| Description: | Summary:
Mozilla Firefox is prone to multiple vulnerabilities.
Vulnerability Insight:
The following flaws exist:
- Use-after-free vulnerability in the 'nsContentUtils::ContentIsHostIncludingDescendantOf'
function
- Improper data initialization in the 'txXPathNodeUtils::getBaseURI' function
- An error in 'Worker::SetEventListener' function in the Web workers implementation
- Use-after-free vulnerability in 'nsEventListenerManager::SetEventHandler' function
- Use-after-free vulnerability in 'nsIOService::NewChannelFromURIWithProxyFlags' function
- Use-after-free vulnerability in the 'nsIPresShell::GetPresContext' function
- Improper handling of the appending of an IFRAME element in 'PDF.js'
- Use-after-free vulnerability in 'nsDocLoader::doStopDocumentLoad' function
- Multiple unspecified vulnerabilities in the browser engine
- Improper restriction of the nature or placement of HTML within a dropdown menu
- Improper memory allocation for unspecified functions by JavaScript engine
- Improper determination of the thread for release of an image object
Vulnerability Impact:
Successful exploitation will allow attackers to execute arbitrary
code, cause a denial of service, spoof the address bar, conduct clickjacking attacks and conduct
buffer overflow attacks.
Affected Software/OS:
Mozilla Firefox before version 25.0 on Mac OS X.
Solution:
Update to version 25.0 or later.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
