The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool. This vulnerability affects Firefox ESR < 52.3 and Firefox < 55.

The remote NewStart CGSL host, running version MAIN 4.05, has firefox packages installed that are affected by multiple vulnerabilities:

  - File downloads encoded with blob: and data: URL     elements bypassed normal file download checks though the     Phishing and Malware Protection feature and its block     lists of suspicious sites and files. This would allow     malicious sites to lure users into downloading     executables that would otherwise be detected as     suspicious. This vulnerability affects Firefox < 56,     Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7814)

  - A use-after-free vulnerability can occur in design mode     when image objects are resized if objects referenced     during the resizing have been freed from memory. This     results in a potentially exploitable crash. This     vulnerability affects Firefox < 56, Firefox ESR < 52.4,     and Thunderbird < 52.4. (CVE-2017-7819)

  - The content security policy (CSP) sandbox directive     did not create a unique origin for the document, causing     it to behave as if the allow-same-origin keyword were     always specified. This could allow a Cross-Site     Scripting (XSS) attack to be launched from unsafe     content. This vulnerability affects Firefox < 56,     Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7823)

  - A use-after-free vulnerability can occur when an editor     DOM node is deleted prematurely during tree traversal     while still bound to the document. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.3, Firefox ESR < 52.3, and     Firefox < 55. (CVE-2017-7809)

  - Memory safety bugs were reported in Firefox 54, Firefox     ESR 52.2, and Thunderbird 52.2. Some of these bugs     showed evidence of memory corruption and we presume that     with enough effort that some of these could be exploited     to run arbitrary code. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7779)

  - An out-of-bounds read occurs when applying style rules     to pseudo-elements, such as ::first-line, using cached     style data. This vulnerability affects Thunderbird <     52.3, Firefox ESR < 52.3, and Firefox < 55.
    (CVE-2017-7753)

  - A buffer overflow can occur when manipulating Accessible     Rich Internet Applications (ARIA) attributes within the     DOM. This results in a potentially exploitable crash.
    This vulnerability affects Thunderbird < 52.3, Firefox     ESR < 52.3, and Firefox < 55. (CVE-2017-7785)

  - A buffer overflow can occur when the image renderer     attempts to paint non-displayable SVG elements. This     results in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7786)

  - Same-origin policy protections can be bypassed on pages     with embedded iframes during page reloads, allowing the     iframes to access content on the top level page, leading     to information disclosure. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7787)

  - A buffer overflow will occur when viewing a certificate     in the certificate manager if the certificate has an     extremely long object identifier (OID). This results in     a potentially exploitable crash. This vulnerability     affects Thunderbird < 52.3, Firefox ESR < 52.3, and     Firefox < 55. (CVE-2017-7792)

  - On pages containing an iframe, the data: protocol can     be used to create a modal alert that will render over     arbitrary domains following page navigation, spoofing of     the origin of the modal alert from the iframe content.
    This vulnerability affects Thunderbird < 52.3, Firefox     ESR < 52.3, and Firefox < 55. (CVE-2017-7791)

  - A use-after-free vulnerability can occur in WebSockets     when the object holding the connection is freed before     the disconnection operation is finished. This results in     an exploitable crash. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7800)

  - The Developer Tools feature suffers from a XUL injection     vulnerability due to improper sanitization of the web     page source code. In the worst case, this could allow     arbitrary code execution when opening a malicious page     with the style editor tool. This vulnerability affects     Firefox ESR < 52.3 and Firefox < 55. (CVE-2017-7798)

  - A use-after-free vulnerability can occur when     manipulating the DOM during the resize event of an image     element. If these elements have been freed due to a lack     of strong references, a potentially exploitable crash     may occur when the freed elements are accessed. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7802)

  - A use-after-free vulnerability can occur while re-     computing layout for a marquee element during window     resizing where the updated style object is freed while     still in use. This results in a potentially exploitable     crash. This vulnerability affects Thunderbird < 52.3,     Firefox ESR < 52.3, and Firefox < 55. (CVE-2017-7801)

  - A mechanism that uses AppCache to hijack a URL in a     domain using fallback by serving the files from a sub-     path on the domain. This has been addressed by requiring     fallback files be inside the manifest directory. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7807)

