{"id":"USN-2936-3","summary":"firefox regression","details":"USN-2936-1 fixed vulnerabilities in Firefox. The update caused an issue\nwhere a device update POST request was sent every time about:preferences#sync\nwas shown. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman,\n Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup,\n Andrew McCreight, and Steve Fink discovered multiple memory safety issues\n in Firefox. If a user were tricked in to opening a specially crafted\n website, an attacker could potentially exploit these to cause a denial of\n service via application crash, or execute arbitrary code with the\n privileges of the user invoking Firefox. (CVE-2016-2804, CVE-2016-2806,\n CVE-2016-2807)\n \n An invalid write was discovered when using the JavaScript .watch() method in\n some circumstances. If a user were tricked in to opening a specially crafted\n website, an attacker could potentially exploit this to cause a denial of\n service via application crash, or execute arbitrary code with the\n privileges of the user invoking Firefox. (CVE-2016-2808)\n \n Looben Yang discovered a use-after-free and buffer overflow in service\n workers. If a user were tricked in to opening a specially crafted website,\n an attacker could potentially exploit these to cause a denial of service\n via application crash, or execute arbitrary code with the privileges of\n the user invoking Firefox. (CVE-2016-2811, CVE-2016-2812)\n \n Sascha Just discovered a buffer overflow in libstagefright in some\n circumstances. If a user were tricked in to opening a specially crafted\n website, an attacker could potentially exploit this to cause a denial of\n service via application crash, or execute arbitrary code with the\n privileges of the user invoking Firefox. (CVE-2016-2814)\n \n Muneaki Nishimura discovered that CSP is not applied correctly to web\n content sent with the multipart/x-mixed-replace MIME type. An attacker\n could potentially exploit this to conduct cross-site scripting (XSS)\n attacks when they would otherwise be prevented. (CVE-2016-2816)\n \n Muneaki Nishimura discovered that the chrome.tabs.update API for web\n extensions allows for navigation to javascript: URLs. A malicious\n extension could potentially exploit this to conduct cross-site scripting\n (XSS) attacks. (CVE-2016-2817)\n \n Mark Goodwin discovered that about:healthreport accepts certain events\n from any content present in the remote-report iframe. If another\n vulnerability allowed the injection of web content in the remote-report\n iframe, an attacker could potentially exploit this to change the user's\n sharing preferences. (CVE-2016-2820)\n","modified":"2026-02-10T04:40:58Z","published":"2016-05-19T00:42:28Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-2936-3"},{"type":"REPORT","url":"https://launchpad.net/bugs/1583389"}],"affected":[{"package":{"name":"firefox","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/firefox@46.0.1+build1-0ubuntu0.14.04.3?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.0.1+build1-0ubuntu0.14.04.3"}]}],"versions":["24.0+build1-0ubuntu1","25.0+build3-0ubuntu0.13.10.1","28.0~b2+build1-0ubuntu2","28.0+build1-0ubuntu1","28.0+build2-0ubuntu1","28.0+build2-0ubuntu2","29.0+build1-0ubuntu0.14.04.2","30.0+build1-0ubuntu0.14.04.3","31.0+build1-0ubuntu0.14.04.1","32.0+build1-0ubuntu0.14.04.1","32.0.3+build1-0ubuntu0.14.04.1","33.0+build2-0ubuntu0.14.04.1","34.0+build2-0ubuntu0.14.04.1","35.0+build3-0ubuntu0.14.04.2","35.0.1+build1-0ubuntu0.14.04.1","36.0+build2-0ubuntu0.14.04.4","36.0.1+build2-0ubuntu0.14.04.1","36.0.4+build1-0ubuntu0.14.04.1","37.0+build2-0ubuntu0.14.04.1","37.0.1+build1-0ubuntu0.14.04.1","37.0.2+build1-0ubuntu0.14.04.1","38.0+build3-0ubuntu0.14.04.1","39.0+build5-0ubuntu0.14.04.1","39.0.3+build2-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.4","40.0.3+build1-0ubuntu0.14.04.1","41.0+build3-0ubuntu0.14.04.1","41.0.1+build2-0ubuntu0.14.04.1","41.0.2+build2-0ubuntu0.14.04.1","42.0+build2-0ubuntu0.14.04.1","43.0+build1-0ubuntu0.14.04.1","43.0.4+build3-0ubuntu0.14.04.1","44.0+build3-0ubuntu0.14.04.1","44.0.1+build2-0ubuntu0.14.04.1","44.0.2+build1-0ubuntu0.14.04.1","45.0+build2-0ubuntu0.14.04.1","45.0.1+build1-0ubuntu0.14.04.2","45.0.2+build1-0ubuntu0.14.04.1","46.0+build5-0ubuntu0.14.04.2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"firefox","binary_version":"46.0.1+build1-0ubuntu0.14.04.3"},{"binary_name":"firefox-dev","binary_version":"46.0.1+build1-0ubuntu0.14.04.3"},{"binary_name":"firefox-globalmenu","binary_version":"46.0.1+build1-0ubuntu0.14.04.3"},{"binary_name":"firefox-mozsymbols","binary_version":"46.0.1+build1-0ubuntu0.14.04.3"},{"binary_name":"firefox-testsuite","binary_version":"46.0.1+build1-0ubuntu0.14.04.3"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:14.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-2936-3.json"}},{"package":{"name":"firefox","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/firefox@46.0.1+build1-0ubuntu0.16.04.2?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.0.1+build1-0ubuntu0.16.04.2"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"firefox","binary_version":"46.0.1+build1-0ubuntu0.16.04.2"},{"binary_name":"firefox-dev","binary_version":"46.0.1+build1-0ubuntu0.16.04.2"},{"binary_name":"firefox-globalmenu","binary_version":"46.0.1+build1-0ubuntu0.16.04.2"},{"binary_name":"firefox-mozsymbols","binary_version":"46.0.1+build1-0ubuntu0.16.04.2"},{"binary_name":"firefox-testsuite","binary_version":"46.0.1+build1-0ubuntu0.16.04.2"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:16.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-2936-3.json"}}],"schema_version":"1.7.3"}