現已提供適用於 Red Hat Enterprise Linux 6 與 Red Hat Enterprise Linux 7 的 firefox 更新。Red Hat 產品安全性團隊已將此更新評等為具有重大安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。Mozilla Firefox 是開放原始碼的網頁瀏覽器。此更新將 Firefox 升級至 52.3.0 ESR 版。安全性修正：* 在處理格式錯誤的 Web 內容過程中發現多個缺陷。包含惡意內容的網頁可造成 Firefox 損毀，或可能利用執行 Firefox 之使用者的權限來執行任意程式碼。(CVE-2017-7779、CVE-2017-7798、CVE-2017-7800、CVE-2017-7801、CVE-2017-7753、CVE-2017-7784、CVE-2017-7785、CVE-2017-7786、CVE-2017-7787、CVE-2017-7792、CVE-2017-7802、CVE-2017-7807、CVE-2017-7809、CVE-2017-7791、CVE-2017-7803) Red Hat 感謝 Mozilla 專案報告這些問題。上游確認 Mozilla 開發人員和社群、Frederik Braun、Looben Yang、Nils、SkyLined、Oliver Wagner、Fraser Tweedale、Mathias Karlsson、Jose Maria Acuna 和 Rhys Enniks 為原始報告者。

在 Firefox 中發現多個安全性問題。如果使用者遭誘騙而開啟特製網站，攻擊者可能會利用這些弱點發動跨網站指令碼 (XSS) 攻擊、繞過沙箱限制、取得敏感資訊、偽造模型警示的來源、繞過相同來源的限制、讀取未初始化的記憶體、透過應用程式損毀或懸置造成拒絕服務或是執行任意程式碼。(CVE-2017-7753、CVE-2017-7779、CVE-2017-7780、CVE-2017-7781、CVE-2017-7783、CVE-2017-7784、CVE-2017-7785、CVE-2017-7786、CVE-2017-7787、CVE-2017-7788、CVE-2017-7789、CVE-2017-7791、CVE-2017-7792、CVE-2017-7794、CVE-2017-7797、CVE-2017-7798、CVE-2017-7799、CVE-2017-7800、CVE-2017-7801、CVE-2017-7802、CVE-2017-7803、CVE-2017-7806、CVE-2017-7807、CVE-2017-7808、CVE-2017-7809)

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

USN-3391-1 已修復 Firefox 中的弱點。此更新提供 Ubufox 的對應更新。

在 Firefox 中發現多個安全性問題。如果使用者遭誘騙而開啟特製網站，攻擊者可能會利用這些弱點發動跨網站指令碼 (XSS) 攻擊、繞過沙箱限制、取得敏感資訊、偽造模型警示的來源、繞過相同來源的限制、讀取未初始化的記憶體、透過應用程式損毀或懸置造成拒絕服務或是執行任意程式碼。(CVE-2017-7753、CVE-2017-7779、CVE-2017-7780、CVE-2017-7781、CVE-2017-7783、CVE-2017-7784、CVE-2017-7785、CVE-2017-7786、CVE-2017-7787、CVE-2017-7788、CVE-2017-7789、CVE-2017-7791、CVE-2017-7792、CVE-2017-7794、CVE-2017-7797、CVE-2017-7798、CVE-2017-7799、CVE-2017-7800、CVE-2017-7801、CVE-2017-7802、CVE-2017-7803、CVE-2017-7806、CVE-2017-7807、CVE-2017-7808、CVE-2017-7809)