  - When a page's content security policy (CSP) header     contains a sandbox directive, other directives are     ignored. This results in the incorrect enforcement of     CSP. This vulnerability affects Thunderbird < 52.3,     Firefox ESR < 52.3, and Firefox < 55. (CVE-2017-7803)

  - A use-after-free vulnerability can occur when reading an     image observer during frame reconstruction after the     observer has been freed. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7784)

  - A use-after-free vulnerability can occur when     manipulating arrays of Accessible Rich Internet     Applications (ARIA) elements within containers through     the DOM. This results in a potentially exploitable     crash. This vulnerability affects Firefox < 56, Firefox     ESR < 52.4, and Thunderbird < 52.4. (CVE-2017-7818)

  - A buffer overflow occurs when drawing and validating     elements with the ANGLE graphics library, used for WebGL     content. This is due to an incorrect value being passed     within the library during checks and results in a     potentially exploitable crash. This vulnerability     affects Firefox < 56, Firefox ESR < 52.4, and     Thunderbird < 52.4. (CVE-2017-7824)

  - Memory safety bugs were reported in Firefox 55 and     Firefox ESR 52.3. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 56, Firefox     ESR < 52.4, and Thunderbird < 52.4. (CVE-2017-7810)

  - A use-after-free vulnerability can occur in the Fetch     API when the worker or the associated window are freed     when still in use, resulting in a potentially     exploitable crash. This vulnerability affects Firefox <     56, Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7793)

  - A privacy flaw was discovered in Firefox. In Private     Browsing mode, a web worker could write persistent data     to IndexedDB, which was not cleared when exiting and     would persist across multiple sessions. A malicious     website could exploit the flaw to bypass private-     browsing protections and uniquely fingerprint visitors.
    (CVE-2017-7843)

  - A use-after-free vulnerability can occur when flushing     and resizing layout because the PressShell object has     been freed while still in use. This results in a     potentially exploitable crash during these operations.
    This vulnerability affects Firefox < 57, Firefox ESR <     52.5, and Thunderbird < 52.5. (CVE-2017-7828)

  - Memory safety bugs were reported in Firefox 56 and     Firefox ESR 52.4. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 57, Firefox     ESR < 52.5, and Thunderbird < 52.5. (CVE-2017-7826)

  - The Resource Timing API incorrectly revealed navigations     in cross-origin iframes. This is a same-origin policy     violation and could allow for data theft of URLs loaded     by users. This vulnerability affects Firefox < 57,     Firefox ESR < 52.5, and Thunderbird < 52.5.
    (CVE-2017-7830)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201802-03 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page, possibly resulting in the execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to perform Man-in-the-Middle attacks,       obtain sensitive information, spoof the address bar, conduct clickjacking       attacks, bypass security restrictions and protection mechanisms, or have       other unspecified impact.
  Workaround :

    There is no known workaround at this time.

This update for MozillaFirefox to ESR 52.3 fixes several issues. These security issues were fixed :

  - CVE-2017-7807 Domain hijacking through AppCache fallback     (bsc#1052829)

  - CVE-2017-7791 Spoofing following page navigation with     data: protocol and modal alerts (bsc#1052829)

  - CVE-2017-7792 Buffer overflow viewing certificates with     an extremely long OID (bsc#1052829)

  - CVE-2017-7782 WindowsDllDetourPatcher allocates memory     without DEP protections (bsc#1052829)

  - CVE-2017-7787 Same-origin policy bypass with iframes     through page reloads (bsc#1052829)

  - CVE-2017-7786 Buffer overflow while painting     non-displayable SVG (bsc#1052829)

  - CVE-2017-7785 Buffer overflow manipulating ARIA     attributes in DOM (bsc#1052829)

  - CVE-2017-7784 Use-after-free with image observers     (bsc#1052829)

  - CVE-2017-7753 Out-of-bounds read with cached style data     and pseudo-elements (bsc#1052829)

  - CVE-2017-7798 XUL injection in the style editor in     devtools (bsc#1052829)

  - CVE-2017-7804 Memory protection bypass through     WindowsDllDetourPatcher (bsc#1052829)

