Mozilla Firefox, Firefox ESR vulnerabilities

A use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

A heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.

A use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when contenteditable mode is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering deletion of DOM elements that were created in the editor.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.

The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

The nsNPObjWrapper::GetNewOrUsed function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted NPAPI plugin.

A use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element.

The nsCSPContext::SendReports function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 does not prevent the use of a non-HTTP report-uri for Content Security Policy (CSP) violation reports. This allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.

Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL content.

Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation.

An integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 may allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.

The CryptoKey interface implementation in Mozilla Firefox before version 42.0 and Firefox ESR 38.x before version 38.4 lacks status checking, which may allow attackers to have an unspecified impact via vectors related to a cryptographic key.

The AddWeightedPathSegLists and SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before version 42.0 and Firefox ESR 38.x before version 38.4 lack status checking, allowing remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.

Buffer overflow in the rx::TextureStorage11 class in ANGLE, used in Mozilla Firefox before version 42.0 and Firefox ESR 38.x before version 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.

The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an 'overflow.'

The NetworkUtils.cpp file in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 may have a vulnerability that allows remote attackers to cause a denial of service through memory corruption and application crash.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

A use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code. The issue arises from improper interaction between resize events and changes to CSS token sequences for a CANVAS element.

A use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before version 40.0 and Firefox ESR 38.x before version 38.2 may allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an XMLHttpRequest object.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.