The version of Firefox installed on the remote Mac OS X host is prior to 44. It is, therefore, affected by the following vulnerabilities :

  - A cookie injection vulnerability exists due to illegal     control characters being stored as cookie values in     violation of RFC6265. A remote attacker can exploit this     to inject cookies. (CVE-2015-7208)

  - Multiple unspecified memory corruption issues exist that     allow a remote attacker to execute arbitrary code.
    (CVE-2016-1930, CVE-2016-1931)

  - An integer overflow condition exists due to improper     parsing of GIF images during deinterlacing. A remote     attacker can exploit this, via a specially crafted GIF     image, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1933)

  - A buffer overflow condition exists in WebGL that is     triggered when handling cache out-of-memory error     conditions. A remote attacker can exploit this to     execute arbitrary code. (CVE-2016-1935)

  - A content spoofing vulnerability exists due to the     protocol handler dialog treating double click events as     two single click events. A remote attacker can exploit     this to spoof content, allowing the attacker to trick a     user into performing malicious actions. (CVE-2016-1937)

  - A cryptographic weakness exists in Network Security     Services (NSS) due to incorrect calculations with     'mp_div' and 'mp_exptmod'. (CVE-2016-1938)

  - A cookie injection vulnerability exists due to illegal     control characters being permitted in cookie names. A     remote attacker can exploit this to inject cookies.
    (CVE-2016-1939)

  - An URL spoofing vulnerability exists due to a flaw that     is triggered during the handling of a URL that invalid     for the internal protocol, causing the URL to be pasted     into the address bar. A remote attacker can exploit this     spoof URLs, allowing the attacker to trick a     user into visiting a malicious website. (CVE-2016-1942)

  - An unspecified memory corruption issue exists in the     ANGLE graphics library implementation. A remote attacker     can exploit this to corrupt memory, resulting in the     execution of arbitrary code. (CVE-2016-1944)

  - A wild pointer flaw exists due to improper handling of     ZIP files. A remote attacker can exploit this, via a     crafted ZIP file, to have an unspecified impact.
    (CVE-2016-1945)

  - An integer overflow condition exists in the bundled     version of libstagefright due to improper handling of     MP4 file metadata. A remote attacker can exploit this     to execute arbitrary code. (CVE-2016-1946)

  - A flaw exists in the safe browsing feature due to the     Application Reputation service being unreachable. A     remote attacker can exploit this to convince a user     into downloading a malicious executable without being     warned. (CVE-2016-1947)

  - A use-after-free error exists in Network Security     Services (NSS) due to improper handling of failed     allocations during DHE and ECDHE handshakes. An attacker     can exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-1978)

The remote host is affected by the vulnerability described in GLSA-201605-06 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, NSS, NSPR, and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms, or have other unspecified       impacts.
  Workaround :

    There is no known workaround at this time.

リモート Mac OS X ホストにインストールされている Firefox のバージョンは、 44 より前のバージョンです。したがって、次の脆弱性の影響を受けます：

- 無効なコントロール文字が RFC6265 違反のクッキー値として保存されていることにより、クッキーインジェクションの脆弱性が存在します。リモートの攻撃者がこれを悪用して、クッキーを注入する可能性があります。（CVE-2015-7208）

- 複数の詳細不明なメモリ破損の問題が存在し、リモートの攻撃者が任意のコードを実行することが可能です。
 （CVE-2016-1930、CVE-2016-1931）

- インターレース解除中の GIF イメージの不適切な解析により、整数オーバーフロー状態が存在します。リモートの攻撃者が、特別に細工された GIF イメージを通じて、これを悪用して、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。（CVE-2016-1933）

- WebGL に、キャッシュメモリ不足のエラー状態を処理するときに引き起こされるバッファオーバーフローの状態が存在します。リモートの攻撃者がこれを悪用し、任意のコードを実行する恐れがあります。（CVE-2016-1935）

- ダブルクリックのイベントを 2 つのワンクリックのイベントとして扱うプロトコルハンドラーダイアログにより、コンテンツスプーフィングの脆弱性が存在します。リモートの攻撃者がこれを悪用してコンテンツを偽装することで、ユーザーを騙して悪意のある動作を実行させる可能性があります。（CVE-2016-1937）

- 「mp_div」および「mp_exptmod」の不適切な計算により、Network Security Services（NSS）に暗号化の脆弱性が存在します。（CVE-2016-1938）

- 無効なコントロール文字がクッキー名で許可されていることにより、クッキーインジェクションの脆弱性が存在します。リモートの攻撃者がこれを悪用して、クッキーを注入する可能性があります。
 （CVE-2016-1939）

