Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, integer overflows, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, information disclosure or denial of service.

seamonkey was updated to fix 25 security issues.

These security issues were fixed :

  - CVE-2015-4520: Mozilla Firefox before 41.0 and Firefox     ESR 38.x before 38.3 allowed remote attackers to bypass     CORS preflight protection mechanisms by leveraging (1)     duplicate cache-key generation or (2) retrieval of a     value from an incorrect HTTP Access-Control-* response     header (bsc#947003).

  - CVE-2015-4521: The ConvertDialogOptions function in     Mozilla Firefox before 41.0 and Firefox ESR 38.x before     38.3 might allowed remote attackers to cause a denial of     service (memory corruption and application crash) or     possibly have unspecified other impact via unknown     vectors (bsc#947003).

  - CVE-2015-4522: The nsUnicodeToUTF8::GetMaxLength     function in Mozilla Firefox before 41.0 and Firefox ESR     38.x before 38.3 might allowed remote attackers to cause     a denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

  - CVE-2015-4502: js/src/proxy/Proxy.cpp in Mozilla Firefox     before 41.0 mishandled certain receiver arguments, which     allowed remote attackers to bypass intended window     access restrictions via a crafted website (bsc#947003).

  - CVE-2015-4503: The TCP Socket API implementation in     Mozilla Firefox before 41.0 mishandled array boundaries     that were established with a navigator.mozTCPSocket.open     method call and send method calls, which allowed remote     TCP servers to obtain sensitive information from process     memory by reading packet data, as demonstrated by     availability of this API in a Firefox OS application     (bsc#947003).

  - CVE-2015-4500: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 41.0 and     Firefox ESR 38.x before 38.3 allowed remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via unknown vectors (bsc#947003).

  - CVE-2015-4501: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 41.0     allowed remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors (bsc#947003).

  - CVE-2015-4506: Buffer overflow in the     vp9_init_context_buffers function in libvpx, as used in     Mozilla Firefox before 41.0 and Firefox ESR 38.x before     38.3, allowed remote attackers to execute arbitrary code     via a crafted VP9 file (bsc#947003).

  - CVE-2015-4507: The SavedStacks class in the JavaScript     implementation in Mozilla Firefox before 41.0, when the     Debugger API is enabled, allowed remote attackers to     cause a denial of service (getSlotRef assertion failure     and application exit) or possibly execute arbitrary code     via a crafted website (bsc#947003).

  - CVE-2015-4504: The lut_inverse_interp16 function in the     QCMS library in Mozilla Firefox before 41.0 allowed     remote attackers to obtain sensitive information or     cause a denial of service (buffer over-read and     application crash) via crafted attributes in the ICC 4     profile of an image (bsc#947003).

  - CVE-2015-4505: updater.exe in Mozilla Firefox before     41.0 and Firefox ESR 38.x before 38.3 on Windows allowed     local users to write to arbitrary files by conducting a     junction attack and waiting for an update operation by     the Mozilla Maintenance Service (bsc#947003).

  - CVE-2015-7180: The ReadbackResultWriterD3D11::Run     function in Mozilla Firefox before 41.0 and Firefox ESR     38.x before 38.3 misinterprets the return value of a     function call, which might allowed remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly have unspecified other     impact via unknown vectors (bsc#947003).

  - CVE-2015-4509: Use-after-free vulnerability in the     HTMLVideoElement interface in Mozilla Firefox before     41.0 and Firefox ESR 38.x before 38.3 allowed remote     attackers to execute arbitrary code via crafted     JavaScript code that modifies the URI table of a media     element, aka ZDI-CAN-3176 (bsc#947003).

  - CVE-2015-7178: The ProgramBinary::linkAttributes     function in libGLES in ANGLE, as used in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 on Windows,     mishandles shader access, which allowed remote attackers     to execute arbitrary code or cause a denial of service     (memory corruption and application crash) via crafted     (1) OpenGL or (2) WebGL content (bsc#947003).

  - CVE-2015-7179: The     VertexBufferInterface::reserveVertexSpace function in     libGLES in ANGLE, as used in Mozilla Firefox before 41.0     and Firefox ESR 38.x before 38.3 on Windows, incorrectly     allocates memory for shader attribute arrays, which     allowed remote attackers to execute arbitrary code or     cause a denial of service (buffer overflow and     application crash) via crafted (1) OpenGL or (2) WebGL     content (bsc#947003).

  - CVE-2015-7176: The AnimationThread function in Mozilla     Firefox before 41.0 and Firefox ESR 38.x before 38.3     used an incorrect argument to the sscanf function, which     might allowed remote attackers to cause a denial of     service (stack-based buffer overflow and application     crash) or possibly have unspecified other impact via     unknown vectors (bsc#947003).

