Summary
Multiple security vulnerabilities were discovered in Firefox. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit these to conduct cross-site scripting (XSS) attacks,
obtain sensitive information, cause a denial of service via application
crash, or execute arbitrary code. (CVE-2016-9080, CVE-2016-9893,
CVE-2016-9894, CVE-2016-9895, CVE-2016-9896, CVE-2016-9897, CVE-2016-9898,
CVE-2016-9899, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9903,
CVE-2016-9904)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | firefox | 50.1.0+build2-0ubuntu0.14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 50.1.0+build2-0ubuntu0.16.04.1 |
Vulnerabilities 13
-
Unscored —
Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we pres…
-
Unscored —
Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we pr…
-
Unscored —
A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the bu…
-
Unscored —
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inlin…
-
Unscored —
Use-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not currently enabled by default.…
-
Unscored —
Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a…
-
Unscored —
Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerabil…
-
Unscored —
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption…
-
Unscored —
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of…
-
Unscored —
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will …
-
Unscored —
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin …
-
Unscored —
Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerabil…
-
Unscored —
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zo…
References
-
report
https://ubuntu.com/security/CVE-2016-9080
-
report
https://ubuntu.com/security/CVE-2016-9893
-
report
https://ubuntu.com/security/CVE-2016-9894
-
report
https://ubuntu.com/security/CVE-2016-9895
-
report
https://ubuntu.com/security/CVE-2016-9896
-
report
https://ubuntu.com/security/CVE-2016-9897
-
report
https://ubuntu.com/security/CVE-2016-9898
-
report
https://ubuntu.com/security/CVE-2016-9899
-
report
https://ubuntu.com/security/CVE-2016-9900
-
report
https://ubuntu.com/security/CVE-2016-9901
-
report
https://ubuntu.com/security/CVE-2016-9902
-
report
https://ubuntu.com/security/CVE-2016-9903
-
report
https://ubuntu.com/security/CVE-2016-9904