{"id":"USN-3175-2","summary":"firefox regression","details":"USN-3175-1 fixed vulnerabilities in Firefox. The update caused a\nregression on systems where the AppArmor profile for Firefox is set to\nenforce mode. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Multiple memory safety issues were discovered in Firefox. If a user were\n tricked in to opening a specially crafted website, an attacker could\n potentially exploit these to cause a denial of service via application\n crash, or execute arbitrary code. (CVE-2017-5373, CVE-2017-5374)\n \n JIT code allocation can allow a bypass of ASLR protections in some\n circumstances. If a user were tricked in to opening a specially crafted\n website, an attacker could potentially exploit this to cause a denial of\n service via application crash, or execute arbitrary code. (CVE-2017-5375)\n \n Nicolas Grégoire discovered a use-after-free when manipulating XSL in\n XSLT documents in some circumstances. If a user were tricked in to opening\n a specially crafted website, an attacker could potentially exploit this to\n cause a denial of service via application crash, or execute arbitrary\n code. (CVE-2017-5376)\n \n Atte Kettunen discovered a memory corruption issue in Skia in some\n circumstances. If a user were tricked in to opening a specially crafted\n website, an attacker could potentially exploit this to cause a denial of\n service via application crash, or execute arbitrary code. (CVE-2017-5377)\n \n Jann Horn discovered that an object's address could be discovered through\n hashed codes of JavaScript objects shared between pages. If a user were\n tricked in to opening a specially crafted website, an attacker could\n potentially exploit this to obtain sensitive information. (CVE-2017-5378)\n \n A use-after-free was discovered in Web Animations in some circumstances.\n If a user were tricked in to opening a specially crafted website, an\n attacker could potentially exploit this to cause a denial of service via\n application crash, or execute arbitrary code. (CVE-2017-5379)\n \n A use-after-free was discovered during DOM manipulation of SVG content in\n some circumstances. If a user were tricked in to opening a specially\n crafted website, an attacker could potentially exploit this to cause a\n denial of service via application crash, or execute arbitrary code.\n (CVE-2017-5380)\n \n Jann Horn discovered that the \"export\" function in the Certificate Viewer\n can force local filesystem navigation when the Common Name contains\n slashes. If a user were tricked in to exporting a specially crafted\n certificate, an attacker could potentially exploit this to save content\n with arbitrary filenames in unsafe locations. (CVE-2017-5381)\n \n Jerri Rice discovered that the Feed preview for RSS feeds can be used to\n capture errors and exceptions generated by privileged content. An attacker\n could potentially exploit this to obtain sensitive information.\n (CVE-2017-5382)\n \n Armin Razmjou discovered that certain unicode glyphs do not trigger\n punycode display. An attacker could potentially exploit this to spoof the\n URL bar contents. (CVE-2017-5383)\n \n Paul Stone and Alex Chapman discovered that the full URL path is exposed\n to JavaScript functions specified by Proxy Auto-Config (PAC) files. If a\n user has enabled Web Proxy Auto Detect (WPAD), an attacker could\n potentially exploit this to obtain sensitive information. (CVE-2017-5384)\n \n Muneaki Nishimura discovered that data sent in multipart channels will\n ignore the Referrer-Policy response headers. An attacker could potentially\n exploit this to obtain sensitive information. (CVE-2017-5385)\n \n Muneaki Nishimura discovered that WebExtensions can affect other\n extensions using the data: protocol. If a user were tricked in to\n installing a specially crafted addon, an attacker could potentially\n exploit this to obtain sensitive information or gain additional\n privileges. (CVE-2017-5386)\n \n Mustafa Hasan discovered that the existence of local files can be\n determined using the \u003ctrack\u003e element. An attacker could potentially\n exploit this to obtain sensitive information. (CVE-2017-5387)\n \n Cullen Jennings discovered that WebRTC can be used to generate large\n amounts of UDP traffic. An attacker could potentially exploit this to\n conduct Distributed Denial-of-Service (DDOS) attacks. (CVE-2017-5388)\n \n Kris Maglione discovered that WebExtensions can use the mozAddonManager\n API by modifying the CSP headers on sites with the appropriate permissions\n and then using host requests to redirect script loads to a malicious site.\n If a user were tricked in to installing a specially crafted addon, an\n attacker could potentially exploit this to install additional addons\n without user permission. (CVE-2017-5389)\n \n Jerri Rice discovered insecure communication methods in the Dev Tools JSON\n Viewer. An attacker could potentially exploit this to gain additional\n privileges. (CVE-2017-5390)\n \n Jerri Rice discovered that about: pages used by content can load\n privileged about: pages in iframes. An attacker could potentially exploit\n this to gain additional privileges, in combination with a\n content-injection bug in one of those about: pages. (CVE-2017-5391)\n \n Stuart Colville discovered that mozAddonManager allows for the\n installation of extensions from the CDN for addons.mozilla.org, a publicly\n accessible site. If a user were tricked in to installing a specially\n crafted addon, an attacker could potentially exploit this, in combination\n with a cross-site scripting (XSS) attack on Mozilla's AMO sites, to\n install additional addons. (CVE-2017-5393)\n \n Filipe Gomes discovered a use-after-free in the media decoder in some\n circumstances. If a user were tricked in to opening a specially crafted\n website, an attacker could potentially exploit this to cause a denial of\n service via application crash, or execute arbitrary code. (CVE-2017-5396)\n","modified":"2026-02-10T04:41:04Z","published":"2017-02-06T23:18:13Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-3175-2"},{"type":"REPORT","url":"https://launchpad.net/bugs/1659922"}],"affected":[{"package":{"name":"firefox","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/firefox@51.0.1+build2-0ubuntu0.14.04.2?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"51.0.1+build2-0ubuntu0.14.04.2"}]}],"versions":["24.0+build1-0ubuntu1","25.0+build3-0ubuntu0.13.10.1","28.0~b2+build1-0ubuntu2","28.0+build1-0ubuntu1","28.0+build2-0ubuntu1","28.0+build2-0ubuntu2","29.0+build1-0ubuntu0.14.04.2","30.0+build1-0ubuntu0.14.04.3","31.0+build1-0ubuntu0.14.04.1","32.0+build1-0ubuntu0.14.04.1","32.0.3+build1-0ubuntu0.14.04.1","33.0+build2-0ubuntu0.14.04.1","34.0+build2-0ubuntu0.14.04.1","35.0+build3-0ubuntu0.14.04.2","35.0.1+build1-0ubuntu0.14.04.1","36.0+build2-0ubuntu0.14.04.4","36.0.1+build2-0ubuntu0.14.04.1","36.0.4+build1-0ubuntu0.14.04.1","37.0+build2-0ubuntu0.14.04.1","37.0.1+build1-0ubuntu0.14.04.1","37.0.2+build1-0ubuntu0.14.04.1","38.0+build3-0ubuntu0.14.04.1","39.0+build5-0ubuntu0.14.04.1","39.0.3+build2-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.4","40.0.3+build1-0ubuntu0.14.04.1","41.0+build3-0ubuntu0.14.04.1","41.0.1+build2-0ubuntu0.14.04.1","41.0.2+build2-0ubuntu0.14.04.1","42.0+build2-0ubuntu0.14.04.1","43.0+build1-0ubuntu0.14.04.1","43.0.4+build3-0ubuntu0.14.04.1","44.0+build3-0ubuntu0.14.04.1","44.0.1+build2-0ubuntu0.14.04.1","44.0.2+build1-0ubuntu0.14.04.1","45.0+build2-0ubuntu0.14.04.1","45.0.1+build1-0ubuntu0.14.04.2","45.0.2+build1-0ubuntu0.14.04.1","46.0+build5-0ubuntu0.14.04.2","46.0.1+build1-0ubuntu0.14.04.3","47.0+build3-0ubuntu0.14.04.1","48.0+build2-0ubuntu0.14.04.1","49.0+build4-0ubuntu0.14.04.1","49.0.2+build2-0ubuntu0.14.04.1","50.0+build2-0ubuntu0.14.04.2","50.0.2+build1-0ubuntu0.14.04.1","50.1.0+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.1"],"ecosystem_specific":{"binaries":[{"binary_version":"51.0.1+build2-0ubuntu0.14.04.2","binary_name":"firefox"},{"binary_version":"51.0.1+build2-0ubuntu0.14.04.2","binary_name":"firefox-dev"},{"binary_version":"51.0.1+build2-0ubuntu0.14.04.2","binary_name":"firefox-globalmenu"},{"binary_version":"51.0.1+build2-0ubuntu0.14.04.2","binary_name":"firefox-mozsymbols"},{"binary_version":"51.0.1+build2-0ubuntu0.14.04.2","binary_name":"firefox-testsuite"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:14.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3175-2.json"}},{"package":{"name":"firefox","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/firefox@51.0.1+build2-0ubuntu0.16.04.2?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"51.0.1+build2-0ubuntu0.16.04.2"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2","46.0.1+build1-0ubuntu0.16.04.2","47.0+build3-0ubuntu0.16.04.1","48.0+build2-0ubuntu0.16.04.1","49.0+build4-0ubuntu0.16.04.1","49.0.2+build2-0ubuntu0.16.04.2","50.0+build2-0ubuntu0.16.04.2","50.0.2+build1-0ubuntu0.16.04.1","50.1.0+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.1"],"ecosystem_specific":{"binaries":[{"binary_version":"51.0.1+build2-0ubuntu0.16.04.2","binary_name":"firefox"},{"binary_version":"51.0.1+build2-0ubuntu0.16.04.2","binary_name":"firefox-dev"},{"binary_version":"51.0.1+build2-0ubuntu0.16.04.2","binary_name":"firefox-globalmenu"},{"binary_version":"51.0.1+build2-0ubuntu0.16.04.2","binary_name":"firefox-mozsymbols"},{"binary_version":"51.0.1+build2-0ubuntu0.16.04.2","binary_name":"firefox-testsuite"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3175-2.json"}}],"schema_version":"1.7.3"}