WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox < 51.

An update for firefox is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 21 February 2017] This advisory has been updated to include Firefox packages for the PPC and S390 architectures that were previously omitted. For this revised update, packages for all architectures were rebuilt. The rebuilt packages do not contain any new code changes.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 45.7.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378, CVE-2017-5380, CVE-2017-5383, CVE-2017-5386, CVE-2017-5390, CVE-2017-5396)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Jann Horn, Filipe Gomes, Muneaki Nishimura, Nils, Armin Razmjou, Christian Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom Schuster, Oriol, Rh0, Nicolas Gregoire, and Jerri Rice as the original reporters.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox. (CVE-2016-9079,CVE-2016-9893,     CVE-2016-9899, CVE-2016-9895, CVE-2016-9897,     CVE-2016-9898, CVE-2016-9900, CVE-2016-9901,     CVE-2016-9902, CVE-2016-9904,     CVE-2016-9905,CVE-2017-5373,CVE-2017-5375,CVE-2017-5376     ,CVE-2017-5378,CVE-2017-5380,CVE-2017-5383,CVE-2017-538     6,CVE-2017-5390,CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox.
    (CVE-2016-9079,CVE-2016-9893,CVE-2016-9895,CVE-2016-989     7,CVE-2016-9898,CVE-2016-9899,CVE-2016-9900,CVE-2016-99     01,CVE-2016-9902,CVE-2016-9904,CVE-2016-9905,CVE-2017-5     373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378,     CVE-2017-5380, CVE-2017-5383, CVE-2017-5386,     CVE-2017-5390, CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201702-22 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, bypass       access restriction, access otherwise protected information, or spoof       content via multiple vectors.
  Workaround :

    There is no known workaround at this time.

MozillaFirefox 45 ESR was updated to 45.7 to fix the following issues (bsc#1021991) :

  - MFSA 2017-02/CVE-2017-5378: Pointer and frame data     leakage of JavaScript objects (bsc#1021818)

  - MFSA 2017-02/CVE-2017-5396: Use-after-free with Media     Decoder (bsc#1021821)

  - MFSA 2017-02/CVE-2017-5386: WebExtensions can use data:
    protocol to affect other extensions (bsc#1021823)

  - MFSA 2017-02/CVE-2017-5380: Potential use-after-free     during DOM manipulations (bsc#1021819)

  - MFSA 2017-02/CVE-2017-5390: Insecure communication     methods in Developer Tools JSON viewer (bsc#1021820)

  - MFSA 2017-02/CVE-2017-5373: Memory safety bugs fixed in     Firefox 51 and Firefox ESR 45.7 (bsc#1021824)

  - MFSA 2017-02/CVE-2017-5375: Excessive JIT code     allocation allows bypass of ASLR and DEP (bsc#1021814)

  - MFSA 2017-02/CVE-2017-5376: Use-after-free in XSL     (bsc#1021817)

  - MFSA 2017-02/CVE-2017-5383: Location bar spoofing with     unicode characters (bsc#1021822) Please see     https://www.mozilla.org/en-US/security/advisories/mfsa20     17-02/ for more information.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox to version 51.0.1 fixes security issues and bugs.

These security issues were fixed :

  - CVE-2017-5375: Excessive JIT code allocation allows     bypass of ASLR and DEP (bmo#1325200, boo#1021814)

  - CVE-2017-5376: Use-after-free in XSL (bmo#1311687,     boo#1021817) CVE-2017-5377: Memory corruption with     transforms to create gradients in Skia (bmo#1306883,     boo#1021826)

  - CVE-2017-5378: Pointer and frame data leakage of     JavaScript objects (bmo#1312001, bmo#1330769,     boo#1021818)

  - CVE-2017-5379: Use-after-free in Web Animations     (bmo#1309198,boo#1021827)

  - CVE-2017-5380: Potential use-after-free during DOM     manipulations (bmo#1322107, boo#1021819)

  - CVE-2017-5390: Insecure communication methods in     Developer Tools JSON viewer (bmo#1297361, boo#1021820)

  - CVE-2017-5389: WebExtensions can install additional     add-ons via modified host requests (bmo#1308688,     boo#1021828)

  - CVE-2017-5396: Use-after-free with Media Decoder     (bmo#1329403, boo#1021821)

