This update for MozillaFirefox to ESR 45.8 fixes the following issues:
Security issues fixed (bsc#1028391) :

  - CVE-2017-5402: Use-after-free working with events in     FontFace objects

  - CVE-2017-5410: Memory corruption during JavaScript     garbage collection incremental sweeping

  - CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP

  - CVE-2017-5401: Memory Corruption when handling     ErrorResult

  - CVE-2017-5407: Pixel and history stealing via     floating-point timing side channel with SVG filters

  - CVE-2017-5404: Use-after-free working with ranges in     selections

  - CVE-2017-5405: FTP response codes can cause use of     uninitialized values for ports

  - CVE-2017-5408: Cross-origin reading of video captions in     violation of CORS

  - CVE-2017-5409: File deletion via callback parameter in     Mozilla Windows Updater and Maintenance Service

  - CVE-2017-5398: Memory safety bugs fixed in Firefox 52     and Firefox ESR 45.8 Bugfixes :

  - fix crashes on Itanium (bsc#1027527)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox to ESR 45.8 fixes the following issues:
Security issues fixed (bsc#1028391) :

  - CVE-2017-5402: Use-after-free working with events in     FontFace objects

  - CVE-2017-5410: Memory corruption during JavaScript     garbage collection incremental sweeping

  - CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP

  - CVE-2017-5401: Memory Corruption when handling     ErrorResult

  - CVE-2017-5407: Pixel and history stealing via     floating-point timing side channel with SVG filters

  - CVE-2017-5404: Use-after-free working with ranges in     selections

  - CVE-2017-5405: FTP response codes can cause use of     uninitialized values for ports

  - CVE-2017-5408: Cross-origin reading of video captions in     violation of CORS

  - CVE-2017-5409: File deletion via callback parameter in     Mozilla Windows Updater and Maintenance Service

  - CVE-2017-5398: Memory safety bugs fixed in Firefox 52     and Firefox ESR 45.8

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Foundation reports :

Please reference CVE/URL list for details

このMozillaFirefoxのESR 45.8への更新では、次の問題が修正されます：
修正されたセキュリティ問題（bsc#1028391）：

  - CVE-2017-5402：FontFaceオブジェクト内のイベントで発生するメモリ解放後使用

  - CVE-2017-5410：JavaScriptガベージコレクションの増分スイーピング中のメモリ破損

  - CVE-2017-5400：ASLRとDEPのasm.js JITスプレーバイパス

  - CVE-2017-5401：ErrorResultの処理時のメモリ破損

  - CVE-2017-5407：SVGフィルターを使用した浮動小数点タイミングサイドチャネルを介した画素と履歴の盗取

  - CVE-2017-5404：選択の範囲で発生するメモリ解放後使用

  - CVE-2017-5405：FTPレスポンスコードがポートの初期化されていない値の使用を引き起こす可能性があります

  - CVE-2017-5408：CORSに違反したビデオキャプションのクロスオリジン読み取り

  - CVE-2017-5409：Mozilla Windows UpdaterとMaintenance Serviceでのコールバックパラメーターを介したファイル削除

  - CVE-2017-5398：Firefox 52とFirefox ESR 45.8で修正されたメモリ安全性に関するバグ

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

このMozillaFirefoxのESR 45.8への更新では、次の問題が修正されます：
修正されたセキュリティ問題（bsc#1028391）：

  - CVE-2017-5402：FontFaceオブジェクト内のイベントで発生するメモリ解放後使用

  - CVE-2017-5410：JavaScriptガベージコレクションの増分スイーピング中のメモリ破損

  - CVE-2017-5400：ASLRとDEPのasm.js JITスプレーバイパス

  - CVE-2017-5401：ErrorResultの処理時のメモリ破損

  - CVE-2017-5407：SVGフィルターを使用した浮動小数点タイミングサイドチャネルを介した画素と履歴の盗取

  - CVE-2017-5404：選択の範囲で発生するメモリ解放後使用

  - CVE-2017-5405：FTPレスポンスコードがポートの初期化されていない値の使用を引き起こす可能性があります

  - CVE-2017-5408：CORSに違反したビデオキャプションのクロスオリジン読み取り

  - CVE-2017-5409：Mozilla Windows UpdaterとMaintenance Serviceでのコールバックパラメーターを介したファイル削除

