遠端 Redhat Enterprise Linux 6/7 主機上安裝的套件受到 RHSA-2015:1586 公告中提及的多個弱點影響。

    Mozilla Firefox 是開放原始碼的網頁瀏覽器。XULRunner 為 Mozilla Firefox 提供 XUL 執行階段環境。

    處理格式有誤之 web 內容時發現多個缺陷。包含惡意內容的網頁可導致 Firefox 損毀或執行任意程式碼，該程式碼將以執行 Firefox 之使用者的特權運行。(CVE-2015-4473、CVE-2015-4475、CVE-2015-4478、CVE-2015-4479、CVE-2015-4480、CVE-2015-4493、CVE-2015-4484、CVE-2015-4491、CVE-2015-4485、CVE-2015-4486、CVE-2015-4487、CVE-2015-4488、CVE-2015-4489、CVE-2015-4492)

    Red Hat 感謝 Mozilla 專案報告這些問題。
    上游確認 Gary Kwong、Christian Holler、Byron Campen、Aki Helin、Andr Bargull、Massimiliano Tomassoli、laf.intel、Massimiliano Tomassoli、Tyson Smith、Jukka Jylnki、Gustavo Grieco、Abhishek Arya、Ronald Crane 和 Looben Yang 為這些問題的原始報告者。

    所有 Firefox 使用者皆應升級至這些更新版套件，其中包含可更正這些問題的 Firefox 38.2 ESR 版。安裝更新之後，Firefox 必須重新啟動，變更才會生效。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

- Firefox 40.0 的更新 (bnc#940806)

- 針對不需要的軟體下載新增保護

- 建議圖標會依據您最近的瀏覽歷程記錄中類別，顯示感興趣的網站

- Hello 允許為交談新增連結，以便提供交談相關主題的內容

- 依據內容中偏好設定樣式新增附加元件管理員的樣式

- 藉由關閉主執行緒複合功能來改善捲動、圖形和視訊播放效能 (僅限 GNU/Linux)

- 改善圖形封鎖清單機制：可指定 Firefox 版本範圍，限制封鎖了安全性修正的裝置數：

- MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 其他記憶體安全危險

- MFSA 2015-80/CVE-2015-4475 (bmo#1175396) 透過格式錯誤的 MP3 檔案引發的超出邊界讀取問題

- MFSA 2015-81/CVE-2015-4477 (bmo#1179484) MediaStream 播放過程中的釋放後使用問題

- MFSA 2015-82/CVE-2015-4478 (bmo#1105914) 不可設定的 JavaScript 物件內容重新定義

- MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 libstagefright 中的溢位問題

- MFSA 2015-84/CVE-2015-4481 (bmo1171518) 透過 Mozilla Maintenance Service，以硬連結引發的任意檔案覆寫 (只影響 Windows)

- MFSA 2015-85/CVE-2015-4482 (bmo#1184500) 利用 Updater 和惡意 MAR 檔案引發的超出邊界寫入 (不會影響未隨附更新程式的 openSUSE RPM 套件)

- MFSA 2015-86/CVE-2015-4483 (bmo#1148732) 含有 POST 的 Feed 通訊協定繞過混合內容保護

- MFSA 2015-87/CVE-2015-4484 (bmo#1171540) 在 JavaScript 中使用共用記憶體時當機

- MFSA 2015-88/CVE-2015-4491 (bmo#1184009) 縮放點陣圖影像時 gdk-pixbuf 中發生堆積溢位

- MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948、bmo#1178148) 解碼 WebM 視訊時 Libvpx 上發生緩衝區溢位

- MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 在程式碼檢查過程中發現多個弱點

- MFSA 2015-91/CVE-2015-4490 (bmo#1086999) Mozilla 內容安全性原則違反 CSP 規格，允許使用星號萬用字元

- MFSA 2015-92/CVE-2015-4492 (bmo#1185820) 含有共用背景工作的 XMLHttpRequest 發生釋放後使用問題

- 新增 mozilla-no-stdcxx-check.patch

- 已移除過時的修補程式

- mozilla-add-glibcxx_use_cxx11_abi.patch

- firefox-multilocale-chrome.patch

- 重定基底修補程式

- 需要 branding 套件 40 版

- 移除 browser/searchplugins/ 位置，因為其不再有效

- 納入 Firefox 39.0.3 的安全性更新 (bnc#940918)

- MFSA 2015-78/CVE-2015-4495 (bmo#1179262、bmo#1178058) 透過 PDF 讀取器發生的同源違規和本機檔案竊取問題

MozillaFirefox ESR 已更新至 38.4.0ESR 版，修正了多個安全性問題。

MFSA 2015-116/CVE-2015-4513 其他記憶體安全危險 (rv:42.0 / rv:38.4)

MFSA 2015-122/CVE-2015-7188 IP 位址主機名稱的結尾空白字元可繞過同源原則

MFSA 2015-123/CVE-2015-7189 canvas 中的影像互動過程出現緩衝區溢位

MFSA 2015-127/CVE-2015-7193 接收到非標準 Content-Type 標頭時會繞過 CORS 預檢

MFSA 2015-128/CVE-2015-7194 libjar 中的 zip 檔案有記憶體損毀問題

MFSA 2015-130/CVE-2015-7196 透過 Java applet 進行的 JavaScript 記憶體回收程序損毀

MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 在程式碼檢查過程中發現的多個弱點

MFSA 2015-132/CVE-2015-7197 透過背景工作繞過混合內容 WebSocket 原則

MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 NSS 及 NSPR 記憶體損毀問題

它也包含來自 38.3.0ESR 的修正：

MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 其他記憶體安全危險 (rv:41.0 / rv:38.3)

MFSA 2015-101/CVE-2015-4506 libvpx 在剖析 vp9 格式視訊時發生緩衝區溢位

MFSA 2015-105/CVE-2015-4511 解碼 WebM 視訊時發生緩衝區溢位

MFSA 2015-106/CVE-2015-4509 操控 HTML 媒體內容時發生釋放後使用

MFSA 2015-110/CVE-2015-4519 重新導向後若拖放影像，會洩漏最終 URL

MFSA 2015-111/CVE-2015-4520 處理 CORS 預檢要求標頭時發生錯誤

MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522 CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177 CVE-2015-7180 程式碼檢查時發現多個弱點

其亦包含 Firefox 38.2.1ESR 版本的修正：

MFSA 2015-94/CVE-2015-4497 (bsc#943557) 在重設樣式期間調整畫布元素大小時造成的釋放後使用弱點

MFSA 2015-95/CVE-2015-4498 (bsc#943558) 透過資料 URL 繞過附加元件通知

其亦包含 Firefox 38.2.0ESR 版本的修正：

MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 其他記憶體安全危險 (rv:40.0 / rv:38.2)

MFSA 2015-80/CVE-2015-4475 透過格式錯誤的 MP3 檔案引發的超出邊界讀取

MFSA 2015-82/CVE-2015-4478 不可設定的 JavaScript 物件屬性重新定義

MFSA 2015-83/CVE-2015-4479 libstagefright 中的溢位問題

MFSA 2015-87/CVE-2015-4484 在 JavaScript 中使用共用記憶體時當機

MFSA 2015-88/CVE-2015-4491 縮放點陣圖影像時 gdk-pixbuf 中發生堆積溢位

MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 解碼 WebM 視訊時 Libvpx 上發生緩衝區溢位

MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 在程式碼檢查過程中發現的多個弱點

MFSA 2015-92/CVE-2015-4492 含有共用背景工作的 XMLHttpRequest 存在釋放後使用問題

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The version of Mozilla Firefox is prior to 40.0 and is affected by multiple vulnerabilities : 

 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4473) 
 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4474) 
 - An out-of-bounds read error exists in the 'PlayFromAudioQueue()' function due to improper handling of mismatched sample formats. A remote attacker can exploit this, via a specially crafted MP3 file, to disclose memory contents or execute arbitrary code. (CVE-2015-4475) 
 - A use-after-free error exists in the Web Audio API during MediaStream playback. A remote attacker can exploit this to dereference already freed memory, resulting in the potential execution of arbitrary code. (CVE-2015-4477) 
 - A same-origin policy bypass vulnerability exists due to non-configurable properties being redefined in violation of the ECMAScript 6 standard during JSON parsing. A remote attacker can exploit this, by editing these properties to arbitrary values, to bypass the same-origin policy. (CVE-2015-4478) 
 - Multiple integer overflow conditions exist due to improper validation of user-supplied input when handling 'saio' chunks in MPEG4 video. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4479) 
 - An integer overflow condition exists in the bundled libstagefright component when handling H.264 media content. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4480) 
 - An arbitrary file overwrite vulnerability exists in the Mozilla Maintenance Service due to a race condition. An attacker can exploit this, via the use of a hard link, to overwrite arbitrary files with log output. (CVE-2015-4481) 
 - An out-of-bounds write error exists due to an array indexing flaw in the 'mar_consume_index()' function when handling index names in MAR files. An attacker can exploit this to execute arbitrary code. (CVE-2015-4482) 
 - A security bypass vulnerability exists due to a flaw in the 'ShouldLoad()' function that occurs during the handling of POST requests to URLs using the 'feed:' URI handler. An attacker can exploit this to bypass the mixed content blocker. (CVE-2015-4483) 
 - A denial of service vulnerability exists when handling JavaScript using shared memory without properly gating access to Atomics and SharedArrayBuffer views. An attacker can exploit this to crash the program, resulting in a denial of service condition. (CVE-2015-4484) 
 - A heap-based buffer overflow condition exists in the  'resize_context_buffers()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4485) 
 - A heap-based buffer overflow condition exists in the 'decrease_ref_count()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4486) 
 - A buffer overflow condition exists in the 'ReplacePrep()' function. A remote attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4487) 
 - A use-after-free error exists in the 'operator=()' function. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4488) 
 - A memory corruption issue exists in the 'nsTArray_Impl()' function due to improper validation of user-supplied input during self-assignment. An attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2015-4489) 
 - A security bypass vulnerability exists due to a discrepancy in the implementation of Content Security Policy and the CSP specification. The specification states that 'blob:', 'data:', and 'filesystem:' URLs should be excluded in case of a wildcard when matching source expressions, but Mozilla's implementation allows these in the case of an asterisk wildcard. A remote attacker can exploit this to bypass restrictions. (CVE-2015-4490) 
 - A use-after-free error exists in the 'XMLHttpRequest::Open()' function due to improper handling of recursive calls. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4492) 
 - An integer underflow condition exists in the bundled libstagefright library. An attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-4493) 
 - A flaw in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files. (CVE-2015-4495)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
85342	RHEL 6 / 7: firefox (RHSA-2015:1586)	Nessus	Red Hat Local Security Checks	2015/8/12	2025/4/15	medium
85436	openSUSE 安全性更新：MozillaFirefox (openSUSE-2015-547)	Nessus	SuSE Local Security Checks	2015/8/17	2022/5/25	critical
87063	SUSE SLES10 安全性更新：Mozilla Firefox (SUSE-SU-2015:2081-1)	Nessus	SuSE Local Security Checks	2015/11/25	2021/1/6	critical
8856	Mozilla Firefox < 40.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/9/9	2019/3/6	critical

検出

プラグインの検索

medium

critical

critical

critical