  - CVE-2017-5381: Certificate Viewer exporting can be used     to navigate and save to arbitrary filesystem locations     (bmo#1017616, boo#1021830)

  - CVE-2017-5382: Feed preview can expose privileged     content errors and exceptions (bmo#1295322, boo#1021831)

  - CVE-2017-5383: Location bar spoofing with unicode     characters (bmo#1323338, bmo#1324716, boo#1021822)

  - CVE-2017-5384: Information disclosure via Proxy     Auto-Config (PAC) (bmo#1255474, boo#1021832)

  - CVE-2017-5385: Data sent in multipart channels ignores     referrer-policy response headers (bmo#1295945,     boo#1021833)

  - CVE-2017-5386: WebExtensions can use data: protocol to     affect other extensions (bmo#1319070, boo#1021823)

  - CVE-2017-5391: Content about: pages can load privileged     about: pages (bmo#1309310, boo#1021835)

  - CVE-2017-5393: Remove addons.mozilla.org CDN from     whitelist for mozAddonManager (bmo#1309282, boo#1021837)

  - CVE-2017-5387: Disclosure of local file existence     through TRACK tag error messages (bmo#1295023,     boo#1021839)

  - CVE-2017-5388: WebRTC can be used to generate a large     amount of UDP traffic for DDOS attacks (bmo#1281482,     boo#1021840)

  - CVE-2017-5374: Memory safety bugs (boo#1021841)

  - CVE-2017-5373: Memory safety bugs (boo#1021824)

These non-security issues in MozillaFirefox were fixed :

  - Added support for FLAC (Free Lossless Audio Codec)     playback

  - Added support for WebGL 2

  - Added Georgian (ka) and Kabyle (kab) locales

  - Support saving passwords for forms without 'submit'     events

  - Improved video performance for users without GPU     acceleration

  - Zoom indicator is shown in the URL bar if the zoom level     is not at default level

  - View passwords from the prompt before saving them

  - Remove Belarusian (be) locale

  - Use Skia for content rendering (Linux)

  - Improve recognition of LANGUAGE env variable     (boo#1017174)

  - Multiprocess incompatibility did not correctly register     with some add-ons (bmo#1333423)

Versions of Mozilla Firefox ESR earlier than 45.7 are unpatched for the following vulnerabilities :

 - A flaw exists in JIT code allocation that may allow a context-dependent attacker to bypass the Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) protection mechanisms.
 - A use-after-free error exists in the 'txExecutionState::getVariable()' function in 'dom/xslt/xslt/txExecutionState.cpp' that is triggered when handling XSL in XSLT documents. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the program sharing hashed codes of JavaScripts objects between pages. This may allow a context-dependent attacker to gain access to potentially sensitive data by discovering the object's address through a pointer leak.
 - A use-after-free error exists in the 'PresShell::FlushPendingNotifications()' function in 'layout/base/PresShell.cpp' that is triggered during DOM manipulation of SVG content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the JSON viewer in the Developer Tools insecurely creating communication channels for copying and viewing JSON or HTTP headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data.
 - A flaw exists in the 'ICCallStubCompiler::guardFunApply()' function in 'js/src/jit/BaselineIC.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::createThisScriptedSingleton()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AddLazyFunctionsForCompartment()' function in 'js/src/jscompartment.cpp' that is triggered when handling references to a compartment's lazy functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::DefineTypedArrayElement()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DataViewObject::create()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::initEnvironmentChain()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the JavaScript JIT compiler that is triggered when handling windows. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDOMConstructor::HasInstance()' function in 'dom/base/nsDOMClassInfo.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocument::SetScriptGlobalObject()' function in 'dom/base/nsDocument.cpp' that is triggered when handling specially crafted media files. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered during the handling of a specially crafted URL that contains certain unicode glyphs for alternative hyphens and quotes. This may allow a context-dependent attacker to spoof the location bar.
 - A flaw exists that may allow WebExtension scripts to use the 'data: protocol' to affect pages loaded by other extensions. This may allow a context-dependent attacker to potentially disclose sensitive information or gain elevated privileges related to other extensions.