  - CVE-2017-5398：Firefox 52とFirefox ESR 45.8で修正されたメモリ安全性に関するバグ。バグ修正：

  - Itanium上のクラッシュを修正します（bsc#1027527）

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Mozilla Foundation による報告：

詳細については、CVE/URLリストを参照してください。

The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 45.8. It is, therefore, affected by multiple vulnerabilities :

  - Mozilla developers and community members Boris Zbarsky,     Christian Holler, Honza Bambas, Jon Coppeard, Randell     Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd     reported memory safety bugs present in Firefox 51 and     Firefox ESR 45.7. Some of these bugs showed evidence of     memory corruption and we presume that with enough     effort that some of these could be exploited to run     arbitrary code. (CVE-2017-5398)

  - JIT-spray targeting asm.js combined with a heap spray     allows for a bypass of ASLR and DEP protections leading     to potential memory corruption attacks. (CVE-2017-5400)

  - A crash triggerable by web content in which an     ErrorResult references unassigned memory due to a logic     error. The resulting crash may be exploitable.
    (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a     FontFace object after the object has been already been     destroyed while working with fonts. This results in a     potentially exploitable crash. (CVE-2017-5402)

  - A use-after-free error can occur when manipulating     ranges in selections with one node inside a native     anonymous tree and one node outside of it. This results     in a potentially exploitable crash. (CVE-2017-5404)

  - Certain response codes in FTP connections can result in     the use of uninitialized values for ports in FTP     operations. (CVE-2017-5405)

  - Using SVG filters that don't use the fixed point math     implementation on a target iframe, a malicious page can     extract pixel values from a targeted user. This can be     used to extract history information and read text     values across domains. This violates same-origin policy     and leads to information disclosure. (CVE-2017-5407)

  - Video files loaded video captions cross-origin without     checking for the presence of CORS headers permitting     such cross-origin use, leading to potential information     disclosure for video captions. (CVE-2017-5408)

  - The Mozilla Windows updater can be called by a     non-privileged user to delete an arbitrary local file     by passing a special path to the callback parameter     through the Mozilla Maintenance Service, which has     privileged access. Note: This attack requires local     system access and only affects Windows. Other operating     systems are not affected. (CVE-2017-5409)

  - Memory corruption resulting in a potentially     exploitable crash during garbage collection of     JavaScript due errors in how incremental sweeping is     managed for memory cleanup. (CVE-2017-5410)

Note that Tenable Network Security has extracted the preceding description block directly from the Mozilla security advisories.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox installed on the remote Windows host is prior to 52.0. It is, therefore, affected by multiple vulnerabilities :

  - Mozilla developers and community members Boris Zbarsky,     Christian Holler, Honza Bambas, Jon Coppeard, Randell     Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd     reported memory safety bugs present in Firefox 51 and     Firefox ESR 45.7. Some of these bugs showed evidence of     memory corruption and we presume that with enough     effort that some of these could be exploited to run     arbitrary code. (CVE-2017-5398)

  - Mozilla developers and community members Carsten Book,     Calixte Denizet, Christian Holler, Andrew McCreight,     David Bolter, David Keeler, Jon Coppeard, Tyson Smith,     Ronald Crane, Tooru Fujisawa, Ben Kelly, Bob Owen, Jed     Davis, Julian Seward, Julian Hector, Philipp, Markus     Stange, and Andre Bargull reported memory safety bugs     present in Firefox 51. Some of these bugs showed     evidence of memory corruption and we presume that with     enough effort that some of these could be exploited to     run arbitrary code. (CVE-2017-5399)

  - JIT-spray targeting asm.js combined with a heap spray     allows for a bypass of ASLR and DEP protections leading     to potential memory corruption attacks. (CVE-2017-5400)

  - A crash triggerable by web content in which an     ErrorResult references unassigned memory due to a logic     error. The resulting crash may be exploitable.
    (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a     FontFace object after the object has been already been     destroyed while working with fonts. This results in a     potentially exploitable crash. (CVE-2017-5402)

  - When adding a range to an object in the DOM, it is     possible to use addRange to add the range to an     incorrect root object. This triggers a use-after-free,     resulting in a potentially exploitable crash.
    (CVE-2017-5403)

