Debian Firefox vulnerabilities

CVE-2016-9896 [HIGH] CVE-2016-9896: firefox - Use-after-free while manipulating the "navigator" object within WebVR. Note: Web... Use-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not currently enabled by default. This vulnerability affects Firefox < 50.1. Scope: local sid: resolved (fixed in 50.1.0-1)

CVE-2016-2821 [HIGH] CVE-2016-2821: firefox - Use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firef... Use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when contenteditable mode is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering deletion of DOM elements that were created in the editor. Scope: local sid: resolved

CVE-2016-2801 [HIGH] CVE-2016-2801: firefox - The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite... The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797. Scope

CVE-2016-1954 [HIGH] CVE-2016-1954: firefox - The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozil... The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local

CVE-2016-9070 [HIGH] CVE-2016-9070: firefox - A maliciously crafted page loaded to the sidebar through a bookmark can referenc... A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox < 50. Scope: local sid: resolved (fixed in 50.0-1)

CVE-2016-2834 [HIGH] CVE-2016-2834: firefox - Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox ... Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Scope: local sid: resolved (fixed in 47.0-1)

CVE-2016-2806 [HIGH] CVE-2016-2806: firefox - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox be... Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Scope: local sid: resolved (fixed in 46.0-1)

CVE-2016-1964 [HIGH] CVE-2016-1964: firefox - Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox... Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2016-5273 [HIGH] CVE-2016-5273: firefox - The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibi... The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site. Scope: local sid: resolved (fixed in 49.0-1)

CVE-2016-1977 [HIGH] CVE-2016-1977: firefox - The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.... The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2016-5252 [HIGH] CVE-2016-5252: firefox - Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozill... Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations. Scope: local sid: resolved (fixed in 48.0-1)

CVE-2016-1963 [HIGH] CVE-2016-1963: firefox - The FileReader class in Mozilla Firefox before 45.0 allows local users to gain p... The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2016-5258 [HIGH] CVE-2016-5258: firefox - Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox befo... Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session. Scope: local sid: resolved (fixed in 48.0-1)

CVE-2016-2807 [HIGH] CVE-2016-2807: firefox - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox be... Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Scope: local sid: resolved (fixed in 46.0-1)

CVE-2016-9077 [HIGH] CVE-2016-9077: firefox - Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-o... Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox < 50. Scope: local sid: resolved (fixed in 50.0-1)

CVE-2016-2828 [HIGH] CVE-2016-2828: firefox - Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x... Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool. Scope: local sid: resolved (fixed in 47.0-1)

CVE-2016-9069 [HIGH] CVE-2016-9069: firefox - A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulti... A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50. Scope: local sid: resolved (fixed in 50.0-1)

CVE-2016-9066 [HIGH] CVE-2016-9066: firefox - A buffer overflow resulting in a potentially exploitable crash due to memory all... A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Scope: local sid: resolved (fixed in 50.0-1)

CVE-2016-5272 [HIGH] CVE-2016-5272: firefox - The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x ... The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site. Scope: local sid: resolved (fixed in 49.0-1)

CVE-2016-2836 [HIGH] CVE-2016-2836: firefox - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox be... Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors. Scope: local sid: resolv