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

執行 MAIN 4.05 版的遠端 NewStart CGSL 主機安裝了受多個弱點影響的 firefox 套件：- 即使有釣魚和惡意軟體保護功能及其可疑網站和檔案封鎖清單，以 blob: 和 data: URL 元素編碼的檔案下載仍然繞過了正常的檔案下載檢查。這會讓惡意網站誘騙使用者下載原本會偵測出疑點的可執行檔。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7814) - 在設計模式下，若調整影像物件的大小，而這些影像物件是參照已被釋放的記憶體，則會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7819) - 內容安全性原則 (CSP) 沙箱指示詞未建立文件專用的原點，以致於它造成看似一律指定 allow-same-origin 關鍵字的行為。這樣會讓攻擊者得以利用不安全的內容發動跨網站指令碼 (XSS) 攻擊。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7823) - 若在樹狀遊走仍然繫結文件時過早刪除編輯器的 DOM 節點，會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7809) - 已通報 Firefox 54、Firefox ESR 52.2 和 Thunderbird 52.2 中存在的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7779) - 使用經過快取的樣式資料將樣式規則套用於虛擬元素 (如 ::first-line) 時，會出現越界讀取情形。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7753) - 在 DOM 內操控 Accessible Rich Internet Applications (ARIA) 屬性時會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7785) - 當影像轉譯器嘗試描繪無法顯示的 SVG 元素時，會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7786) - 重新載入頁面時，可能利用內嵌 iframe 在頁面上繞過同源原則保護機制，讓 iframe 得以存取頂層頁面的內容，造成資訊洩漏。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7787) - 若憑證的物件識別元 (OID) 長度極長，則在憑證管理員中檢視憑證時，會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7792) - 在含 iframe 的頁面上，使用 data: protocol 可建立強制回應警示，該警示會在頁面瀏覽之後轉譯為任意網域，偽造 iframe 內容的強制回應警示來源。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7791) - 若保留連線的物件在中斷連線作業完成之前被釋放，WebSockets 可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7800) - 由於網頁原始碼的不當清理，「開發人員工具」功能容易受 XUL 插入弱點的影響。在最嚴重的情況下，可能會在使用樣式編輯器工具開啟惡意頁面時允許任意程式碼執行。此弱點會影響 Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7798) - 操控 DOM 時若調整影像元素的大小，可能會產生釋放後使用弱點。若這些元素因缺乏強參照而已被釋放，當存取被釋放的元素時會發生可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7802) - 若因調整視窗大小而重新計算跑馬燈元素的版面配置時，更新過後的樣式物件在仍然使用中的狀態下被釋放，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7801) - 一種在網域中使用 AppCache 劫持 URL 的機制，該網域從網域的子路徑提供檔案作為 fallback。已藉由要求 fallback 檔案需在 manifest 目錄中，使此弱點得到解決。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7807) - 若頁面的內容安全性原則 (CSP) 標頭內含沙箱指示詞，則會略過其他指示詞。這樣會錯誤地強制執行 CSP。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7803) - 重建框架時，若在 observer 被釋放之後才讀取影像 observer，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7784) - 透過 DOM 在容器內操控 Accessible Rich Internet Applications (ARIA) 元素的陣列時，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7818) - 以用於 WebGL 內容的 ANGLE 圖形程式庫繪製及驗證元素時，會發生緩衝區溢位情形。這是因為在檢查時將錯誤的值傳送到程式庫內，會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7824) - 已通報 Firefox 55 和 Firefox ESR 52.3 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7810) - 背景工作或相關聯視窗在仍然使用中被釋放時，Fetch API 會產生釋放後使用弱點，造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7793) - 在 Firefox 中發現一個隱私缺陷。在「私密瀏覽」模式中，Web 背景工作可將持續資料寫入 IndexedDB，而結束時資料卻未清理，因此可能保留在多個工作階段中。惡意網站可利用缺陷來繞過隱私瀏覽保護以及唯一指紋訪客。(CVE-2017-7843) - 由於 PressShell 物件在仍然使用中遭到釋放，因此可能在清空和調整版面配置大小時發生釋放後使用弱點。這樣會在上述作業期間造成可能遭惡意利用的當機。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7828) - 已通報 Firefox 56 和 Firefox ESR 52.4 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7826) - Resource Timing API 錯誤地洩漏跨來源 iframe 的導覽。這是同源原則違規，可能導致使用者載入的 URL 資料遭竊。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7830) 請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

