CVE-2016-9905

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895, CVE-2016-9897, CVE-2016-9898, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9904, CVE-2016-9905).

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption (CVE-2016-9899).

Event handlers on marquee elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript (CVE-2016-9895).

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES (CVE-2016-9897).

Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor (CVE-2016-9898).

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of data: URLs. This could allow for cross-domain data leakage (CVE-2016-9900).

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites (CVE-2016-9904).

A potentially exploitable crash in EnumerateSubDocuments while adding or removing sub-documents (CVE-2016-9905).

Mozilla developers and community members Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky reported memory safety bugs present in Thunderbird ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code (CVE-2016-9893).

This update to Mozilla Thunderbird 45.6.0 fixes security issues and bugs.

In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

The following vulnerabilities were fixed: (boo#1015422)

• CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
• CVE-2016-9895: CSP bypass using marquee tag
• CVE-2016-9897: Memory corruption in libGLES
• CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
• CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
• CVE-2016-9904: Cross-origin information leak in shared atoms
• CVE-2016-9905: Crash in EnumerateSubDocuments
• CVE-2016-9893: Memory safety bugs fixed in Thunderbird 45.6

The following bugs were fixed:

• The system integration dialog was shown every time when starting Thunderbird

This update to Mozilla Thunderbird 45.6.0 fixes security issues and bugs.

In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

The following vulnerabilities were fixed: (boo#1015422)

• CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
• CVE-2016-9895: CSP bypass using marquee tag
• CVE-2016-9897: Memory corruption in libGLES
• CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
• CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
• CVE-2016-9904: Cross-origin information leak in shared atoms
• CVE-2016-9905: Crash in EnumerateSubDocuments
• CVE-2016-9893: Memory safety bugs fixed in Thunderbird 45.6

The following bugs were fixed:

• The system integration dialog was shown every time when starting Thunderbird

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues:

• MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES
• MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution
• MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
• MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
• MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms
• MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments
• MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag
• MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
• MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
• MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events

Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information.

Also the following bug was fixed:

• Fix fontconfig issue (bsc#1000751) on 32bit systems as well.

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues:

• MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES
• MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution
• MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
• MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
• MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms
• MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments
• MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag
• MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
• MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
• MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events

Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information.

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues:

• MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES
• MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution
• MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
• MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
• MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms
• MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments
• MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag
• MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
• MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
• MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events

Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information.

• Fix fontconfig issue (bsc#1000751) on 32bit systems as well.

Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9893, CVE-2017-5373)

Andrew Krasichkov discovered that event handlers on <marquee> elements were executed despite a Content Security Policy (CSP) that disallowed inline JavaScript. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-9895)

A memory corruption issue was discovered in WebGL in some circumstances. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9897)

A use-after-free was discovered when manipulating DOM subtrees in the Editor. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9898)

A use-after-free was discovered when manipulating DOM events and audio elements. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9899)

It was discovered that external resources that should be blocked when loading SVG images can bypass security restrictions using data: URLs. An attacker could potentially exploit this to obtain sensitive information. (CVE-2016-9900)

Jann Horn discovered that JavaScript Map/Set were vulnerable to timing attacks. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to obtain sensitive information across domains. (CVE-2016-9904)

A crash was discovered in EnumerateSubDocuments while adding or removing sub-documents. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-9905)

JIT code allocation can allow a bypass of ASLR protections in some circumstances. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5375)

Nicolas Grégoire discovered a use-after-free when manipulating XSL in XSLT documents in some circumstances. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5376)

Jann Horn discovered that an object's address could be discovered through hashed codes of JavaScript objects shared between pages. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to obtain sensitive information. (CVE-2017-5378)

A use-after-free was discovered during DOM manipulation of SVG content in some circumstances. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5380)

Armin Razmjou discovered that certain unicode glyphs do not trigger punycode display. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to spoof the URL bar contents. (CVE-2017-5383)

Jerri Rice discovered insecure communication methods in the Dev Tools JSON Viewer. An attacker could potentially exploit this to gain…