CVE-2016-5261

Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-5257, CVE-2016-5278, CVE-2016-5270, CVE-2016-5272, CVE-2016-5274, CVE-2016-5276, CVE-2016-5277, CVE-2016-5280, CVE-2016-5281, CVE-2016-5284, CVE-2016-5250, CVE-2016-5261).

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

MozillaFirefox was updated to 45.4.0 ESR to fix the following issues (bsc#999701):

The following security issue were fixed:

• MFSA 2016-86/CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString
• MFSA 2016-86/CVE-2016-5272: Bad cast in nsImageGeometryMixin
• MFSA 2016-86/CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList
• MFSA 2016-86/CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState
• MFSA 2016-86/CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick
• MFSA 2016-86/CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame
• MFSA 2016-86/CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap
• MFSA 2016-86/CVE-2016-5281: use-after-free in DOMSVGLength
• MFSA 2016-86/CVE-2016-5284: Add-on update site certificate pin expiration
• MFSA 2016-86/CVE-2016-5250: Resource Timing API is storing resources sent by the previous page
• MFSA 2016-86/CVE-2016-5261: Integer overflow and memory corruption in WebSocketChannel
• MFSA 2016-86/CVE-2016-5257: Various memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4

MozillaFirefox was updated to version 45.4.0 ESR to fix the following issues:

Security issues fixed: (bsc#999701 MFSA 2016-86):

• CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString
• CVE-2016-5272: Bad cast in nsImageGeometryMixin
• CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList
• CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState
• CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick
• CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame
• CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap
• CVE-2016-5281: use-after-free in DOMSVGLength
• CVE-2016-5284: Add-on update site certificate pin expiration
• CVE-2016-5250: Resource Timing API is storing resources sent by the previous page
• CVE-2016-5261: Integer overflow and memory corruption in WebSocketChannel
• CVE-2016-5257: Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4

Bug fixed:

• Fix for aarch64 Firefox startup crash (bsc#991344)

MozillaFirefox was updated to 45.4.0 ESR to fix the following issues (bsc#999701):

The following security issue were fixed:

• MFSA 2016-86/CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString
• MFSA 2016-86/CVE-2016-5272: Bad cast in nsImageGeometryMixin
• MFSA 2016-86/CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList
• MFSA 2016-86/CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState
• MFSA 2016-86/CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick
• MFSA 2016-86/CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame
• MFSA 2016-86/CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap
• MFSA 2016-86/CVE-2016-5281: use-after-free in DOMSVGLength
• MFSA 2016-86/CVE-2016-5284: Add-on update site certificate pin expiration
• MFSA 2016-86/CVE-2016-5250: Resource Timing API is storing resources sent by the previous page
• MFSA 2016-86/CVE-2016-5261: Integer overflow and memory corruption in WebSocketChannel
• MFSA 2016-86/CVE-2016-5257: Various memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4

Gustavo Grieco discovered an out-of-bounds read during XML parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or obtain sensitive information. (CVE-2016-0718)

Toni Huttunen discovered that once a favicon is requested from a site, the remote server can keep the network connection open even after the page is closed. A remote attacked could potentially exploit this to track users, resulting in information disclosure. (CVE-2016-2830)

Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, Julian Seward, Carsten Book, Gary Kwong, Jesse Ruderman, Andrew McCreight, and Phil Ringnalda discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2835, CVE-2016-2836)

A buffer overflow was discovered in the ClearKey Content Decryption Module (CDM) during video playback. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via plugin process crash, or, in combination with another vulnerability to escape the GMP sandbox, execute arbitrary code. (CVE-2016-2837)

Atte Kettunen discovered a buffer overflow when rendering SVG content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2838)

Bert Massop discovered a crash in Cairo with version 0.10 of FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-2839)

Catalin Dumitru discovered that URLs of resources loaded after a navigation start could be leaked to the following page via the Resource Timing API. An attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5250)

Firas Salem discovered an issue with non-ASCII and emoji characters in data: URLs. An attacker could potentially exploit this to spoof the addressbar contents. (CVE-2016-5251)

Georg Koppen discovered a stack buffer underflow during 2D graphics rendering in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5252)

Abhishek Arya discovered a use-after-free when the alt key is used with top-level menus. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5254)

Jukka Jylänki discovered a crash during garbage collection. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-5255)

Looben Yang discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5258)

Looben Yang discovered a use-after-free when working with nested sync events in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5259)

Mike Kaply discovered that plain-text passwords can be stored in session restore if an input field type is changed from "password" to "text" during a session, leading to information disclosure. (CVE-2016-5260)

Samuel Groß discovered an integer overflow in WebSockets during data buffering in some…