  - CVE-2017-7779 Memory safety bugs fixed in Firefox 55 and     Firefox ESR 52.3 (bsc#1052829)

  - CVE-2017-7800 Use-after-free in WebSockets during     disconnection (bsc#1052829)

  - CVE-2017-7801 Use-after-free with marquee during window     resizing (bsc#1052829)

  - CVE-2017-7802 Use-after-free resizing image elements     (bsc#1052829)

  - CVE-2017-7803 CSP containing 'sandbox' improperly     applied (bsc#1052829)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox. (CVE-2017-7779, CVE-2017-7798,     CVE-2017-7800, CVE-2017-7801, CVE-2017-7753,     CVE-2017-7784, CVE-2017-7785, CVE-2017-7786,     CVE-2017-7787, CVE-2017-7792, CVE-2017-7802,     CVE-2017-7807, CVE-2017-7809, CVE-2017-7791,     CVE-2017-7803)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox was updated to the ESR 52.3 release (bsc#1052829) Following security issues were fixed :

  - MFSA 2017-19/CVE-2017-7807: Domain hijacking through     AppCache fallback

  - MFSA 2017-19/CVE-2017-7791: Spoofing following page     navigation with data: protocol and modal alerts

  - MFSA 2017-19/CVE-2017-7792: Buffer overflow viewing     certificates with an extremely long OID

  - MFSA 2017-19/CVE-2017-7782: WindowsDllDetourPatcher     allocates memory without DEP protections

  - MFSA 2017-19/CVE-2017-7787: Same-origin policy bypass     with iframes through page reloads

  - MFSA 2017-19/CVE-2017-7786: Buffer overflow while     painting non-displayable SVG

  - MFSA 2017-19/CVE-2017-7785: Buffer overflow manipulating     ARIA attributes in DOM

  - MFSA 2017-19/CVE-2017-7784: Use-after-free with image     observers

  - MFSA 2017-19/CVE-2017-7753: Out-of-bounds read with     cached style data and pseudo-elements

  - MFSA 2017-19/CVE-2017-7798: XUL injection in the style     editor in devtools

  - MFSA 2017-19/CVE-2017-7804: Memory protection bypass     through WindowsDllDetourPatcher

  - MFSA 2017-19/CVE-2017-7779: Memory safety bugs fixed in     Firefox 55 and Firefox ESR 52.3

  - MFSA 2017-19/CVE-2017-7800: Use-after-free in WebSockets     during disconnection

  - MFSA 2017-19/CVE-2017-7801: Use-after-free with marquee     during window resizing

  - MFSA 2017-19/CVE-2017-7802: Use-after-free resizing     image elements

  - MFSA 2017-19/CVE-2017-7803: CSP containing 'sandbox'     improperly applied This update also fixes :

  - fixed firefox hangs after a while in FUTEX_WAIT_PRIVATE     if cgroups enabled and running on cpu >=1 (bsc#1031485)

  - The Itanium ia64 build was fixed.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update upgrades Firefox to version 52.3.0 ESR.

Security Fix(es) :

  - Multiple flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Firefox to crash or, potentially, execute     arbitrary code with the privileges of the user running     Firefox. (CVE-2017-7779, CVE-2017-7798, CVE-2017-7800,     CVE-2017-7801, CVE-2017-7753, CVE-2017-7784,     CVE-2017-7785, CVE-2017-7786, CVE-2017-7787,     CVE-2017-7792, CVE-2017-7802, CVE-2017-7807,     CVE-2017-7809, CVE-2017-7791, CVE-2017-7803)