Versions of Mozilla Firefox prior to 51 are unpatched for the following vulnerabilities :

 - A flaw exists in JIT code allocation that may allow a context-dependent attacker to bypass the Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) protection mechanisms.
 - A use-after-free error exists in the 'txExecutionState::getVariable()' function in 'dom/xslt/xslt/txExecutionState.cpp' that is triggered when handling XSL in XSLT documents. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the program sharing hashed codes of JavaScript objects between pages. This may allow a context-dependent to gain access to potentially sensitive data by discovering the object's address through a pointer leak.
 - A use-after-free error exists in the 'nsDocument::GetAnimations()' function in 'dom/base/nsDocument.cpp' that is triggered when handling web animations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'PresShell::FlushPendingNotifications()' function in 'layout/base/PresShell.cpp' that is triggered during DOM manipulation of SVG content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the JSON viewer in the Developer Tools insecurely creating communication channels for copying and viewing JSON or HTTP headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data.
 - A flaw exists in the 'mozAddonManager' API that may allow a WebExtension attacker to modify CSP headers. This may allow a context-dependent attacker to use a host request to redirect script load to a malicious site, where it will install additional extensions without the user's consent.
 - A flaw exists in the 'RangeAnalysis::addBetaNodes()' function in 'js/src/jit/RangeAnalysis.cpp' related to improper comparisons being performed when adding beta nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/DOMMediaStream.cpp' that is triggered when handling media stream tracks. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Library::Create()' function in 'js/src/ctypes/Library.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Library::Create()' function in 'js/src/ctypes/Library.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/workers/ServiceWorkerRegistration.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsAttrAndChildArray::GrowBy()' function in 'dom/base/nsAttrAndChildArray.cpp' related to a missing return value check. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AppendUTF16toUTF8()' function in 'xpcom/string/nsReadableUtils.cpp' that is triggered when handling certain size calculations. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'xpcom/string/nsTSubstringTuple.cpp' that is triggered when handling substring tuble lengths. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An integer overflow condition exists in the 'RTCPPacketInformation::AddApplicationData()' function in 'webrtc/modules/rtp_rtcp/source/rtcp_receiver_help.cc' that is triggered when handling RTCP APP packets. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GetDatabaseFileURL()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered when handling file: URIs. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'gfx/2d/PathRecording.h' that is triggered when handling event recorders. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ICCallStubCompiler::guardFunApply()' function in 'js/src/jit/BaselineIC.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::createThisScriptedSingleton()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AddLazyFunctionsForCompartment()' function in 'js/src/jscompartment.cpp' that is triggered when handling references to a compartment's lazy functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::DefineTypedArrayElement()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DataViewObject::create()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::initEnvironmentChain()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the JavaScript JIT compiler that is triggered when handling windows. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDOMConstructor::HasInstance()' function in 'dom/base/nsDOMClassInfo.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocument::SetScriptGlobalObject()' function in 'dom/base/nsDocument.cpp' that is triggered when handling specially crafted media files. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'security/manager/pki/resources/content/pippki.js' that allows traversing outside of a restricted path. The issue is due to the export functions in the certificate viewer not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). This may allow a context-dependent attacker to make changes to the save destination for certificate content.
 - A flaw exists that may allow a remote attacker to use the preview feature for RSS feeds to view potentially sensitive privileged content errors and exceptions.
 - A flaw exists that is triggered during the handling of a specially crafted URL that contains certain unicode glyphs for alternative hyphens and quotes. This may allow a context-dependent attacker to spoof the location bar.
 - A flaw exists that is triggered during the handling of a specially crafted Proxy Auto-Config (PAC) file. This file may potentially specify which JavaScript function is called for URL requests, allowing a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw exists in 'dom/base/nsDocument.cpp' that is triggered as data sent with multipart channels, such as the multipart/x-mixed-replace MIME type, ignores the bypass referrer-policy response header. This may allow a context-dependent attacker to and gain access to sensitive information related to sites using the header.
 - A flaw exists that may allow WebExtension scripts to use the 'data: protocol' to affect pages loaded by other extensions. This may allow a context-dependent attacker to potentially disclose sensitive information or gain elevated privileges related to other extensions.
 - A flaw exists in 'mobile/android/chrome/content/browser.js' that is triggered when handling a series of JavaScript events in fullscreen mode. This may allow a context-dependent attacker to spoof the location bar.
 - A flaw exists that is triggered as certain 'about: pages' used by web content may load other privileged 'about: pages' within an iframe. This may potentially allow a context-dependent attacker to gain elevated privileges.
 - A flaw exists that is triggered as weak proxy objects may have weak references on multiple threads, instead of only one. This may potentially allow a context-dependent attacker to corrupt memory and execute arbitrary code.
 - A flaw exists in 'toolkit/mozapps/extensions/AddonManager.jsm' that is triggered as mozAddonManager allows for extension installation from the CDN for addons.mozilla.org. This may potentially allow a malicious extension to install additional extensions.
 - A flaw exists that is triggered when the location bar of a new page has been scrolled out of view. This may potentially allow a context-dependent attacker to spoof the location bar.
 - A flaw exists in the 'HTMLTrackElement::SetReadyState()' function in 'dom/html/HTMLTrackElement.cpp' that is triggered when handling TRACK tag error messages. This may allow a context-dependent attacker to enumerate the existence of local files.
 - A flaw exists in 'media/mtransport/nr_socket_prsock.cpp' that is triggered when a STUN server is used in conjunction with a saturation of webkitRTCPeerConnection objects, which may in turn produce a high volume of STUN packets. This may allow a remote attacker to generate significant UDP traffic, resulting in an amplification denial-of-service attack. When performed by multiple machines, a distributed denial-of-service (DDoS) attack can be carried out very effectively.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3175-1 advisory.

