Package Instance

Using Address Sanitizer, security researcher Sascha Just reported a
buffer overflow in the libstagefright library due to issues with the handling of CENC
offsets and the sizes table. This results in a potentially exploitable crash triggerable
through web content.

Mozilla developers fixed several memory safety bugs in the browser engine used in
Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory
corruption under certain circumstances, and we presume that with enough effort at least
some of these could be exploited to run arbitrary code.

Mozilla developer Tim Taubert used the Address Sanitizer tool and
software fuzzing to discover a use-after-free vulnerability while processing DER encoded
keys in the Network Security Services (NSS) libraries. The vulnerability overwrites the
freed memory with zeroes. This issue has been addressed in NSS 3.21.1, shipping in Firefox
45.

Security researcher Hanno Böck reported that calculations with
mp_div and mp_exptmod in Network Security Services (NSS) can
produce wrong results in some circumstances. These functions are used within NSS for a
variety of cryptographic division functions, leading to potential cryptographic
weaknesses.

The CESG, the Information Security Arm of GCHQ, reported that the
JavaScript .watch() method could be used to overflow the 32-bit generation
count of the underlying HashMap, resulting in a write to an invalid entry. Under the right
conditions this write could lead to arbitrary code execution. The overflow takes
considerable time and a malicious page would require a user to keep it open for the
duration of the attack.

Security researcher Jordi Chancel discovered a variant of Mozilla Foundation
Security Advisory 2015-136 which was fixed in Firefox 43. In the original bug, it
was possible to read cross-origin URLs following a redirect if
performance.getEntries() was used along with an iframe to host a page.
Navigating back in history through script, content was pulled from the browser cache for
the redirected location instead of going to the original location. In the newly reported
variant issue, it was found that if a browser session was restored, history navigation
would still allow for the same attack as content was restored from the browser cache. This
is a same-origin policy violation and could allow for data theft.