  - A use-after-free error can occur when manipulating     ranges in selections with one node inside a native     anonymous tree and one node outside of it. This results     in a potentially exploitable crash. (CVE-2017-5404)

  - Certain response codes in FTP connections can result in     the use of uninitialized values for ports in FTP     operations. (CVE-2017-5405)

  - A segmentation fault can occur in the Skia graphics     library during some canvas operations due to issues     with mask/clip intersection and empty masks.
    (CVE-2017-5406)

  - Using SVG filters that don't use the fixed point math     implementation on a target iframe, a malicious page can     extract pixel values from a targeted user. This can be     used to extract history information and read text     values across domains. This violates same-origin policy     and leads to information disclosure. (CVE-2017-5407)

  - Video files loaded video captions cross-origin without     checking for the presence of CORS headers permitting     such cross-origin use, leading to potential information     disclosure for video captions. (CVE-2017-5408)

  - The Mozilla Windows updater can be called by a     non-privileged user to delete an arbitrary local file     by passing a special path to the callback parameter     through the Mozilla Maintenance Service, which has     privileged access. Note: This attack requires local     system access and only affects Windows. Other operating     systems are not affected. (CVE-2017-5409)

  - Memory corruption resulting in a potentially     exploitable crash during garbage collection of     JavaScript due errors in how incremental sweeping is     managed for memory cleanup. (CVE-2017-5410)

  - A use-after-free can occur during buffer storage     operations within the ANGLE graphics library, used for     WebGL content. The buffer storage can be freed while     still in use in some circumstances, leading to a     potentially exploitable crash. Note: This issue is in     libGLES, which is only in use on Windows. Other     operating systems are not affected. (CVE-2017-5411)

  - A buffer overflow read during SVG filter color value     operations, resulting in data exposure. (CVE-2017-5412)

  - A segmentation fault can occur during some     bidirectional layout operations. (CVE-2017-5413)

  - The file picker dialog can choose and display the wrong     local default directory when instantiated. On some     operating systems, this can lead to information     disclosure, such as the operating system or the local     account name. (CVE-2017-5414)

  - An attack can use a blob URL and script to spoof an     arbitrary addressbar URL prefaced by blob: as the     protocol, leading to user confusion and further     spoofing attacks. (CVE-2017-5415)

  - In certain circumstances a networking event listener     can be prematurely released. This appears to result in     a null dereference in practice. (CVE-2017-5416)

  - When dragging content from the primary browser pane to     the addressbar on a malicious site, it is possible to     change the addressbar so that the displayed location     following navigation does not match the URL of the     newly loaded page. This allows for spoofing attacks.
    (CVE-2017-5417)

  - An out of bounds read error occurs when parsing some     HTTP digest authorization responses, resulting in     information leakage through the reading of random     memory containing matches to specifically set patterns.
    (CVE-2017-5418)

  - If a malicious site repeatedly triggers a modal     authentication prompt, eventually the browser UI will     become non-responsive, requiring shutdown through the     operating system. This is a denial of service (DOS)     attack. (CVE-2017-5419)

  - A javascript: url loaded by a malicious page can     obfuscate its location by blanking the URL displayed in     the addressbar, allowing for an attacker to spoof an     existing page without the malicious page's address     being displayed correctly. (CVE-2017-5420)

  - A malicious site could spoof the contents of the print     preview window if popup windows are enabled, resulting     in user confusion of what site is currently loaded.
    (CVE-2017-5421)

  - If a malicious site uses the view-source: protocol in a     series within a single hyperlink, it can trigger a     non-exploitable browser crash when the hyperlink is     selected. This was fixed by no longer making     view-source: linkable. (CVE-2017-5422)

  - A non-existent chrome.manifest file will attempt to be     loaded during startup from the primary installation     directory. If a malicious user with local access puts     chrome.manifest and other referenced files in this     directory, they will be loaded and activated during     startup. This could result in malicious software being     added without consent or modification of referenced     installed files. (CVE-2017-5427)

Note that Tenable Network Security has extracted the preceding description block directly from the Mozilla security advisories.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

リモートのWindowsホストにインストールされているMozilla Firefox ESRは、45.8より前のバージョンです。したがって、以下の複数の脆弱性による影響を受けます。