Versions of Mozilla Firefox ESR earlier than 52.3 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'Accessible::RemoveChild()' function in 'accessible/generic/Accessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsMIMEHeaderParamImpl::DecodeRFC5987Param()' function in 'netwerk/mime/nsMIMEHeaderParamImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsWindow::SetParent()' function in 'widget/windows/nsWindow.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_mac.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to missing thread safety that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NotifyTrackRemoved()' function in 'dom/media/MediaRecorder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'InitGlobalLexicalOperation()' function in 'js/src/vm/Interpreter-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::FinishCompilation()' function in 'js/src/vm/TypeInference.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TypedArrayObjectTemplate::makeTemplateObject()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsFTPDirListingConv::DigestBufferLines()' function in 'netwerk/streamconv/converters/nsFTPDirListingConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'TraceSelf()' function in 'dom/bindings/TypedArray.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebSocket::Send()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ExpressionDecompiler::decompilePC()' function in 'js/src/jsopcode.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::addOsrValueTypeBarrier()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the Developer Tools feature that is triggered as web page source code is not properly validated. This may allow a context-dependent attacker to inject and execute arbitrary XUL code.
 - A use-after-free error exists in the 'WebSocketImpl::Disconnect()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when re-computing the layout for marquee elements during window resizing. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when deleting attached editor DOM nodes. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsImageLoadingContent::Notify()' function in 'dom/base/nsImageLoadingContent.cpp' that is triggered when reading image observers during frame reconstruction. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when resizing image elements. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when manipulation Accessible Rich Internet Applications (ARIA) attributes. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when painting non-displayable SVG elements. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling cached style data and pseudo-elements. This may allow a context-dependent attacker to potentially disclose sensitive memory contents.
 - A flaw exists in the 'nsDocShell::OnNewURI()' function in 'docshell/base/nsDocShell.cpp' that is triggered when handling pages with embedded iframes during page reloads. With a specially crafted web page, a context-dependent attacker can bypass the same-origin policy.
 - A flaw exists in the AppCache feature related to handling of websites under a subdirectory adding fallback pages. With a specially crafted website, a context-dependent attacker can hijack a domain.
 - A flaw exists in the 'openTabPrompt()' and 'openRemotePrompt()' functions in 'toolkit/components/prompts/src/nsPrompter.js' that is triggered when handling page navigations with data: protocols and modal alerts. This may allow a context-dependent attacker to conduct spoofing attacks.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as WindowsDllDetourPatcher may allocate memory with RWX permissions. This may allow a context-dependent attacker to bypass intended DEP protection and more easily exploit another vulnerability that allows code execution.
 - A sandbox directive. This may result in other directives being ignored and incorrect enforcement of the content security policy (CSP).
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as the WindowsDllDetourPatcher class destructor may be re-purposed by malicious code. This may allow a context-dependent attacker to bypass memory protections.
 - An overflow condition exists in 'security/manager/ssl/nsNSSCertHelper.cpp' that is triggered when viewing certificates with overly long OIDs. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.

Versions of Mozilla Firefox prior to 55 are unpatched for the following vulnerabilities :