  - CVE-2015-7177: The InitTextures function in Mozilla     Firefox before 41.0 and Firefox ESR 38.x before 38.3     might allowed remote attackers to cause a denial of     service (memory corruption and application crash) or     possibly have unspecified other impact via unknown     vectors (bsc#947003).

  - CVE-2015-7174: The nsAttrAndChildArray::GrowBy function     in Mozilla Firefox before 41.0 and Firefox ESR 38.x     before 38.3 might allowed remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

  - CVE-2015-7175: The XULContentSinkImpl::AddText function     in Mozilla Firefox before 41.0 and Firefox ESR 38.x     before 38.3 might allowed remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unknown vectors, related to an 'overflow (bsc#947003).

  - CVE-2015-4511: Heap-based buffer overflow in the     nestegg_track_codec_data function in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 allowed     remote attackers to execute arbitrary code via a crafted     header in a WebM video (bsc#947003).

  - CVE-2015-4510: Race condition in the     WorkerPrivate::NotifyFeatures function in Mozilla     Firefox before 41.0 allowed remote attackers to execute     arbitrary code or cause a denial of service     (use-after-free and application crash) by leveraging     improper interaction between shared workers and the     IndexedDB implementation (bsc#947003).

  - CVE-2015-4512: gfx/2d/DataSurfaceHelpers.cpp in Mozilla     Firefox before 41.0 on Linux improperly attempts to use     the Cairo library with 32-bit color-depth surface     creation followed by 16-bit color-depth surface display,     which allowed remote attackers to obtain sensitive     information from process memory or cause a denial of     service (out-of-bounds read) by using a CANVAS element     to trigger 2D rendering (bsc#947003).

  - CVE-2015-4517: NetworkUtils.cpp in Mozilla Firefox     before 41.0 and Firefox ESR 38.x before 38.3 might     allowed remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     have unspecified other impact via unknown vectors     (bsc#947003).

  - CVE-2015-4516: Mozilla Firefox before 41.0 allowed     remote attackers to bypass certain ECMAScript 5 (aka     ES5) API protection mechanisms and modify immutable     properties, and consequently execute arbitrary     JavaScript code with chrome privileges, via a crafted     web page that did not use ES5 APIs (bsc#947003).

  - CVE-2015-4519: Mozilla Firefox before 41.0 and Firefox     ESR 38.x before 38.3 allowed user-assisted remote     attackers to bypass intended access restrictions and     discover a redirect's target URL via crafted JavaScript     code that executes after a drag-and-drop action of an     image into a TEXTBOX element (bsc#947003).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2754-1 advisory.

    Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, and     Cameron McCormack discovered multiple memory safety issues in Thunderbird. If a user were tricked in to     opening a specially crafted message, an attacker could potentially exploit these to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking     Thunderbird. (CVE-2015-4500)

    Khalil Zhani discovered a buffer overflow when parsing VP9 content in some circumstances. If a user were     tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Thunderbird. (CVE-2015-4506)

    A use-after-free was discovered when manipulating HTML media content in some circumstances. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to cause a denial of service via application crash, or execute arbitrary code with the     privileges of the user invoking Thunderbird. (CVE-2015-4509)

    Atte Kettunen discovered a buffer overflow in the nestegg library when decoding WebM format video in some     circumstances. If a user were tricked in to opening a specially crafted message, an attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Thunderbird. (CVE-2015-4511)

    Ronald Crane reported multiple vulnerabilities. If a user were tricked in to opening a specially crafted     website in a browsing context, an attacker could potentially exploit these to cause a denial of service     via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird.
    (CVE-2015-4517, CVE-2015-4521, CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176, CVE-2015-7177,     CVE-2015-7180)

    Mario Gomes discovered that dragging and dropping an image after a redirect exposes the redirected URL to     scripts. An attacker could potentially exploit this to obtain sensitive information. (CVE-2015-4519)

    Ehsan Akhgari discovered 2 issues with CORS preflight requests. An attacker could potentially exploit     these to bypass CORS restrictions. (CVE-2015-4520)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
86107	Debian DSA-3365-1 : iceweasel - security update	Nessus	Debian Local Security Checks	2015/9/24	2021/1/11	high
86282	openSUSE Security Update : seamonkey (openSUSE-2015-632)	Nessus	SuSE Local Security Checks	2015/10/6	2021/1/19	high
86293	Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2754-1)	Nessus	Ubuntu Local Security Checks	2015/10/6	2024/8/27	critical

検出

プラグインの検索

high

high

critical