  - Mozilla developers and community members Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd reported memory safety bugs present in Firefox 51 and Firefox ESR 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2017-5398)

  - JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. (CVE-2017-5400)

  - A crash triggerable by web content in which an ErrorResult references unassigned memory due to a logic error. 結果として発生するクラッシュは悪用される可能性があります。
    (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a FontFace object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. (CVE-2017-5402)

  - A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. (CVE-2017-5404)

  - Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. (CVE-2017-5405)

  - Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. これは、履歴情報を抽出し、ドメイン間でテキスト値を読み取るために使用される可能性があります。This violates same-origin policy and leads to information disclosure. (CVE-2017-5407)

  - Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. (CVE-2017-5408)

  - The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. 注: この攻撃にはローカルシステムへのアクセスが必要であり、Windowsにのみ影響します。他のオペレーティングシステムは影響を受けません。(CVE-2017-5409)

  - Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. (CVE-2017-5410)

Tenable Network Securityは、前述の記述ブロックをMozillaセキュリティアドバイザリから直接抽出しています。
Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートのWindowsホストにインストールされているMozilla Firefoxのバージョンが、52.0より前です。したがって、以下の複数の脆弱性による影響を受けます。

  - Mozilla developers and community members Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd reported memory safety bugs present in Firefox 51 and Firefox ESR 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2017-5398)

  - Mozilla developers and community members Carsten Book, Calixte Denizet, Christian Holler, Andrew McCreight, David Bolter, David Keeler, Jon Coppeard, Tyson Smith, Ronald Crane, Tooru Fujisawa, Ben Kelly, Bob Owen, Jed Davis, Julian Seward, Julian Hector, Philipp, Markus Stange, and Andre Bargull reported memory safety bugs present in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2017-5399)

  - JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. (CVE-2017-5400)

  - A crash triggerable by web content in which an ErrorResult references unassigned memory due to a logic error. 結果として発生するクラッシュは悪用される可能性があります。
    (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a FontFace object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. (CVE-2017-5402)

  - When adding a range to an object in the DOM, it is possible to use addRange to add the range to an incorrect root object. これはメモリ解放後使用（use-after-free）をトリガーし、悪用可能なクラッシュを引き起こします。
    (CVE-2017-5403)

  - A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. (CVE-2017-5404)

  - Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. (CVE-2017-5405)

  - A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks.
    (CVE-2017-5406)

  - Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. これは、履歴情報を抽出し、ドメイン間でテキスト値を読み取るために使用される可能性があります。This violates same-origin policy and leads to information disclosure. (CVE-2017-5407)

  - Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. (CVE-2017-5408)

  - The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. 注: この攻撃にはローカルシステムへのアクセスが必要であり、Windowsにのみ影響します。他のオペレーティングシステムは影響を受けません。(CVE-2017-5409)

  - Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. (CVE-2017-5410)

  - A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. バッファストレージは、状況次第で解放されるかまたは継続して使用され、悪用可能なクラッシュを引き起こすことがあります。注: この問題は、Windowsのみで使われているlibGLESに存在します。他のオペレーティングシステムは影響を受けません。(CVE-2017-5411)

  - A buffer overflow read during SVG filter color value operations, resulting in data exposure. (CVE-2017-5412)

  - A segmentation fault can occur during some bidirectional layout operations. (CVE-2017-5413)

  - The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. (CVE-2017-5414)

  - An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by blob: as the protocol, leading to user confusion and further spoofing attacks. (CVE-2017-5415)

  - In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. (CVE-2017-5416)

  - When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page. これにより、なりすまし攻撃が可能になります。
    (CVE-2017-5417)

  - An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns.
    (CVE-2017-5418)

  - If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service (DOS) attack. (CVE-2017-5419)

  - A javascript: url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. (CVE-2017-5420)

  - A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded.
    (CVE-2017-5421)

  - If a malicious site uses the view-source: プロトコルを利用すると、ハイパーリンクを選択したときに悪用できないブラウザークラッシュを引き起こす可能性があります。これはview-source: linkable. (CVE-2017-5422)

  - A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. ローカルアクセスを持つ悪意のあるユーザーが、このディレクトリにchrome.manifestと他の参照ファイルを置くと、起動時に読み込まれて有効になります。This could result in malicious software being added without consent or modification of referenced installed files. (CVE-2017-5427)