    Multiple memory safety issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via application     crash, or execute arbitrary code. (CVE-2017-5373, CVE-2017-5374)

    JIT code allocation can allow a bypass of ASLR protections in some circumstances. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code. (CVE-2017-5375)

    Nicolas Grgoire discovered a use-after-free when manipulating XSL in XSLT documents in some     circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-5376)

    Atte Kettunen discovered a memory corruption issue in Skia in some circumstances. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code. (CVE-2017-5377)

    Jann Horn discovered that an object's address could be discovered through hashed codes of JavaScript     objects shared between pages. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to obtain sensitive information. (CVE-2017-5378)

    A use-after-free was discovered in Web Animations in some circumstances. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code. (CVE-2017-5379)

    A use-after-free was discovered during DOM manipulation of SVG content in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5380)

    Jann Horn discovered that the export function in the Certificate Viewer can force local filesystem     navigation when the Common Name contains slashes. If a user were tricked in to exporting a specially     crafted certificate, an attacker could potentially exploit this to save content with arbitrary filenames     in unsafe locations. (CVE-2017-5381)

    Jerri Rice discovered that the Feed preview for RSS feeds can be used to capture errors and exceptions     generated by privileged content. An attacker could potentially exploit this to obtain sensitive     information. (CVE-2017-5382)

    Armin Razmjou discovered that certain unicode glyphs do not trigger punycode display. An attacker could     potentially exploit this to spoof the URL bar contents. (CVE-2017-5383)

    Paul Stone and Alex Chapman discovered that the full URL path is exposed to JavaScript functions specified     by Proxy Auto-Config (PAC) files. If a user has enabled Web Proxy Auto Detect (WPAD), an attacker could     potentially exploit this to obtain sensitive information. (CVE-2017-5384)

    Muneaki Nishimura discovered that data sent in multipart channels will ignore the Referrer-Policy response     headers. An attacker could potentially exploit this to obtain sensitive information. (CVE-2017-5385)

    Muneaki Nishimura discovered that WebExtensions can affect other extensions using the data: protocol. If a     user were tricked in to installing a specially crafted addon, an attacker could potentially exploit this     to obtain sensitive information or gain additional privileges. (CVE-2017-5386)

    Mustafa Hasan discovered that the existence of local files can be determined using the <track> element. An     attacker could potentially exploit this to obtain sensitive information. (CVE-2017-5387)

    Cullen Jennings discovered that WebRTC can be used to generate large amounts of UDP traffic. An attacker     could potentially exploit this to conduct Distributed Denial-of-Service (DDOS) attacks. (CVE-2017-5388)

    Kris Maglione discovered that WebExtensions can use the mozAddonManager API by modifying the CSP headers     on sites with the appropriate permissions and then using host requests to redirect script loads to a     malicious site. If a user were tricked in to installing a specially crafted addon, an attacker could     potentially exploit this to install additional addons without user permission. (CVE-2017-5389)

    Jerri Rice discovered insecure communication methods in the Dev Tools JSON Viewer. An attacker could     potentially exploit this to gain additional privileges. (CVE-2017-5390)

    Jerri Rice discovered that about: pages used by content can load privileged about: pages in iframes. An     attacker could potentially exploit this to gain additional privileges, in combination with a content-     injection bug in one of those about: pages. (CVE-2017-5391)

    Stuart Colville discovered that mozAddonManager allows for the installation of extensions from the CDN for     addons.mozilla.org, a publicly accessible site. If a user were tricked in to installing a specially     crafted addon, an attacker could potentially exploit this, in combination with a cross-site scripting     (XSS) attack on Mozilla's AMO sites, to install additional addons. (CVE-2017-5393)

    Filipe Gomes discovered a use-after-free in the media decoder in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code. (CVE-2017-5396)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or information leaks or privilege escalation.

