| Description: | Summary:
Mozilla Firefox is prone to multiple vulnerabilities.
Vulnerability Insight:
Multiple flaws exist due to:
- Multiple memory-corruption vulnerabilities.
- An error in the image parsing code during the de-interlacing of a
maliciously crafted GIF formatted image resulting in a possible integer
overflow.
- A buffer-overflow vulnerability.
- A security bypass vulnerability, that allows for control characters to be
set in cookie names.
- A lack of delay following user click events in the protocol handler dialog,
resulting in double click events to be treated as two single click events.
- Calculations with mp_div and mp_exptmod in Network Security Services (NSS)
can produce wrong results in some circumstances, leading to potential
cryptographic weaknesses.
- Multiple security bypass vulnerabilities exist for address bar spoofing
attacks, that can lead to potential spoofing.
- A Use-after-free vulnerability in the 'ssl3_HandleECDHServerKeyExchange'
function.
Vulnerability Impact:
Successful exploitation will allow
an attacker to bypass security restrictions and perform unauthorized actions,
obtain sensitive information, bypass same-origin policy restrictions to
access data, and execute arbitrary code in the context of the affected
application. Failed exploit attempts will likely result in
denial-of-service conditions.
Affected Software/OS:
Mozilla Firefox version before 44.
Solution:
Update version 44 or later.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