Tenable Network Securityは、前述の記述ブロックをMozillaセキュリティアドバイザリから直接抽出しています。
Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

远程 Windows 主机上安装的 Mozilla Firefox ESR 版本低于 45.8。因而会受到多个漏洞的影响：- Mozilla 开发人员和社区成员 Boris Zbarsky、Christian Holler、Honza Bambas、Jon Coppeard、Randell Jesup、Andre Bargull、Kan-Ru Chen 和 Nathan Froyd 报告 Firefox 51 和 Firefox ESR 45.7 中存在内存安全错误。其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。(CVE-2017-5398) - 瞄准 asm.js 的 JIT 喷射连同堆喷溅，允许绕过 ASLR 和 DEP 保护，造成潜在的内存损坏攻击。(CVE-2017-5400) - 由网页内容触发的崩溃，其中由于逻辑错误导致 ErrorResult 引用未分配内存。所引起的崩溃可遭到漏洞利用。(CVE-2017-5401) - 在处理字体时，若已破坏 FontFace 对象，其后又触发该对象的事件，会引发释放后使用错误。这会导致潜在可利用的崩溃。(CVE-2017-5402) - 当在本地匿名树内外各有一个节点时，操控选择的范围，会引发释放后使用错误。这会导致潜在可利用的崩溃。(CVE-2017-5404) - FTP 连接中的某些响应代码，可能导致在 FTP 操作中使用未初始化的端口值。(CVE-2017-5405) - 所用 SVG 筛选器若没有在目标 iframe 上使用定点数学实施，则恶意页面会从目标用户处提取像素值。这可用于跨域提取历史信息和读取文本值。如此即违反了同源策略，导致信息泄露。(CVE-2017-5407) - 视频文件跨源加载视频字幕，并未检查是否存在 CORS 标头，以允许此等跨源使用，这可能导致视频字幕信息泄露。(CVE-2017-5408) - 无特权用户可调用 Mozilla Windows 更新程序，通过具有特别访问权的 Mozilla 维护服务，向回调参数传递特殊路径，而删除任意本地文件。注意：该攻击要求具有本地系统访问权，且仅限影响 Windows。其他操作系统不受影响。(CVE-2017-5409) - 由于增量清理内存的管理方式出现错误，内存损坏可能会在 JavaScript 的垃圾回收期间引起崩溃。(CVE-2017-5410) 请注意，Tenable Network Security 已直接从 Mozilla 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程 Windows 主机上安装的 Mozilla Firefox 版本低于 52.0。因而会受到多个漏洞的影响：- Mozilla 开发人员和社区成员 Boris Zbarsky、Christian Holler、Honza Bambas、Jon Coppeard、Randell Jesup、Andre Bargull、Kan-Ru Chen 和 Nathan Froyd 报告 Firefox 51 和 Firefox ESR 45.7 中存在内存安全错误。其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。(CVE-2017-5398) - Mozilla 开发人员和社区成员 Carsten Book、Calixte Denizet、Christian Holler、Andrew McCreight、David Bolter、David Keeler、Jon Coppeard、Tyson Smith、Ronald Crane、Tooru Fujisawa、Ben Kelly、Bob Owen、Jed Davis、Julian Seward、Julian Hector、Philipp、Markus Stange 和 Andre Bargull 报告 Firefox 51 中存在内存安全错误。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。(CVE-2017-5399) - 瞄准 asm.js 的 JIT 喷射连同堆喷溅，允许绕过 ASLR 和 DEP 保护，造成潜在的内存损坏攻击。(CVE-2017-5400) - 由网页内容触发的崩溃，其中由于逻辑错误导致 ErrorResult 引用未分配内存。所引起的崩溃可遭到漏洞利用。(CVE-2017-5401) - 在处理字体时，若已破坏 FontFace 对象，其后又触发该对象的事件，会引发释放后使用错误。