Test ID:	1.3.6.1.4.1.25623.1.0.842476
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2743-4)
Summary:	The remote host is missing an update for the 'firefox' package(s) announced via the USN-2743-4 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the USN-2743-4 advisory. Vulnerability Insight: USN-2743-1 fixed vulnerabilities in Firefox. After upgrading, some users reported problems with bookmark creation and crashes in some circumstances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, Cameron McCormack, Bob Clary and Randell Jesup discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-4500, CVE-2015-4501) Andre Bargull discovered that when a web page creates a scripted proxy for the window with a handler defined a certain way, a reference to the inner window will be passed, rather than that of the outer window. (CVE-2015-4502) Felix Grobert discovered an out-of-bounds read in the QCMS color management library in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or obtain sensitive information. (CVE-2015-4504) Khalil Zhani discovered a buffer overflow when parsing VP9 content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-4506) Spandan Veggalam discovered a crash while using the debugger API in some circumstances. If a user were tricked in to opening a specially crafted website whilst using the debugger, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-4507) Juho Nurminen discovered that the URL bar could display the wrong URL in reader mode in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct URL spoofing attacks. (CVE-2015-4508) A use-after-free was discovered when manipulating HTML media content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-4509) Looben Yang discovered a use-after-free when using a shared worker with IndexedDB in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'firefox' package(s) on Ubuntu 12.04, Ubuntu 14.04, Ubuntu 15.04. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-4500 BugTraq ID: 76816 http://www.securityfocus.com/bid/76816 Debian Security Information: DSA-3365 (Google Search) http://www.debian.org/security/2015/dsa-3365 RedHat Security Advisories: RHSA-2015:1834 http://rhn.redhat.com/errata/RHSA-2015-1834.html RedHat Security Advisories: RHSA-2015:1852 http://rhn.redhat.com/errata/RHSA-2015-1852.html http://www.securitytracker.com/id/1033640 SuSE Security Announcement: SUSE-SU-2015:1680 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00004.html SuSE Security Announcement: SUSE-SU-2015:1703 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00007.html SuSE Security Announcement: SUSE-SU-2015:2081 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html SuSE Security Announcement: openSUSE-SU-2015:1658 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html SuSE Security Announcement: openSUSE-SU-2015:1679 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html SuSE Security Announcement: openSUSE-SU-2015:1681 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html http://www.ubuntu.com/usn/USN-2743-1 http://www.ubuntu.com/usn/USN-2743-2 http://www.ubuntu.com/usn/USN-2743-3 http://www.ubuntu.com/usn/USN-2743-4 http://www.ubuntu.com/usn/USN-2754-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-4501 Common Vulnerability Exposure (CVE) ID: CVE-2015-4502 BugTraq ID: 76815 http://www.securityfocus.com/bid/76815 Common Vulnerability Exposure (CVE) ID: CVE-2015-4504 Common Vulnerability Exposure (CVE) ID: CVE-2015-4506 Common Vulnerability Exposure (CVE) ID: CVE-2015-4507 Common Vulnerability Exposure (CVE) ID: CVE-2015-4508 Common Vulnerability Exposure (CVE) ID: CVE-2015-4509 http://www.zerodayinitiative.com/advisories/ZDI-15-646
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.