 - A flaw exists that is triggered as the HTTP Strict-Transport-Security (HSTS) header is ignored when processing a response containing multiple HSTS headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) to bypass HSTS protection and downgrade the HTTP communication.
 - A flaw exists in the 'Key::EncodeAsString()' function in 'dom/indexedDB/Key.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'SelectionManager::SetControlSelectionListener()' and 'SelectionManager::ClearControlSelectionListener()' functions in 'accessible/base/SelectionManager.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'DocAccessible::MoveChild()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'xpcom/threads/MozPromise.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling edit transactions. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists related to the Android UI thread. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CanonicalizeLanguageTag()' function in 'js/src/builtin/Intl.js' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling freezing of dense elements. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Module::instantiate()' function in 'js/src/wasm/WasmModule.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Accessible::RemoveChild()' function in 'accessible/generic/Accessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::build()' and 'IonBuilder::buildInline()' functions in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsContentUtils::ConvertStringFromEncoding()' function in 'dom/base/nsContentUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::JitActivation::getRematerializedFrame()' function in 'js/src/vm/Stack.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsMIMEHeaderParamImpl::DecodeRFC5987Param()' function in 'netwerk/mime/nsMIMEHeaderParamImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsWindow::SetParent()' function in 'widget/windows/nsWindow.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_mac.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to missing thread safety that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NotifyTrackRemoved()' function in 'dom/media/MediaRecorder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'InitGlobalLexicalOperation()' function in 'js/src/vm/Interpreter-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::FinishCompilation()' function in 'js/src/vm/TypeInference.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TypedArrayObjectTemplate::makeTemplateObject()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsFTPDirListingConv::DigestBufferLines()' function in 'netwerk/streamconv/converters/nsFTPDirListingConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TraceSelf()' function in 'dom/bindings/TypedArray.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebSocket::Send()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ExpressionDecompiler::decompilePC()' function in 'js/src/jsopcode.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::addOsrValueTypeBarrier()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists related to response header name interning not having same-origin protections. This may allow a context-dependent attacker to disclose stored header names.
 - A flaw exists in the Developer Tools feature that is triggered as web page source code is not properly validated. This may allow a context-dependent attacker to inject and execute arbitrary XUL code.
 - A use-after-free error exists in the 'WebSocketImpl::Disconnect()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when re-computing the layout for marquee elements during window resizing. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when deleting attached editor DOM nodes. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsImageLoadingContent::Notify()' function in 'dom/base/nsImageLoadingContent.cpp' that is triggered when reading image observers during frame reconstruction. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when resizing image elements. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when manipulation Accessible Rich Internet Applications (ARIA) attributes. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when painting non-displayable SVG elements. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling the layer manager while rendering SVG content. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling cached style data and pseudo-elements. This may allow a context-dependent attacker to potentially disclose sensitive memory contents.
 - A flaw exists in the 'nsDocShell::OnNewURI()' function in 'docshell/base/nsDocShell.cpp' that is triggered when handling pages with embedded iframes during page reloads. With a specially crafted web page, a context-dependent attacker can bypass the same-origin policy.
 - A flaw exists in the AppCache feature related to handling of websites under a subdirectory adding fallback pages. With a specially crafted website, a context-dependent attacker can hijack a domain.
 - A flaw exists in the 'openTabPrompt()' and 'openRemotePrompt()' functions in 'toolkit/components/prompts/src/nsPrompter.js' that is triggered when handling page navigations with data: protocols and modal alerts. This may allow a context-dependent attacker to conduct spoofing attacks.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as WindowsDllDetourPatcher may allocate memory with RWX permissions. This may allow a context-dependent attacker to bypass intended DEP protection and more easily exploit another vulnerability that allows code execution.
 - A flaw exists in the 'AllowOpen()' function in 'security/sandbox/linux/broker/SandboxBroker.cpp'. This may allow a context-dependent attacker to bypass the sandbox restrictions and truncate files on the system.
 - A flaw exists in the elliptic curve point addition algorithm that is triggered when using mixed Jacobian-affine coordinates. This may allow an attacker with the ability to intercept network traffic '(e.g'. MitM, DNS cache poisoning) to interfere with a connection and cause the calculation of an incorrect shared secret.
 - A flaw exists that is triggered when handling frame-ancestors directives containing origins with paths. This may allow a context-dependent attacker to bypass the content security policy (CSP).
 - A sandbox directive. This may result in other directives being ignored and incorrect enforcement of the content security policy (CSP).
 - A flaw exists in the 'ExecuteServiceCommand()' function in 'toolkit/components/maintenanceservice/workmonitor.cpp' that is triggered when handling patch directory paths. Combined with another local vulnerability this may allow an attacker to have the Windows updater delete any file named 'update.log'.
 - A flaw exists in 'toolkit/content/aboutwebrtc/aboutWebrtc.js' that is triggered as certain input to about:webrtc is not properly validated. This may allow an attacker to create a specially crafted request that executes arbitrary script code in a user's browser session within the trust relationship between their browser and the server or inject XUL code.
 - A flaw exists in the 'nsHttpChannelAuthProvider::ConfirmAuth()' function in 'netwerk/protocol/http/nsHttpChannelAuthProvider.cpp' that is triggered when handling long usernames in URLs. This may allow a context-dependent attacker to cause a denial of service.
 - A flaw exists in 'toolkit/crashreporter/client/crashreporter_win.cpp' that is triggered as the Windows crash reporter may read extra memory for certain non-null-terminated registry values. This may allow an attacker to disclose potentially sensitive memory contents.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as the WindowsDllDetourPatcher class destructor may be re-purposed by malicious code. This may allow a context-dependent attacker to bypass memory protections.
 - A flaw exists that is triggered as sandboxed about:srcdoc iframes do not inherit content security policy (CSP) directives. This may allow a context-dependent attacker to bypass the content security policy (CSP).
 - An overflow condition exists in 'security/manager/ssl/nsNSSCertHelper.cpp' that is triggered when viewing certificates with overly long OIDs. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.

