| Description: | Summary:
Mozilla Firefox ESR is prone to multiple vulnerabilities.
Vulnerability Insight:
Multiple flaws exist due to:
- An use-after-free in SMIL animation functions,
- An use-after-free during transaction processing in the editor,
- An out-of-bounds write with malicious font in Graphite 2,
- An out-of-bounds write in Base64 encoding in NSS,
- The buffer overflow in WebGL,
- An use-after-free during focus handling,
- An use-after-free in text input selection,
- An use-after-free in frame selection,
- An use-after-free in nsAutoPtr during XSLT processing,
- An use-after-free in nsTArray Length() during XSLT processing,
- An use-after-free in txExecutionState destructor during XSLT processing,
- An use-after-free with selection during scroll events,
- An use-after-free during style changes,
- The Memory corruption with accessibility and DOM manipulation,
- An out-of-bounds write during BinHex decoding,
- The buffer overflow while parsing application/http-index-format content,
- An out-of-bounds read when HTTP/2 DATA frames are sent with incorrect da
- An out-of-bounds read during glyph processing,
- An out-of-bounds read in ConvolvePixel,
- An out-of-bounds write in ClearKeyDecryptor,
- The vulnerabilities in Libevent library,
- The potential Buffer overflow in flex-generated code,
- An uninitialized values used while parsing application/http-index-format,
- The DRBG flaw in NSS and
- The Memory safety bugs.
Vulnerability Impact:
Successful exploitation will allow remote
attackers to execute arbitrary code, to delete arbitrary files by leveraging
certain local file execution, to obtain sensitive information, and to cause
a denial of service.
Affected Software/OS:
Mozilla Firefox ESR versions before 45.9.
Solution:
Update to version 45.9 or later.
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