- 内部プロトコルに対して無効な URL を処理することで、URL がアドレスバーに渡されることによって発生する欠陥により、URL スプーフィングの脆弱性が存在します。リモートの攻撃者がこれを悪用して URL を偽装することで、ユーザーを騙して悪意のある Web サイトにアクセスさせる可能性があります。（CVE-2016-1942）

- ANGLE グラフィックライブラリの実装に、詳細不明なメモリ破損の問題が存在します。リモートの攻撃者がこれを悪用してメモリを破損させ、任意のコードを実行する可能性があります。（CVE-2016-1944）

- ZIP ファイルの不適切な処理により、ワイルドポインターの欠陥が存在します。リモートの攻撃者がこれを悪用して、細工された ZIP ファイルを通じて詳細不明な影響を与える可能性があります。
 （CVE-2016-1945）

- MP4 ファイルのメタデータの不適当な処理により、libstagefright バンドルバージョンに整数オーバーフロー状態が存在します。リモートの攻撃者がこれを悪用し、任意のコードを実行する恐れがあります。（CVE-2016-1946）

- Application Reputation サービスが到達不能になっていることにより、セーフブラウジング機能に欠陥が存在します。リモートの攻撃者がこれを悪用して、警告を表示することなくユーザーに悪意のある実行可能ファイルをダウンロードさせる可能性があります。（CVE-2016-1947）

- DHE および ECDHE ハンドシェイク中に失敗した割り当ての不適切な処理により、Network Security Services（NSS）に use-after-free エラーが存在します。攻撃者がこれを悪用し、すでに解放されたメモリを逆参照して、任意のコードを実行する可能性があります。
 （CVE-2016-1978）

リモートホストは、GLSA-201605-06 で説明されている脆弱性の影響を受けます（Mozilla 製品：複数の脆弱性）

Firefox、NSS、NSPR、および Thunderbird に、複数の脆弱性が発見されました。詳細については、以下で参照されている CVE 識別子をレビューしてください。
 影響：

リモートの攻撃者が、ユーザーを誘導し、特別に細工された Web ページやメールを表示させることができた場合、任意のコードを実行したり、サービス拒否状態を発生させたりする可能性があります。さらに、リモートの攻撃者が、中間者攻撃を実行する、機密情報を取得する、アドレスバーを偽装する、クリックジャッキング攻撃を実行する、セキュリティ制限および保護メカニズムをバイパスする、または詳細不明なその他の影響を与えることができる場合があります。
 回避策：

現時点で、既知の回避策はありません。

遠端 Mac OS X 主機上安裝的 Firefox 版本比 44 版舊。因此受到以下弱點影響：

- 存在一個 Cookie 插入弱點，這是因為將不合法控制字元儲存為 Cookie 值，違反 RFC6265 所導致。遠端攻擊者可惡意利用此弱點插入 Cookie。(CVE-2015-7208)

- 存在多個會讓遠端攻擊者執行任意程式碼的不明記憶體損毀問題。
 (CVE-2016-1930、CVE-2016-1931)

- 存在一個整數溢位情形，這是因為在去交錯式過程中不當剖析 GIF 影像所導致。遠端攻擊者可加以惡意利用，透過特製的 GIF 影像，造成拒絕服務情形或是執行任意程式碼。(CVE-2016-1933)

- WebGL 中存在一個緩衝區溢位情形，其會在處理快取記憶體不足錯誤情形時觸發。遠端攻擊者可惡意利用這點，執行任意程式碼。(CVE-2016-1935)

- 存在一個內容偽造弱點，這是因為通訊協定處置程式對話方塊，將按兩下事件視為兩次的按一下事件所導致。遠端攻擊者可惡意利用此偽造內容，讓攻擊者能夠誘騙使用者執行惡意動作。(CVE-2016-1937)

- Network Security Services (NSS) 中存在一個密碼編譯弱點，這是因為「mp_div」及「mp_exptmod」的錯誤計算所導致。(CVE-2016-1938)

- 存在一個 Cookie 插入弱點，這是因為在 Cookie 名稱中允許使用不合法控制字元所導致。遠端攻擊者可惡意利用此弱點插入 Cookie。
 (CVE-2016-1939)

- 存在一個 URL 偽造弱點，這是因為一個對內部通訊協定而言無效的 URL，在處理過程中觸發一個瑕疵，造成將 URL 貼到位址列中所導致。遠端攻擊者可惡意利用此偽造 URL，讓攻擊者能夠誘騙使用者造訪惡意網站。(CVE-2016-1942)

- ANGLE 圖庫實作中存在一個不明的記憶體損毀問題。遠端攻擊者可惡意利用此問題損毀記憶體，進而導致任意程式碼執行。(CVE-2016-1944)

- 存在一個環境指標瑕疵，這是因為不當處理 ZIP 檔案所導致。遠端攻擊者可惡意利用此瑕疵，透過特製 ZIP 檔案造成不明影響。
 (CVE-2016-1945)

- 隨附的 libstagefright 版本中存在一個整數溢位情形，這是因為不當處理 MP4 檔案詮釋資料所導致。遠端攻擊者可惡意利用這點，執行任意程式碼。(CVE-2016-1946)

- 安全瀏覽功能中存在一個瑕疵，這是因為無法連線至 Application Reputation 服務所導致。遠端攻擊者可以惡意利用此瑕疵，說服使用者在未受警告的情況下下載惡意執行檔。(CVE-2016-1947)

- Network Security Services (NSS) 中存在一個釋放後使用錯誤，這是因為 DHE 和 ECDHE 交握期間不當處理失敗的配置所導致。攻擊者可加以利用，解除參照已釋放的記憶體，進而導致執行任意程式碼。
 (CVE-2016-1978)

远程 Mac OS X 主机上安装的 Firefox 版本低于 44。因此，它受到以下漏洞的影响：

- 存在一个 Cookie 注入漏洞，这是因为将非法控制字符储存为 Cookie 值，违反 RFC6265 所导致。远程攻击者可利用此漏洞注入 Cookie。(CVE-2015-7208)

- 存在多种不明内存损坏问题，远程攻击者可利用这些问题执行任意代码。
 （CVE-2016-1930、CVE-2016-1931）

- 存在一个整数溢出情况，这是因为在去交隔行过程中不当解析 GIF 图像所导致。远程攻击者可利用此问题，通过特别构建的 GIF 图像，造成拒绝服务情况或执行任意代码。(CVE-2016-1933)

- WebGL 中存在一个缓冲区溢出情况，其会在处理缓存不足错误情况时触发。远程攻击者可利用此缺陷执行任意代码。(CVE-2016-1935)

- 存在一个内容伪造漏洞，这是因为协议处理程序对话框将双击事件作为两次单击事件处理所导致。远程攻击者可利用此欺骗内容，诱骗用户执行恶意操作。(CVE-2016-1937)

- Network Security Services (NSS) 中存在一个加密漏洞，这是因为“mp_div' and 'mp_exptmod”的错误计算所导致。(CVE-2016-1938)

- 存在一个 Cookie 注入漏洞，这是因为在 Cookie 名称中允许使用非法控制字符所导致。远程攻击者可利用此漏洞注入 Cookie。
 (CVE-2016-1939)

- 存在一个 URL 欺骗漏洞，这是因为处理一个对内部协议无效的 URL 过程中触发一个缺陷，造成将 URL 粘贴到地址栏中所导致。远程攻击者可利用此欺骗 URL，诱骗用户访问恶意网站。(CVE-2016-1942)

- ANGLE 图库实现中存在一个不明的内存损坏问题。远程攻击者可利用此问题损坏内存，导致执行任意代码。(CVE-2016-1944)

- 存在一个失控指针缺陷，这是因为不当处理 ZIP 文件所导致。远程攻击者可利用此缺陷，通过特别构建的 ZIP 文件造成不明影响。
 (CVE-2016-1945)

- 绑定的 libstagefright 版本中存在一个整数溢出情况，这是因为不当处理 MP4 文件元数据所导致。远程攻击者可利用此缺陷执行任意代码。(CVE-2016-1946)

- 安全浏览功能中存在一个缺陷，这是因为无法连接 Application Reputation 服务所导致。远程攻击者可以利用此缺陷，说服用户下载恶意可执行文件，而不会发出警告。(CVE-2016-1947)

- Network Security Services (NSS) 中存在一个释放后使用错误，这是因为 DHE 和 ECDHE 握手过程中不当处理失败的分配所导致。攻击者可利用此问题取消引用已经释放的内存，从而导致执行任意代码。
 (CVE-2016-1978)

遠端主機受到 GLSA-201605-06 中所述的弱點影響 (Mozilla 產品：多個弱點)

在 Firefox、NSS、NSPR 和 Thunderbird 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者還可能發動攔截式攻擊、取得敏感資訊、偽造位址列、發動點擊劫持攻擊、繞過安全性限制和保護機制，或造成其他不明影響。
 因應措施：

目前尚無已知的因應措施。

远程主机受到 GLSA-201605-06 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Firefox、NSS、NSPR 和 Thunderbird 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、欺骗地址栏、执行点击劫持攻击、绕过安全限制和保护机制，或造成其他不明影响。
 变通方案：

目前无任何已知的变通方案。

The version of Firefox is prior to 44.0 and is affected by multiple vulnerabilities : 

 - Multiple unspecified memory corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-1930, CVE-2016-1931)
 - An integer overflow condition exists due to improper parsing of GIF images during deinterlacing. A remote attacker can exploit this, via a specially crafted GIF image, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1933)
 - A buffer overflow condition exists in WebGL that is triggered when handling cache out-of-memory error conditions. A remote attacker can exploit this to execute arbitrary code. (CVE-2016-1935)
 - A content spoofing vulnerability exists due to the protocol handler dialog treating double click events as two single click events. A remote attacker can exploit this to spoof content, allowing the attacker to trick a user into performing malicious actions. (CVE-2016-1937)
 - A cryptographic weakness exists in Network Security Services (NSS) due to incorrect calculations with 'mp_div' and 'mp_exptmod'. (CVE-2016-1938)
 - A cookie injection vulnerability exists due to illegal control characters being permitted in cookie names. A remote attacker can exploit this to inject cookies. (CVE-2016-1939)
 - A flaw exists that is triggered as the delay between the download dialog getting focus and the button getting enabled is too short. If a context-dependent attacker can trick a user into double clicking in a specific location, they can pass the second click through to a dialog below that location. This will allow the attacker to cause the user to perform unintentional actions. (CVE-2016-1941)
 - An URL spoofing vulnerability exists due to a flaw that is triggered during the handling of a URL that invalid for the internal protocol, causing the URL to be pasted into the address bar. A remote attacker can exploit this spoof URLs, allowing the attacker to trick a user into visiting a malicious website. (CVE-2016-1942)
 - An unspecified memory corruption issue exists in the ANGLE graphics library implementation. A remote attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2016-1944)
 - A wild pointer flaw exists due to improper handling of ZIP files. A remote attacker can exploit this, via a crafted ZIP file, to have an unspecified impact. (CVE-2016-1945)
 - An integer overflow condition exists in the bundled version of libstagefright due to improper handling of MP4 file metadata. A remote attacker can exploit this to execute arbitrary code. (CVE-2016-1946)
 - A flaw exists in the safe browsing feature due to the Application Reputation service being unreachable. A remote attacker can exploit this to convince a user into downloading a malicious executable without being warned. (CVE-2016-1947)

The specific version of Firefox that the system is running is reportedly affected by the following vulnerabilities:

- Brotli contains a flaw in the DecodeVarLenUint8() function in dec/decode.c related to use of uninitialized memory. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1930)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor. (CVE-2016-1931)

- Mozilla Firefox contains a flaw in the Downscaler::ClearRow() function in image/Downscaler.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the nsComputedDOMStyle::GetStyleContextForElement() and nsComputedDOMStyle::GetStyleContextForElementNoFlush() functions in layout/style/nsComputedDOMStyle.cpp. The issue is triggered when using a frame that is not in the composed document. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw that is triggered when handling fuctions accepting rest parameters. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the CodeGeneratorShared::allocateData() function in js/src/jit/shared/CodeGenerator-shared.h that is triggered when handling out-of-memory error conditions. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the VCMGenericEncoder::Release() function in media/webrtc/trunk/webrtc/modules/video_coding/main/source/generic_encoder.cc. The issue is triggered as the encoded-frame callback is not unregistered when releasing codec databases. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains an unspecified flaw in js/src/vm/HelperThreads.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the JSRuntime::createJitRuntime() function in js/src/jscompartment.cpp that is triggered when handling out-of-memory error conditions. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains an unspecified flaw that is triggered when handling attribute changes. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the HTMLMediaElement::NotifyAddedSource() function in dom/html/HTMLMediaElement.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the nsGIFDecoder2::WriteInternal() function in image/decoders/nsGIFDecoder2.cpp that is triggered when handling GIF image frame bounds. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1931)

- Mozilla Firefox contains a flaw that is triggered when handling WebAudio content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a use-after-free condition in the nsLayoutUtils::SurfaceFromElement() function in dom/html/HTMLMediaElement.cpp. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1930)

- Mozilla Firefox contains a flaw in the Evaluate() function in js/src/shell/js.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1931)

- Mozilla Firefox contains an overflow condition in the WebGLContext::BufferData() function in dom/canvas/WebGLContextBuffers.cpp that is triggered when handling cache out-of-memory error conditions. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code. (CVE-2016-1935)

- Mozilla Firefox contains a flaw in the BrowserApp::onTabChanged() function in mobile/android/base/java/org/mozilla/gecko/BrowserApp.java. The issue is triggered when handling page scrolling. This may allow a context-dependent attacker to spoof the location. (CVE-2016-1943)

- Mozilla Firefox contains an integer overflow condition that is triggered when handling GIF images. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided by the vendor. (CVE-2016-1933)

- Mozilla Firefox contains a flaw in the Buffer11::NativeBuffer11::map() function within the ANGLE implementation. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1944)

- Mozilla Firefox for Android contains a flaw in mobile/android/chrome/content/browser.js that is triggered when handling data: URLs. This may allow a context-dependent attacker to spoof the location. (CVE-2016-1940)

- Mozilla Firefox contains a flaw in the safe browsing feature as the Application Reputation service was unreachable. This may allow a context-dependent attacker to trick a user into downloading a malicious executable without the user being warned. (CVE-2016-1947)

- Mozilla Firefox contains an integer overflow condition in the MoofParser::Metadata() function in media/libstagefright/binding/MoofParser.cpp. The issue is triggered when handling MP4 file metadata. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1946)

- Mozilla Firefox contains a flaw in modules/libjar/nsZipArchive.cpp that is triggered when handling ZIP files. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1945)

- Mozilla Firefox contains a flaw in the nsCookieService::SetCookieInternal() function in netwerk/cookie/nsCookieService.cpp as control characters are permitted in cookie names. This may allow a context-dependent attacker to inject cookies. (CVE-2016-1939)

- Mozilla Network Security Services (NSS) contains an unspecified cryptographical issue when handling calculations that contain mp_div or mp_exptmod. This may allow an attacker to trigger potential cryptographic weaknesses. (CVE-2016-1938)

- Mozilla Firefox for Android contains a flaw in mobile/android/chrome/content/browser.js that is triggered as lightweight themes fail to properly secure connections when installing themes. This may allow a remote man-in-the-middle attacker to make changes to the theme.
 (CVE-2016-1948)

- Mozilla Firefox contains a flaw in the protocol handler in toolkit/mozapps/handling/content/dialog.js that is due to the handler treating double click events as two single click events. This may allow a context-dependent attacker to spoof content to cause a user to potentially perform malicious actions, such as downloading attacker controlled software. (CVE-2016-1937)

- Mozilla Firefox for Mac OS X contains a flaw that is triggered as the delay between the download dialog getting focus and the button getting enabled is too short. If a context-dependent attacker can trick a user into double clicking in a specific location, they can pass the second click through to a dialog below that location. This will allow the attacker to cause the user to perform unintentional actions. (CVE-2016-1941)

- Mozilla Firefox contains a flaw in browser/base/content/urlbarBindings.xml that is triggered during the handling of a URL that is invalid for the internal protocol, which will cause the URL to be pasted into the address bar. This may allow a context-dependent attacker to spoof URLs. (CVE-2016-1942)

- Mozilla Network Security Services (NSS) contains a use-after-free error in the ssl3_HandleECDHServerKeyExchange() function. The issue is triggered when handling failed allocations during DHE and ECDHE handshakes. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1978)

ID	Name	Product	Family	Published	Updated	Severity
88459	Firefox < 44 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	1/28/2016	11/20/2019	critical
91379	GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)	Nessus	Gentoo Local Security Checks	5/31/2016	12/5/2022	critical
88459	Firefox < 44 の複数の脆弱性（Mac OS X）	Nessus	MacOS X Local Security Checks	1/28/2016	11/20/2019	critical
91379	GLSA-201605-06：Mozilla 製品：複数の脆弱性	Nessus	Gentoo Local Security Checks	5/31/2016	12/5/2022	critical
88459	Firefox < 44 多個弱點 (Mac OS X)	Nessus	MacOS X Local Security Checks	1/28/2016	11/20/2019	critical
88459	Firefox < 44 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	1/28/2016	11/20/2019	critical
91379	GLSA-201605-06：Mozilla 產品：多個弱點	Nessus	Gentoo Local Security Checks	5/31/2016	12/5/2022	critical
91379	GLSA-201605-06：Mozilla 产品：多种漏洞	Nessus	Gentoo Local Security Checks	5/31/2016	12/5/2022	critical
9075	Mozilla Firefox < 44.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2/19/2016	3/6/2019	critical
802019	Firefox < 44 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	9/6/2016		critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical