura discovered that the chrome.tabs.update API for web extensions allows for navigation to javascript: URLs. A malicious extension could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-2817)

Mark Goodwin discovered that about:healthreport accepts certain events from any content present in the remote-report iframe. If another vulnerability allowed the injection of web content in the remote-report iframe, an attacker could potentially exploit this to change the user's sharing preferences. (CVE-2016-2820)