Test Kennung:	1.3.6.1.4.1.25623.1.0.842770
Kategorie:	Ubuntu Local Security Checks
Titel:	Ubuntu Update for firefox USN-2936-3
Zusammenfassung:	The remote host is missing an update for the 'firefox'; package(s) announced via the referenced advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the referenced advisory. Vulnerability Insight: USN-2936-1 fixed vulnerabilities in Firefox. The update caused an issue where a device update POST request was sent every time about:preferences sync was shown. This update fixes the problem. Original advisory details: Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup, Andrew McCreight, and Steve Fink discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2804, CVE-2016-2806, CVE-2016-2807) An invalid write was discovered when using the JavaScript .watch() method in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2808) Looben Yang discovered a use-after-free and buffer overflow in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2811, CVE-2016-2812) Sascha Just discovered a buffer overflow in libstagefright in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2814) Muneaki Nishimura discovered that CSP is not applied correctly to web content sent with the multipart/x-mixed-replace MIME type. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks when they would otherwise be prevented. (CVE-2016-2816) Muneaki Nishimura discovered that the chrome.tabs.update API for web extensions allows for navigation to javascript: URLs. A malicious extension could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-2817) Mark Goodwin discovered that about:healthreport accepts certain events from any content present in the remote-report iframe. If another vulnerability allowed the injection of web content in the remote-report iframe, an attacker could potentially exploit this to change the user's sharing preferences. (CVE-2016-2820) Affected Software/OS: firefox on Ubuntu 16.04 LTS, Ubuntu 15.10, Ubuntu 14.04 LTS, Ubuntu 12.04 LTS Solution: Please Install the Updated Packages. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-2804 https://security.gentoo.org/glsa/201701-15 http://www.securitytracker.com/id/1035692 SuSE Security Announcement: openSUSE-SU-2016:1211 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html SuSE Security Announcement: openSUSE-SU-2016:1251 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.html http://www.ubuntu.com/usn/USN-2936-1 http://www.ubuntu.com/usn/USN-2936-2 http://www.ubuntu.com/usn/USN-2936-3 Common Vulnerability Exposure (CVE) ID: CVE-2016-2806 Debian Security Information: DSA-3601 (Google Search) http://www.debian.org/security/2016/dsa-3601 RedHat Security Advisories: RHSA-2016:0695 http://rhn.redhat.com/errata/RHSA-2016-0695.html SuSE Security Announcement: openSUSE-SU-2016:1767 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html SuSE Security Announcement: openSUSE-SU-2016:1769 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html SuSE Security Announcement: openSUSE-SU-2016:1778 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html Common Vulnerability Exposure (CVE) ID: CVE-2016-2807 Debian Security Information: DSA-3559 (Google Search) http://www.debian.org/security/2016/dsa-3559 Debian Security Information: DSA-3576 (Google Search) http://www.debian.org/security/2016/dsa-3576 RedHat Security Advisories: RHSA-2016:1041 http://rhn.redhat.com/errata/RHSA-2016-1041.html SuSE Security Announcement: SUSE-SU-2016:1258 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00023.html SuSE Security Announcement: SUSE-SU-2016:1352 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00054.html SuSE Security Announcement: SUSE-SU-2016:1374 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00057.html http://www.ubuntu.com/usn/USN-2973-1 Common Vulnerability Exposure (CVE) ID: CVE-2016-2808 Common Vulnerability Exposure (CVE) ID: CVE-2016-2811 Common Vulnerability Exposure (CVE) ID: CVE-2016-2812 Common Vulnerability Exposure (CVE) ID: CVE-2016-2814 Common Vulnerability Exposure (CVE) ID: CVE-2016-2816 Common Vulnerability Exposure (CVE) ID: CVE-2016-2817 Common Vulnerability Exposure (CVE) ID: CVE-2016-2820
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.