This update for MozillaThunderbird to version 52.3 fixes security issues and bugs. The following vulnerabilities were fixed :

  - CVE-2017-7798: XUL injection in the style editor in     devtools

  - CVE-2017-7800: Use-after-free in WebSockets during     disconnection

  - CVE-2017-7801: Use-after-free with marquee during window     resizing

  - CVE-2017-7784: Use-after-free with image observers

  - CVE-2017-7802: Use-after-free resizing image elements

  - CVE-2017-7785: Buffer overflow manipulating ARIA     attributes in DOM

  - CVE-2017-7786: Buffer overflow while painting     non-displayable SVG

  - CVE-2017-7753: Out-of-bounds read with cached style data     and pseudo-elements#

  - CVE-2017-7787: Same-origin policy bypass with iframes     through page reloads

  - CVE-2017-7807: Domain hijacking through AppCache     fallback

  - CVE-2017-7792: Buffer overflow viewing certificates with     an extremely long OID

  - CVE-2017-7804: Memory protection bypass through     WindowsDllDetourPatcher

  - CVE-2017-7791: Spoofing following page navigation with     data: protocol and modal alerts

  - CVE-2017-7782: WindowsDllDetourPatcher allocates memory     without DEP protections

  - CVE-2017-7803: CSP containing 'sandbox' improperly     applied

  - CVE-2017-7779: Memory safety bugs fixed in Firefox 55     and Firefox ESR 52.3

The following bugs were fixed :

  - Unwanted inline images shown in rogue SPAM messages

  - Deleting message from the POP3 server not working when     maildir storage was used

  - Message disposition flag (replied / forwarded) lost when     reply or forwarded message was stored as draft and draft     was sent later

  - Inline images not scaled to fit when printing

  - Selected text from another message sometimes included in     a reply

  - No authorisation prompt displayed when inserting image     into email body although image URL requires     authentication

  - Large attachments taking a long time to open under some     circumstances

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3391-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to conduct cross-site scripting (XSS)     attacks, bypass sandbox restrictions, obtain sensitive information, spoof the origin of modal alerts,     bypass same origin restrictions, read uninitialized memory, cause a denial of service via program crash or     hang, or execute arbitrary code. (CVE-2017-7753, CVE-2017-7779, CVE-2017-7780, CVE-2017-7781,     CVE-2017-7783, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7788, CVE-2017-7789,     CVE-2017-7791, CVE-2017-7792, CVE-2017-7794, CVE-2017-7797, CVE-2017-7798, CVE-2017-7799, CVE-2017-7800,     CVE-2017-7801, CVE-2017-7802, CVE-2017-7803, CVE-2017-7806, CVE-2017-7807, CVE-2017-7808, CVE-2017-7809)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for firefox is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 52.3.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7779, CVE-2017-7798, CVE-2017-7800, CVE-2017-7801, CVE-2017-7753, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7792, CVE-2017-7802, CVE-2017-7807, CVE-2017-7809, CVE-2017-7791, CVE-2017-7803)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Mozilla developers and community, Frederik Braun, Looben Yang, Nils, SkyLined, Oliver Wagner, Fraser Tweedale, Mathias Karlsson, Jose Maria Acuna, and Rhys Enniks as the original reporters.

The remote Oracle Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-2456 advisory.

    [52.3.0-3.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one
    - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484]

    [52.3.0-3]
    - Fix for rhbz#1470294 - bundling newer libffi for ppc* platforms

    [52.3.0-2]
    - Update to 52.3.0 ESR (b2)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to Mozilla Firefox 52.3esr fixes a number of security issues.

The following vulnerabilities were advised upstream under MFSA 2017-19 (boo#1052829) :

  - CVE-2017-7798: XUL injection in the style editor in     devtools

  - CVE-2017-7800: Use-after-free in WebSockets during     disconnection

  - CVE-2017-7801: Use-after-free with marquee during window     resizing

  - CVE-2017-7784: Use-after-free with image observers

  - CVE-2017-7802: Use-after-free resizing image elements

  - CVE-2017-7785: Buffer overflow manipulating ARIA     attributes in DOM

  - CVE-2017-7786: Buffer overflow while painting     non-displayable SVG

  - CVE-2017-7753: Out-of-bounds read with cached style data     and pseudo-elements#

  - CVE-2017-7787: Same-origin policy bypass with iframes     through page reloads

  - CVE-2017-7807: Domain hijacking through AppCache     fallback

  - CVE-2017-7792: Buffer overflow viewing certificates with     an extremely long OID

  - CVE-2017-7804: Memory protection bypass through     WindowsDllDetourPatcher

  - CVE-2017-7791: Spoofing following page navigation with     data: protocol and modal alerts

  - CVE-2017-7782: WindowsDllDetourPatcher allocates memory     without DEP protections

  - CVE-2017-7803: CSP containing 'sandbox' improperly     applied

  - CVE-2017-7779: Memory safety bugs fixed in Firefox 55     and Firefox ESR 52.3

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, bypass of the same-origin policy or incorrect enforcement of CSP.

For Debian 7 'Wheezy', these problems have been fixed in version 52.3.0esr-1~deb7u1.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:2456 advisory.

    Mozilla Firefox is an open source web browser.

    This update upgrades Firefox to version 52.3.0 ESR.

    Security Fix(es):

    * Multiple flaws were found in the processing of malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the     user running Firefox. (CVE-2017-7779, CVE-2017-7798, CVE-2017-7800, CVE-2017-7801, CVE-2017-7753,     CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7792, CVE-2017-7802, CVE-2017-7807,     CVE-2017-7809, CVE-2017-7791, CVE-2017-7803)

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Mozilla     developers and community, Frederik Braun, Looben Yang, Nils, SkyLined, Oliver Wagner, Fraser Tweedale,     Mathias Karlsson, Jose Mara Acua, and Rhys Enniks as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, bypass of the same-origin policy or incorrect enforcement of CSP.

The version of Mozilla Firefox installed on the remote Windows host is prior to 55. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 52.3. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 55. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable application crashes.

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.3. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

Mozilla Foundation reports :

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
127356	NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0116)	Nessus	NewStart CGSL Local Security Checks	critical
106884	GLSA-201802-03 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
103563	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2017:2589-1)	Nessus	SuSE Local Security Checks	critical
103056	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1198)	Nessus	Huawei Local Security Checks	critical
103055	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1197)	Nessus	Huawei Local Security Checks	critical
102856	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2017:2302-1)	Nessus	SuSE Local Security Checks	critical
102667	Scientific Linux Security Update : firefox on SL6.x, SL7.x i386/x86_64 (20170815)	Nessus	Scientific Linux Local Security Checks	critical
700183	Mozilla Firefox ESR < 52.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
700182	Mozilla Firefox < 55 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
102622	openSUSE Security Update : MozillaThunderbird (openSUSE-2017-955)	Nessus	SuSE Local Security Checks	critical
102523	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3391-1)	Nessus	Ubuntu Local Security Checks	critical
102504	CentOS 6 / 7 : firefox (CESA-2017:2456)	Nessus	CentOS Local Security Checks	critical
102473	Oracle Linux 6 / 7 : firefox (ELSA-2017-2456)	Nessus	Oracle Linux Local Security Checks	critical
102472	openSUSE Security Update : MozillaFirefox (openSUSE-2017-921)	Nessus	SuSE Local Security Checks	critical
102438	Debian DLA-1053-1 : firefox-esr security update	Nessus	Debian Local Security Checks	critical
102410	RHEL 6 / 7 : firefox (RHSA-2017:2456)	Nessus	Red Hat Local Security Checks	critical
102369	Debian DSA-3928-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
102359	Mozilla Firefox < 55 Multiple Vulnerabilities	Nessus	Windows	critical
102358	Mozilla Firefox ESR < 52.3 Multiple Vulnerabilities	Nessus	Windows	critical
102357	Mozilla Firefox < 55 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
102356	Mozilla Firefox ESR < 52.3 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
102278	FreeBSD : mozilla -- multiple vulnerabilities (555b244e-6b20-4546-851f-d8eb7d6c1ffa)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-7798

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical