Mozilla Firefox 更新至最新的 Firefox 38ESR 分支 (確切為 38.2.0ESR 版)。

修正的安全性問題：

- MFSA 2015-78 / CVE-2015-4495：透過 PDF 讀取器引發的同源違規和本機檔案竊取

- MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474：
其他記憶體安全性危險 (rv:40.0 / rv:38.2)

- MFSA 2015-80 / CVE-2015-4475：透過格式錯誤的 MP3 檔案引發的超出邊界讀取

- MFSA 2015-82 / CVE-2015-4478：不可設定的 JavaScript 物件屬性重新定義

- MFSA 2015-83 / CVE-2015-4479：libstagefright 中的溢位問題

- MFSA 2015-87 / CVE-2015-4484：在 JavaScript 中使用共用記憶體時當機

- MFSA 2015-88 / CVE-2015-4491：縮放點陣圖影像時 gdk-pixbuf 中發生堆積溢位

- MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486：解碼 WebM 視訊時 Libvpx 上發生緩衝區溢位

- MFSA 2015-90 / CVE-2015-4487/CVE-2015-4488/CVE-2015-4489：
在程式碼檢查過程中發現多個弱點

- MFSA 2015-92 / CVE-2015-4492：含有共用背景工作的 XMLHttpRequest 存在釋放後使用問題

此更新也包含許多從 31ESR 到 38ESR 的功能改進與錯誤修正。

此外，Mozilla NSS 程式庫也將其 CKBI API 從 1.98 切換至 2.4，亦即 Firefox 38ESR 使用的版本。

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Gary Kwong、Christian Holler 和 Byron Campen 發現 Thunderbird 中有多個記憶體安全問題。如果使用者遭到誘騙而開啟特製訊息，攻擊者可能惡意利用這些問題，透過損毀應用程式造成拒絕服務，或可能以叫用 Thunderbird 的使用者權限執行任意程式碼。(CVE-2015-4473)

Ronald Crane 報告了 3 個安全性問題。如果使用者遭到誘騙而開啟特製訊息，攻擊者可能會加以惡意利用並結合其他安全性弱點，透過應用程式損毀造成拒絕服務，或是以叫用 Thunderbird 的使用者權限執行任意程式碼。
(CVE-2015-4487, CVE-2015-4488, CVE-2015-4489)

Gustavo Grieco 發現 gdk-pixbuf 中有一個堆積溢位問題。如果使用者遭到誘騙而開啟特製訊息，攻擊者可能惡意利用此問題，透過損毀應用程式造成拒絕服務，或可能以叫用 Thunderbird 的使用者權限執行任意程式碼。(CVE-2015-4491)

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

CVE-2015-4491 的安全性修正

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The version of Mozilla Firefox is prior to 40.0 and is affected by multiple vulnerabilities : 

 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4473) 
 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4474) 
 - An out-of-bounds read error exists in the 'PlayFromAudioQueue()' function due to improper handling of mismatched sample formats. A remote attacker can exploit this, via a specially crafted MP3 file, to disclose memory contents or execute arbitrary code. (CVE-2015-4475) 
 - A use-after-free error exists in the Web Audio API during MediaStream playback. A remote attacker can exploit this to dereference already freed memory, resulting in the potential execution of arbitrary code. (CVE-2015-4477) 
 - A same-origin policy bypass vulnerability exists due to non-configurable properties being redefined in violation of the ECMAScript 6 standard during JSON parsing. A remote attacker can exploit this, by editing these properties to arbitrary values, to bypass the same-origin policy. (CVE-2015-4478) 
 - Multiple integer overflow conditions exist due to improper validation of user-supplied input when handling 'saio' chunks in MPEG4 video. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4479) 
 - An integer overflow condition exists in the bundled libstagefright component when handling H.264 media content. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4480) 
 - An arbitrary file overwrite vulnerability exists in the Mozilla Maintenance Service due to a race condition. An attacker can exploit this, via the use of a hard link, to overwrite arbitrary files with log output. (CVE-2015-4481) 
 - An out-of-bounds write error exists due to an array indexing flaw in the 'mar_consume_index()' function when handling index names in MAR files. An attacker can exploit this to execute arbitrary code. (CVE-2015-4482) 
 - A security bypass vulnerability exists due to a flaw in the 'ShouldLoad()' function that occurs during the handling of POST requests to URLs using the 'feed:' URI handler. An attacker can exploit this to bypass the mixed content blocker. (CVE-2015-4483) 
 - A denial of service vulnerability exists when handling JavaScript using shared memory without properly gating access to Atomics and SharedArrayBuffer views. An attacker can exploit this to crash the program, resulting in a denial of service condition. (CVE-2015-4484) 
 - A heap-based buffer overflow condition exists in the  'resize_context_buffers()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4485) 
 - A heap-based buffer overflow condition exists in the 'decrease_ref_count()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4486) 
 - A buffer overflow condition exists in the 'ReplacePrep()' function. A remote attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4487) 
 - A use-after-free error exists in the 'operator=()' function. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4488) 
 - A memory corruption issue exists in the 'nsTArray_Impl()' function due to improper validation of user-supplied input during self-assignment. An attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2015-4489) 
 - A security bypass vulnerability exists due to a discrepancy in the implementation of Content Security Policy and the CSP specification. The specification states that 'blob:', 'data:', and 'filesystem:' URLs should be excluded in case of a wildcard when matching source expressions, but Mozilla's implementation allows these in the case of an asterisk wildcard. A remote attacker can exploit this to bypass restrictions. (CVE-2015-4490) 
 - A use-after-free error exists in the 'XMLHttpRequest::Open()' function due to improper handling of recursive calls. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4492) 
 - An integer underflow condition exists in the bundled libstagefright library. An attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-4493) 
 - A flaw in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files. (CVE-2015-4495)

ID	名稱	產品	系列	已發布	已更新	嚴重性
85906	SUSE SLED11 / SLES11 安全性更新：MozillaFirefox、mozilla-nss (SUSE-SU-2015:1528-1)	Nessus	SuSE Local Security Checks	2015/9/11	2022/5/25	critical
85648	Ubuntu 14.04 LTS：thunderbird 弱點 (USN-2712-1)	Nessus	Ubuntu Local Security Checks	2015/8/26	2024/8/28	critical
85817	Fedora 21 : gdk-pixbuf2-2.31.6-1.fc21 (2015-13926)	Nessus	Fedora Local Security Checks	2015/9/8	2021/1/11	medium
8856	Mozilla Firefox < 40.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/9/9	2019/3/6	critical

偵測

搜尋 Plugin

critical

critical

medium

critical