執行 MAIN 4.05 版的遠端 NewStart CGSL 主機安裝了受多個弱點影響的 thunderbird 套件：- 即使有釣魚和惡意軟體保護功能及其可疑網站和檔案封鎖清單，以 blob: 和 data: URL 元素編碼的檔案下載仍然繞過了正常的檔案下載檢查。這會讓惡意網站誘騙使用者下載原本會偵測出疑點的可執行檔。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7814) - 在設計模式下，若調整影像物件的大小，而這些影像物件是參照已被釋放的記憶體，則會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7819) - 內容安全性原則 (CSP) 沙箱指示詞未建立文件專用的原點，以致於它造成看似一律指定 allow-same-origin 關鍵字的行為。這樣會讓攻擊者得以利用不安全的內容發動跨網站指令碼 (XSS) 攻擊。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7823) - 若在樹狀遊走仍然繫結文件時過早刪除編輯器的 DOM 節點，會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7809) - 已通報 Firefox 54、Firefox ESR 52.2 和 Thunderbird 52.2 中存在的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7779) - 使用經過快取的樣式資料將樣式規則套用於虛擬元素 (如 ::first-line) 時，會出現越界讀取情形。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7753) - 在 DOM 內操控 Accessible Rich Internet Applications (ARIA) 屬性時會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7785) - 當影像轉譯器嘗試描繪無法顯示的 SVG 元素時，會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7786) - 重新載入頁面時，可能利用內嵌 iframe 在頁面上繞過同源原則保護機制，讓 iframe 得以存取頂層頁面的內容，造成資訊洩漏。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7787) - 若憑證的物件識別元 (OID) 長度極長，則在憑證管理員中檢視憑證時，會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7792) - 在含 iframe 的頁面上，使用 data: protocol 可建立強制回應警示，該警示會在頁面瀏覽之後轉譯為任意網域，偽造 iframe 內容的強制回應警示來源。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7791) - 若保留連線的物件在中斷連線作業完成之前被釋放，WebSockets 可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7800) - 操控 DOM 時若調整影像元素的大小，可能會產生釋放後使用弱點。若這些元素因缺乏強參照而已被釋放，當存取被釋放的元素時會發生可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7802) - 若因調整視窗大小而重新計算跑馬燈元素的版面配置時，更新過後的樣式物件在仍然使用中的狀態下被釋放，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7801) - 一種在網域中使用 AppCache 劫持 URL 的機制，該網域從網域的子路徑提供檔案作為 fallback。已藉由要求 fallback 檔案需在 manifest 目錄中，使此弱點得到解決。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7807) - 若頁面的內容安全性原則 (CSP) 標頭內含沙箱指示詞，則會略過其他指示詞。這樣會錯誤地強制執行 CSP。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7803) - 重建框架時，若在 observer 被釋放之後才讀取影像 observer，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7784) - 透過 DOM 在容器內操控 Accessible Rich Internet Applications (ARIA) 元素的陣列時，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7818) - 以用於 WebGL 內容的 ANGLE 圖形程式庫繪製及驗證元素時，會發生緩衝區溢位情形。這是因為在檢查時將錯誤的值傳送到程式庫內，會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7824) - 已通報 Firefox 55 和 Firefox ESR 52.3 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7810) - 背景工作或相關聯視窗在仍然使用中被釋放時，Fetch API 會產生釋放後使用弱點，造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7793) - 由於 PressShell 物件在仍然使用中遭到釋放，因此可能在清空和調整版面配置大小時發生釋放後使用弱點。這樣會在上述作業期間造成可能遭惡意利用的當機。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7828) - 已通報 Firefox 56 和 Firefox ESR 52.4 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7826) - Resource Timing API 錯誤地洩漏跨來源 iframe 的導覽。這是同源原則違規，可能導致使用者載入的 URL 資料遭竊。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7830) 請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端主機受到 GLSA-201803-14 中所述的弱點影響 (Mozilla Thunderbird：多個弱點) 在 Mozilla Thunderbird 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 Mozilla 基礎安全性公告和 CVE 識別碼。影響：遠端攻擊者可能能夠執行任意程式碼、造成拒絕服務情形、取得敏感資訊、進行 URL 劫持或發動跨網站指令碼 (XSS) 攻擊。因應措施：目前尚無已知的因應措施。

Versions of Mozilla Firefox ESR earlier than 52.3 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'Accessible::RemoveChild()' function in 'accessible/generic/Accessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsMIMEHeaderParamImpl::DecodeRFC5987Param()' function in 'netwerk/mime/nsMIMEHeaderParamImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsWindow::SetParent()' function in 'widget/windows/nsWindow.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_mac.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to missing thread safety that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NotifyTrackRemoved()' function in 'dom/media/MediaRecorder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'InitGlobalLexicalOperation()' function in 'js/src/vm/Interpreter-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::FinishCompilation()' function in 'js/src/vm/TypeInference.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TypedArrayObjectTemplate::makeTemplateObject()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsFTPDirListingConv::DigestBufferLines()' function in 'netwerk/streamconv/converters/nsFTPDirListingConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'TraceSelf()' function in 'dom/bindings/TypedArray.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebSocket::Send()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ExpressionDecompiler::decompilePC()' function in 'js/src/jsopcode.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::addOsrValueTypeBarrier()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the Developer Tools feature that is triggered as web page source code is not properly validated. This may allow a context-dependent attacker to inject and execute arbitrary XUL code.
 - A use-after-free error exists in the 'WebSocketImpl::Disconnect()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when re-computing the layout for marquee elements during window resizing. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when deleting attached editor DOM nodes. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsImageLoadingContent::Notify()' function in 'dom/base/nsImageLoadingContent.cpp' that is triggered when reading image observers during frame reconstruction. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when resizing image elements. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when manipulation Accessible Rich Internet Applications (ARIA) attributes. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when painting non-displayable SVG elements. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling cached style data and pseudo-elements. This may allow a context-dependent attacker to potentially disclose sensitive memory contents.
 - A flaw exists in the 'nsDocShell::OnNewURI()' function in 'docshell/base/nsDocShell.cpp' that is triggered when handling pages with embedded iframes during page reloads. With a specially crafted web page, a context-dependent attacker can bypass the same-origin policy.
 - A flaw exists in the AppCache feature related to handling of websites under a subdirectory adding fallback pages. With a specially crafted website, a context-dependent attacker can hijack a domain.
 - A flaw exists in the 'openTabPrompt()' and 'openRemotePrompt()' functions in 'toolkit/components/prompts/src/nsPrompter.js' that is triggered when handling page navigations with data: protocols and modal alerts. This may allow a context-dependent attacker to conduct spoofing attacks.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as WindowsDllDetourPatcher may allocate memory with RWX permissions. This may allow a context-dependent attacker to bypass intended DEP protection and more easily exploit another vulnerability that allows code execution.
 - A sandbox directive. This may result in other directives being ignored and incorrect enforcement of the content security policy (CSP).
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as the WindowsDllDetourPatcher class destructor may be re-purposed by malicious code. This may allow a context-dependent attacker to bypass memory protections.
 - An overflow condition exists in 'security/manager/ssl/nsNSSCertHelper.cpp' that is triggered when viewing certificates with overly long OIDs. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.

Versions of Mozilla Firefox prior to 55 are unpatched for the following vulnerabilities :

 - A flaw exists that is triggered as the HTTP Strict-Transport-Security (HSTS) header is ignored when processing a response containing multiple HSTS headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) to bypass HSTS protection and downgrade the HTTP communication.
 - A flaw exists in the 'Key::EncodeAsString()' function in 'dom/indexedDB/Key.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'SelectionManager::SetControlSelectionListener()' and 'SelectionManager::ClearControlSelectionListener()' functions in 'accessible/base/SelectionManager.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'DocAccessible::MoveChild()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'xpcom/threads/MozPromise.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling edit transactions. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists related to the Android UI thread. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CanonicalizeLanguageTag()' function in 'js/src/builtin/Intl.js' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling freezing of dense elements. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Module::instantiate()' function in 'js/src/wasm/WasmModule.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Accessible::RemoveChild()' function in 'accessible/generic/Accessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::build()' and 'IonBuilder::buildInline()' functions in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsContentUtils::ConvertStringFromEncoding()' function in 'dom/base/nsContentUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::JitActivation::getRematerializedFrame()' function in 'js/src/vm/Stack.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsMIMEHeaderParamImpl::DecodeRFC5987Param()' function in 'netwerk/mime/nsMIMEHeaderParamImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsWindow::SetParent()' function in 'widget/windows/nsWindow.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_mac.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to missing thread safety that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NotifyTrackRemoved()' function in 'dom/media/MediaRecorder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'InitGlobalLexicalOperation()' function in 'js/src/vm/Interpreter-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::FinishCompilation()' function in 'js/src/vm/TypeInference.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TypedArrayObjectTemplate::makeTemplateObject()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsFTPDirListingConv::DigestBufferLines()' function in 'netwerk/streamconv/converters/nsFTPDirListingConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TraceSelf()' function in 'dom/bindings/TypedArray.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebSocket::Send()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ExpressionDecompiler::decompilePC()' function in 'js/src/jsopcode.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::addOsrValueTypeBarrier()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists related to response header name interning not having same-origin protections. This may allow a context-dependent attacker to disclose stored header names.
 - A flaw exists in the Developer Tools feature that is triggered as web page source code is not properly validated. This may allow a context-dependent attacker to inject and execute arbitrary XUL code.
 - A use-after-free error exists in the 'WebSocketImpl::Disconnect()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when re-computing the layout for marquee elements during window resizing. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when deleting attached editor DOM nodes. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsImageLoadingContent::Notify()' function in 'dom/base/nsImageLoadingContent.cpp' that is triggered when reading image observers during frame reconstruction. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when resizing image elements. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when manipulation Accessible Rich Internet Applications (ARIA) attributes. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when painting non-displayable SVG elements. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling the layer manager while rendering SVG content. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling cached style data and pseudo-elements. This may allow a context-dependent attacker to potentially disclose sensitive memory contents.
 - A flaw exists in the 'nsDocShell::OnNewURI()' function in 'docshell/base/nsDocShell.cpp' that is triggered when handling pages with embedded iframes during page reloads. With a specially crafted web page, a context-dependent attacker can bypass the same-origin policy.
 - A flaw exists in the AppCache feature related to handling of websites under a subdirectory adding fallback pages. With a specially crafted website, a context-dependent attacker can hijack a domain.
 - A flaw exists in the 'openTabPrompt()' and 'openRemotePrompt()' functions in 'toolkit/components/prompts/src/nsPrompter.js' that is triggered when handling page navigations with data: protocols and modal alerts. This may allow a context-dependent attacker to conduct spoofing attacks.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as WindowsDllDetourPatcher may allocate memory with RWX permissions. This may allow a context-dependent attacker to bypass intended DEP protection and more easily exploit another vulnerability that allows code execution.
 - A flaw exists in the 'AllowOpen()' function in 'security/sandbox/linux/broker/SandboxBroker.cpp'. This may allow a context-dependent attacker to bypass the sandbox restrictions and truncate files on the system.
 - A flaw exists in the elliptic curve point addition algorithm that is triggered when using mixed Jacobian-affine coordinates. This may allow an attacker with the ability to intercept network traffic '(e.g'. MitM, DNS cache poisoning) to interfere with a connection and cause the calculation of an incorrect shared secret.
 - A flaw exists that is triggered when handling frame-ancestors directives containing origins with paths. This may allow a context-dependent attacker to bypass the content security policy (CSP).
 - A sandbox directive. This may result in other directives being ignored and incorrect enforcement of the content security policy (CSP).
 - A flaw exists in the 'ExecuteServiceCommand()' function in 'toolkit/components/maintenanceservice/workmonitor.cpp' that is triggered when handling patch directory paths. Combined with another local vulnerability this may allow an attacker to have the Windows updater delete any file named 'update.log'.
 - A flaw exists in 'toolkit/content/aboutwebrtc/aboutWebrtc.js' that is triggered as certain input to about:webrtc is not properly validated. This may allow an attacker to create a specially crafted request that executes arbitrary script code in a user's browser session within the trust relationship between their browser and the server or inject XUL code.
 - A flaw exists in the 'nsHttpChannelAuthProvider::ConfirmAuth()' function in 'netwerk/protocol/http/nsHttpChannelAuthProvider.cpp' that is triggered when handling long usernames in URLs. This may allow a context-dependent attacker to cause a denial of service.
 - A flaw exists in 'toolkit/crashreporter/client/crashreporter_win.cpp' that is triggered as the Windows crash reporter may read extra memory for certain non-null-terminated registry values. This may allow an attacker to disclose potentially sensitive memory contents.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as the WindowsDllDetourPatcher class destructor may be re-purposed by malicious code. This may allow a context-dependent attacker to bypass memory protections.
 - A flaw exists that is triggered as sandboxed about:srcdoc iframes do not inherit content security policy (CSP) directives. This may allow a context-dependent attacker to bypass the content security policy (CSP).
 - An overflow condition exists in 'security/manager/ssl/nsNSSCertHelper.cpp' that is triggered when viewing certificates with overly long OIDs. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.

ID	Name	Product	Family	Published	Updated	Severity
102504	CentOS 6 / 7：firefox (CESA-2017:2456)	Nessus	CentOS Local Security Checks	8/16/2017	1/4/2021	critical
102523	Ubuntu 14.04 LTS / 16.04 LTS：Firefox 弱點 (USN-3391-1)	Nessus	Ubuntu Local Security Checks	8/16/2017	10/23/2023	critical
102543	Ubuntu 14.04 LTS / 16.04 LTS：Ubufox 更新 (USN-3391-2)	Nessus	Ubuntu Local Security Checks	8/17/2017	10/20/2023	critical
127356	NewStart CGSL MAIN 4.05：firefox 多個弱點 (NS-SA-2019-0116)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	5/7/2024	critical
127363	NewStart CGSL MAIN 4.05：thunderbird 多個弱點 (NS-SA-2019-0119)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	5/7/2024	critical
108820	GLSA-201803-14：Mozilla Thunderbird：多個弱點	Nessus	Gentoo Local Security Checks	4/4/2018	9/28/2020	critical
700183	Mozilla Firefox ESR < 52.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/21/2017	11/6/2019	high
700182	Mozilla Firefox < 55 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/21/2017	3/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

high

high