For Debian 7 'Wheezy', these problems have been fixed in version 45.7.0esr-1~deb7u1.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for firefox is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 21 February 2017] This advisory has been updated to include Firefox packages for the PPC and S390 architectures that were previously omitted. For this revised update, packages for all architectures were rebuilt. The rebuilt packages do not contain any new code changes.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 45.7.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378, CVE-2017-5380, CVE-2017-5383, CVE-2017-5386, CVE-2017-5390, CVE-2017-5396)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Jann Horn, Filipe Gomes, Muneaki Nishimura, Nils, Armin Razmjou, Christian Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom Schuster, Oriol, Rh0, Nicolas Gregoire, and Jerri Rice as the original reporters.

New mozilla-thunderbird packages are available for Slackware 14.1, 14.2, and -current to fix security issues.

This update upgrades Firefox to version 45.7.0 ESR.

Security Fix(es) :

  - Multiple flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Firefox to crash or, potentially, execute     arbitrary code with the privileges of the user running     Firefox. (CVE-2017-5373, CVE-2017-5375, CVE-2017-5376,     CVE-2017-5378, CVE-2017-5380, CVE-2017-5383,     CVE-2017-5386, CVE-2017-5390, CVE-2017-5396)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-0190 advisory.

    [45.7.0-1.0.1]
    - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html       and remove the corresponding Red Hat files

    [45.7.0-1]
    - Updated to 45.7.0 (B1)

    [45.6.0-2]
    - Enabled ffmpeg > 54.35.1 (rhbz#1330898, mozbz#1263665)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in the Mozilla Firefox web browser: Memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code, information disclosure or privilege escalation.

The version of Mozilla Firefox installed on the remote Windows host is prior to 51.0. It is, therefore, affected by multiple vulnerabilities :

  - Mozilla developers and community members Christian     Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom     Schuster, and Oriol reported memory safety bugs present     in Firefox 50.1 and Firefox ESR 45.6. Some of these     bugs showed evidence of memory corruption and we     presume that with enough effort that some of these     could be exploited to run arbitrary code.
    (CVE-2017-5373)

  - Mozilla developers and community members Gary Kwong,     Olli Pettay, Tooru Fujisawa, Carsten Book, Andrew     McCreight, Chris Pearce, Ronald Crane, Jan de Mooij,     Julian Seward, Nicolas Pierron, Randell Jesup, Esther     Monchari, Honza Bambas, and Philipp reported memory     safety bugs present in Firefox 50.1. Some of these bugs     showed evidence of memory corruption and we presume     that with enough effort that some of these could be     exploited to run arbitrary code. (CVE-2017-5374)

  - JIT code allocation can allow for a bypass of ASLR and     DEP protections leading to potential memory corruption     attacks. (CVE-2017-5375)

  - Use-after-free while manipulating XSL in XSLT documents     (CVE-2017-5376)

  - A memory corruption vulnerability in Skia that can     occur when using transforms to make gradients,     resulting in a potentially exploitable crash.
    (CVE-2017-5377)

  - Hashed codes of JavaScript objects are shared between     pages. This allows for pointer leaks because an object's     address can be discovered through hash codes, and also     allows for data leakage of an object's content using     these hash codes. (CVE-2017-5378)

  - Use-after-free vulnerability in Web Animations when     interacting with cycle collection found through     fuzzing. (CVE-2017-5379)

  - A potential use-after-free found through fuzzing during     DOM manipulation of SVG content. (CVE-2017-5380)

  - The 'export' function in the Certificate Viewer can     force local filesystem navigation when the 'common     name' in a certificate contains slashes, allowing     certificate content to be saved in unsafe locations     with an arbitrary filename. (CVE-2017-5381)

