CVE-2016-2814

Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.

Updated firefox packages fix security vulnerabilities:

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-2805, CVE-2016-2806, CVE-2016-2807, CVE-2016-2808, CVE-2016-2814).

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update to MozillaFirefox 38.8.0 ESR fixes the following issues (bsc#977333):

• CVE-2016-2805: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977374)
• CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977376)
• CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (bsc#977381)
• CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (bsc#977386)

This update to MozillaFirefox 38.8.0 ESR fixes the following security issues (bsc#977333):

• CVE-2016-2805: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977374)
• CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977376)
• CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (bsc#977386)
• CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (bsc#977381)

This update to MozillaFirefox 38.8.0 ESR fixes the following security issues (bsc#977333):

• CVE-2016-2805: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977374)
• CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977376)
• CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (bsc#977386)
• CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (bsc#977381)

Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup, Andrew McCreight, and Steve Fink discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2804, CVE-2016-2806, CVE-2016-2807)

An invalid write was discovered when using the JavaScript .watch() method in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2808)

Looben Yang discovered a use-after-free and buffer overflow in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2811, CVE-2016-2812)

Sascha Just discovered a buffer overflow in libstagefright in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2814)

Muneaki Nishimura discovered that CSP is not applied correctly to web content sent with the multipart/x-mixed-replace MIME type. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks when they would otherwise be prevented. (CVE-2016-2816)

Muneaki Nishimura discovered that the chrome.tabs.update API for web extensions allows for navigation to javascript: URLs. A malicious extension could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-2817)

Mark Goodwin discovered that about:healthreport accepts certain events from any content present in the remote-report iframe. If another vulnerability allowed the injection of web content in the remote-report iframe, an attacker could potentially exploit this to change the user's sharing preferences. (CVE-2016-2820)