Debian Firefox-Esr vulnerabilities

CVE-2016-1964 [HIGH] CVE-2016-1964: firefox - Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox... Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2016-5273 [HIGH] CVE-2016-5273: firefox - The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibi... The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site. Scope: local sid: resolved (fixed in 49.0-1)

CVE-2016-1977 [HIGH] CVE-2016-1977: firefox - The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.... The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2016-5252 [HIGH] CVE-2016-5252: firefox - Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozill... Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations. Scope: local sid: resolved (fixed in 48.0-1)

CVE-2016-1963 [HIGH] CVE-2016-1963: firefox - The FileReader class in Mozilla Firefox before 45.0 allows local users to gain p... The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2016-5258 [HIGH] CVE-2016-5258: firefox - Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox befo... Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session. Scope: local sid: resolved (fixed in 48.0-1)

CVE-2016-2807 [HIGH] CVE-2016-2807: firefox - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox be... Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Scope: local sid: resolved (fixed in 46.0-1)

CVE-2016-9077 [HIGH] CVE-2016-9077: firefox - Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-o... Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox < 50. Scope: local sid: resolved (fixed in 50.0-1)

CVE-2016-2828 [HIGH] CVE-2016-2828: firefox - Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x... Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool. Scope: local sid: resolved (fixed in 47.0-1)

CVE-2016-9066 [HIGH] CVE-2016-9066: firefox - A buffer overflow resulting in a potentially exploitable crash due to memory all... A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Scope: local sid: resolved (fixed in 50.0-1)

CVE-2016-5272 [HIGH] CVE-2016-5272: firefox - The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x ... The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site. Scope: local sid: resolved (fixed in 49.0-1)

CVE-2016-2836 [HIGH] CVE-2016-2836: firefox - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox be... Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors. Scope: local sid: resolv

CVE-2016-5255 [HIGH] CVE-2016-5255: firefox - Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function i... Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript that is mishandled during incremental garbage collection. Scope: local sid: resolved (fixed in 48.0-1)

CVE-2016-2831 [HIGH] CVE-2016-2831: firefox - Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that ... Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site. Scope: local sid: resolved (fixed in 47.0-1)

CVE-2016-2815 [HIGH] CVE-2016-2815: firefox - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox be... Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Scope: local sid: resolved (fixed in 47.0-1)

CVE-2016-1959 [HIGH] CVE-2016-1959: firefox - The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote atta... The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via unspecified use of the Clients API. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2016-1968 [HIGH] CVE-2016-1968: brotli - Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remo... Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression. Scope: local bookworm: resolved (fixed in 0.3.0+dfsg-3) bullseye: resolved (fixed in 0.3.0+dfsg-3) forky: resolved (fixed in 0.3.0+dfsg-3) sid: resolved (fixed in

CVE-2016-5266 [HIGH] CVE-2016-5266: firefox - Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTr... Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTransfer) actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site. Scope: local sid: resolved (fixed in 48.0-1)

CVE-2016-2814 [HIGH] CVE-2016-2814: firefox - Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo ... Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table. Scope: local sid: resolved (fixed in 46.0-1)

CVE-2016-9902 [HIGH] CVE-2016-9902: firefox - The Pocket toolbar button, once activated, listens for events fired from it's ow... The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50