  - Feed preview for RSS feeds can be used to capture     errors and exceptions generated by privileged content,     allowing for the exposure of internal information not     meant to be seen by web content. (CVE-2017-5382)

  - URLs containing certain unicode glyphs for alternative     hyphens and quotes do not properly trigger punycode     display, allowing for domain name spoofing attacks in     the location bar. (CVE-2017-5383)

  - Proxy Auto-Config (PAC) files can specify a JavaScript     function called for all URL requests with the full URL     path which exposes more information than would be sent     to the proxy itself in the case of HTTPS. Normally the     Proxy Auto-Config file is specified by the user or     machine owner and presumed to be non-malicious, but if     a user has enabled Web Proxy Auto Detect (WPAD) this     file can be served remotely. (CVE-2017-5384)

  - Data sent with in multipart channels, such as the     multipart/x-mixed-replace MIME type, will ignore the     referrer-policy response header, leading to potential     information disclosure for sites using this header.
    (CVE-2017-5385)

  - WebExtension scripts can use the 'data:' protocol to     affect pages loaded by other web extensions using this     protocol, leading to potential data disclosure or     privilege escalation in affected extensions.
    (CVE-2017-5386)

  - The existence of a specifically requested local file     can be found due to the double firing of the 'onerror'     when the 'source' attribute on a <track> tag refers to     a file that does not exist if the source page is loaded     locally. (CVE-2017-5387)

  - A STUN server in conjunction with a large number of     'webkitRTCPeerConnection' objects can be used to send     large STUN packets in a short period of time due to a     lack of rate limiting being applied on e10s systems,     allowing for a denial of service attack. (CVE-2017-5388)

  - WebExtensions could use the 'mozAddonManager' API by     modifying the CSP headers on sites with the appropriate     permissions and then using host requests to redirect     script loads to a malicious site. This allows a     malicious extension to then install additional     extensions without explicit user permission.
    (CVE-2017-5389)

  - The JSON viewer in the Developer Tools uses insecure     methods to create a communication channel for copying     and viewing JSON or HTTP headers data, allowing for     potential privilege escalation. (CVE-2017-5390)

  - Special 'about:' pages used by web content, such as RSS     feeds, can load privileged 'about:' pages in an iframe.
    If a content-injection bug were found in one of those     pages this could allow for potential privilege     escalation. (CVE-2017-5391)

  - The 'mozAddonManager' allows for the installation of     extensions from the CDN for addons.mozilla.org, a     publicly accessible site. This could allow malicious     extensions to install additional extensions from the CDN     in combination with an XSS attack on Mozilla AMO sites.
    (CVE-2017-5393)

  - A use-after-free vulnerability in the Media Decoder     when working with media files when some events are     fired after the media elements are freed from memory.
    (CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the Mozilla security advisories.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 45.7. It is, therefore, affected by multiple vulnerabilities :

  - Mozilla developers and community members Christian     Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom     Schuster, and Oriol reported memory safety bugs present     in Firefox 50.1 and Firefox ESR 45.6. Some of these     bugs showed evidence of memory corruption and we     presume that with enough effort that some of these     could be exploited to run arbitrary code.
    (CVE-2017-5373)

  - JIT code allocation can allow for a bypass of ASLR and     DEP protections leading to potential memory corruption     attacks. (CVE-2017-5375)

  - Use-after-free while manipulating XSL in XSLT documents     (CVE-2017-5376)

  - Hashed codes of JavaScript objects are shared between     pages. This allows for pointer leaks because an object's     address can be discovered through hash codes, and also     allows for data leakage of an object's content using     these hash codes. (CVE-2017-5378)

  - A potential use-after-free found through fuzzing during     DOM manipulation of SVG content. (CVE-2017-5380)

  - URLs containing certain unicode glyphs for alternative     hyphens and quotes do not properly trigger punycode     display, allowing for domain name spoofing attacks in     the location bar. (CVE-2017-5383)

  - WebExtension scripts can use the 'data:' protocol to     affect pages loaded by other web extensions using this     protocol, leading to potential data disclosure or     privilege escalation in affected extensions.
    (CVE-2017-5386)

  - The JSON viewer in the Developer Tools uses insecure     methods to create a communication channel for copying     and viewing JSON or HTTP headers data, allowing for     potential privilege escalation. (CVE-2017-5390)

  - A use-after-free vulnerability in the Media Decoder     when working with media files when some events are     fired after the media elements are freed from memory.
    (CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the Mozilla security advisories.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 51. It is, therefore, affected by the following vulnerabilities :

  - Mozilla developers and community members Christian     Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom     Schuster, and Oriol reported memory safety bugs present     in Firefox 50.1 and Firefox ESR 45.6. Some of these     bugs showed evidence of memory corruption and we     presume that with enough effort that some of these     could be exploited to run arbitrary code.
    (CVE-2017-5373)

  - Mozilla developers and community members Gary Kwong,     Olli Pettay, Tooru Fujisawa, Carsten Book, Andrew     McCreight, Chris Pearce, Ronald Crane, Jan de Mooij,     Julian Seward, Nicolas Pierron, Randell Jesup, Esther     Monchari, Honza Bambas, and Philipp reported memory     safety bugs present in Firefox 50.1. Some of these bugs     showed evidence of memory corruption and we presume     that with enough effort that some of these could be     exploited to run arbitrary code. (CVE-2017-5374)

  - JIT code allocation can allow for a bypass of ASLR and     DEP protections leading to potential memory corruption     attacks. (CVE-2017-5375)

  - Use-after-free while manipulating XSL in XSLT documents     (CVE-2017-5376)

  - A memory corruption vulnerability in Skia that can     occur when using transforms to make gradients,     resulting in a potentially exploitable crash.
    (CVE-2017-5377)

  - Hashed codes of JavaScript objects are shared between     pages. This allows for pointer leaks because an object's     address can be discovered through hash codes, and also     allows for data leakage of an object's content using     these hash codes. (CVE-2017-5378)

  - Use-after-free vulnerability in Web Animations when     interacting with cycle collection found through     fuzzing. (CVE-2017-5379)

  - A potential use-after-free found through fuzzing during     DOM manipulation of SVG content. (CVE-2017-5380)

  - The 'export' function in the Certificate Viewer can     force local filesystem navigation when the 'common     name' in a certificate contains slashes, allowing     certificate content to be saved in unsafe locations     with an arbitrary filename. (CVE-2017-5381)

  - Feed preview for RSS feeds can be used to capture     errors and exceptions generated by privileged content,     allowing for the exposure of internal information not     meant to be seen by web content. (CVE-2017-5382)

  - URLs containing certain unicode glyphs for alternative     hyphens and quotes do not properly trigger punycode     display, allowing for domain name spoofing attacks in     the location bar. (CVE-2017-5383)

  - Proxy Auto-Config (PAC) files can specify a JavaScript     function called for all URL requests with the full URL     path which exposes more information than would be sent     to the proxy itself in the case of HTTPS. Normally the     Proxy Auto-Config file is specified by the user or     machine owner and presumed to be non-malicious, but if     a user has enabled Web Proxy Auto Detect (WPAD) this     file can be served remotely. (CVE-2017-5384)

  - Data sent with in multipart channels, such as the     multipart/x-mixed-replace MIME type, will ignore the     referrer-policy response header, leading to potential     information disclosure for sites using this header.
    (CVE-2017-5385)

  - WebExtension scripts can use the 'data:' protocol to     affect pages loaded by other web extensions using this     protocol, leading to potential data disclosure or     privilege escalation in affected extensions.
    (CVE-2017-5386)

  - The existence of a specifically requested local file     can be found due to the double firing of the 'onerror'     when the 'source' attribute on a <track> tag refers to     a file that does not exist if the source page is loaded     locally. (CVE-2017-5387)

  - A STUN server in conjunction with a large number of     'webkitRTCPeerConnection' objects can be used to send     large STUN packets in a short period of time due to a     lack of rate limiting being applied on e10s systems,     allowing for a denial of service attack. (CVE-2017-5388)

  - WebExtensions could use the 'mozAddonManager' API by     modifying the CSP headers on sites with the appropriate     permissions and then using host requests to redirect     script loads to a malicious site. This allows a     malicious extension to then install additional     extensions without explicit user permission.
    (CVE-2017-5389)

  - The JSON viewer in the Developer Tools uses insecure     methods to create a communication channel for copying     and viewing JSON or HTTP headers data, allowing for     potential privilege escalation. (CVE-2017-5390)

  - Special 'about:' pages used by web content, such as RSS     feeds, can load privileged 'about:' pages in an iframe.
    If a content-injection bug were found in one of those     pages this could allow for potential privilege     escalation. (CVE-2017-5391)

  - The 'mozAddonManager' allows for the installation of     extensions from the CDN for addons.mozilla.org, a     publicly accessible site. This could allow malicious     extensions to install additional extensions from the CDN     in combination with an XSS attack on Mozilla AMO sites.
    (CVE-2017-5393)

  - A use-after-free vulnerability in the Media Decoder     when working with media files when some events are     fired after the media elements are freed from memory.
    (CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the Mozilla security advisories.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is 45.x prior to 45.7. It is, therefore, affected by the following vulnerabilities :

  - Mozilla developers and community members Christian     Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom     Schuster, and Oriol reported memory safety bugs present     in Firefox 50.1 and Firefox ESR 45.6. Some of these     bugs showed evidence of memory corruption and we     presume that with enough effort that some of these     could be exploited to run arbitrary code.
    (CVE-2017-5373)

  - JIT code allocation can allow for a bypass of ASLR and     DEP protections leading to potential memory corruption     attacks. (CVE-2017-5375)

  - Use-after-free while manipulating XSL in XSLT documents     (CVE-2017-5376)

  - Hashed codes of JavaScript objects are shared between     pages. This allows for pointer leaks because an object's     address can be discovered through hash codes, and also     allows for data leakage of an object's content using     these hash codes. (CVE-2017-5378)

  - A potential use-after-free found through fuzzing during     DOM manipulation of SVG content. (CVE-2017-5380)

  - URLs containing certain unicode glyphs for alternative     hyphens and quotes do not properly trigger punycode     display, allowing for domain name spoofing attacks in     the location bar. (CVE-2017-5383)

  - WebExtension scripts can use the 'data:' protocol to     affect pages loaded by other web extensions using this     protocol, leading to potential data disclosure or     privilege escalation in affected extensions.
    (CVE-2017-5386)

  - The JSON viewer in the Developer Tools uses insecure     methods to create a communication channel for copying     and viewing JSON or HTTP headers data, allowing for     potential privilege escalation. (CVE-2017-5390)

  - A use-after-free vulnerability in the Media Decoder     when working with media files when some events are     fired after the media elements are freed from memory.
    (CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the Mozilla security advisories.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Foundation reports :

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
101416	Virtuozzo 6 : firefox (VZLSA-2017-0190)	Nessus	Virtuozzo Local Security Checks	critical
99858	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1012)	Nessus	Huawei Local Security Checks	critical
99857	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1011)	Nessus	Huawei Local Security Checks	critical
97265	GLSA-201702-22 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
97082	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2017:0427-1)	Nessus	SuSE Local Security Checks	critical
97081	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2017:0426-1)	Nessus	SuSE Local Security Checks	critical
96940	openSUSE Security Update : MozillaFirefox (openSUSE-2017-187)	Nessus	SuSE Local Security Checks	critical
9928	Mozilla Firefox ESR < 45.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
9927	Mozilla Firefox < 51 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
96872	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3175-1)	Nessus	Ubuntu Local Security Checks	critical
96815	Debian DLA-800-1 : firefox-esr security update	Nessus	Debian Local Security Checks	critical
96813	CentOS 5 / 6 / 7 : firefox (CESA-2017:0190)	Nessus	CentOS Local Security Checks	critical
96804	Slackware 14.1 / 14.2 / current : mozilla-thunderbird (SSA:2017-026-01)	Nessus	Slackware Local Security Checks	critical
96792	Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20170125)	Nessus	Scientific Linux Local Security Checks	critical
96791	RHEL 5 / 6 / 7 : firefox (RHSA-2017:0190)	Nessus	Red Hat Local Security Checks	critical
96789	Oracle Linux 5 / 6 / 7 : firefox (ELSA-2017-0190)	Nessus	Oracle Linux Local Security Checks	critical
96780	Debian DSA-3771-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
96776	Mozilla Firefox < 51.0 Multiple Vulnerabilities	Nessus	Windows	critical
96775	Mozilla Firefox ESR < 45.7 Multiple Vulnerabilities	Nessus	Windows	critical
96774	Mozilla Firefox < 51 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
96773	Mozilla Firefox ESR 45.x < 45.7 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
96743	FreeBSD : mozilla -- multiple vulnerabilities (e60169c4-aa86-46b0-8ae2-0d81f683df09)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-5386

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical