Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to read uninitialized memory, obtain sensitive
information, bypass phishing and malware protection, spoof the origin in
modal dialogs, conduct cross-site scripting (XSS) attacks, cause a denial
of service via application crash, or execute arbitrary code.
(CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812,
CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7818, CVE-2017-7819,
CVE-2017-7820, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824)
Martin Thomson discovered that NSS incorrectly generated handshake hashes.
A remote attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2017-7805)
Multiple security issues were discovered in WebExtensions. If a user were
tricked in to installing a specially crafted extension, an attacker could
potentially exploit these to download and open non-executable files
without interaction, or obtain elevated privileges. (CVE-2017-7816,
CVE-2017-7821)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | firefox | 56.0+build6-0ubuntu0.14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 56.0+build6-0ubuntu0.16.04.1 |
Vulnerabilities 16
-
Unscored —
A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still…
-
Unscored —
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for l…
-
Unscored —
Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corru…
-
Unscored —
Memory safety bugs were reported in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that othe…
-
Unscored —
Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer b…
-
Unscored —
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing a…
-
Unscored —
On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will h…
-
Unscored —
WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security ch…
-
Unscored —
A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) eleme…
-
Unscored —
A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the…
-
Unscored —
The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or …
-
Unscored —
A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can…
-
Unscored —
The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the N…
-
Unscored —
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to be…
-
Unscored —
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. …
References
-
report
https://ubuntu.com/security/CVE-2017-7793
-
report
https://ubuntu.com/security/CVE-2017-7805
-
report
https://ubuntu.com/security/CVE-2017-7810
-
report
https://ubuntu.com/security/CVE-2017-7811
-
report
https://ubuntu.com/security/CVE-2017-7812
-
report
https://ubuntu.com/security/CVE-2017-7813
-
report
https://ubuntu.com/security/CVE-2017-7814
-
report
https://ubuntu.com/security/CVE-2017-7815
-
report
https://ubuntu.com/security/CVE-2017-7816
-
report
https://ubuntu.com/security/CVE-2017-7818
-
report
https://ubuntu.com/security/CVE-2017-7819
-
report
https://ubuntu.com/security/CVE-2017-7820
-
report
https://ubuntu.com/security/CVE-2017-7821
-
report
https://ubuntu.com/security/CVE-2017-7822
-
report
https://ubuntu.com/security/CVE-2017-7823
-
report
https://ubuntu.com/security/CVE-2017-7824