这会导致潜在可利用的崩溃。(CVE-2017-5402) - 在 DOM 中为对象添加范围时，有可能会使用 addRange 为错误的根对象添加范围。这会触发释放后使用错误，导致可遭利用的崩溃。(CVE-2017-5403) - 当在本地匿名树内外各有一个节点时，操控选择的范围，会引发释放后使用错误。这会导致潜在可利用的崩溃。(CVE-2017-5404) - FTP 连接中的某些响应代码，可能导致在 FTP 操作中使用未初始化的端口值。(CVE-2017-5405) - 由于蒙版/剪辑交集和空蒙版的问题，在有些画布操作期间，Skia 图形库中会发生分段错误。(CVE-2017-5406) - 使用的 SVG 筛选器若没有在目标 iframe 上使用定点数学实施，则恶意页面会从目标用户处提取像素值。这可用于跨域提取历史信息和读取文本值。如此即违反了同源策略，导致信息泄露。(CVE-2017-5407) - 视频文件跨源加载视频字幕，并未检查是否存在 CORS 标头，以允许此等跨源使用，这可能导致视频字幕信息泄露。(CVE-2017-5408) - 无特权用户可调用 Mozilla Windows 更新程序，通过具有特别访问权的 Mozilla 维护服务，向回调参数传递特殊路径，而删除任意本地文件。注意：该攻击要求具有本地系统访问权，且仅限影响 Windows。其他操作系统不受影响。(CVE-2017-5409) - 由于增量清理内存的管理方式出现错误，内存损坏可能会在 JavaScript 的垃圾回收期间引起崩溃。(CVE-2017-5410) - 在缓冲区存储操作期间，用于 WebGL 内容的 ANGLE 图形库中会发生释放后使用错误。在某些情况下，可以释放仍在使用的缓冲区存储，因而可能导致可遭利用的崩溃。注意：该问题存在于只有 Windows 在使用的 libGLES 中。其他操作系统不受影响。(CVE-2017-5411) - SVG 过滤器进行颜色值操作期间，存在缓冲区溢出读取，因而造成数据泄露。(CVE-2017-5412) - 在某些双向布局操作期间，会发生分段错误。(CVE-2017-5413) - 在实例化时，文件选择器对话框会选择和显示错误的本地默认目录。在某些操作系统中，这有可能会导致信息泄露，例如操作系统或本地帐户名称。(CVE-2017-5414) - 攻击者可使用 blob URL 和脚本，来伪造以 blob: 开头的任意 URL 地址栏作为协议，造成用户混淆和进一步的欺骗攻击。(CVE-2017-5415) - 在某些情况下，网络事件侦听器可以提前释放。这在实践中可能会造成空取消引用。(CVE-2017-5416) - 当从主要浏览器窗格中拖拽内容至恶意站点的地址栏时，有可能会改变地址栏，使得导航之后显示的位置与新加载页面的 URL 不相符。这会允许欺骗攻击。(CVE-2017-5417) - 分析某些 HTTP 摘要授权响应时，会发生越界读取错误，导致通过读取包含符合特别设置模式的随机内存时，就会造成信息泄露。(CVE-2017-5418) - 如果恶意站点反复触发模式验证提示，浏览器 UI 最终会停止响应，需要通过操作系统关闭。这是拒绝服务 (DOS) 攻击。(CVE-2017-5419) - 恶意页面加载的 javascript: url 会通过消除地址栏中显示的 URL 而混淆其位置，允许攻击者在未正确显示恶意网页地址的情况下伪造现有页面。(CVE-2017-5420) - 如果启用弹出窗口，恶意站点可能会伪造打印预览窗口的内容，导致用户无法判断当前加载了哪个站点。(CVE-2017-5421) - 如果恶意站点在单一超链接中使用 view-source: 系列协议，选择该超链接时，可能触发不可利用的浏览器崩溃。通过使 view-source: 不再具有可链接性，来修复该问题。(CVE-2017-5422) - 从主安装目录启动时，试图加载不存在的 chrome.manifest 文件。如果具有本地访问权的恶意用户，在该目录中放置 chrome.manifest 及其他引用文件，启动时将加载和激活这些文件。这可导致在未经同意的情况下添加恶意软件，或修改引用的安装文件。(CVE-2017-5427) 请注意，Tenable Network Security 已直接从 Mozilla 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

遠端 Windows 主機上安裝的 Mozilla Firefox ESR 版本比 45.8 舊。因此，會受到多個弱點影響：- Mozilla 開發人員與社群成員 Boris Zbarsky、Christian Holler、Honza Bambas、Jon Coppeard、Randell Jesup、Andre Bargull、Kan-Ru Chen 和 Nathan Froyd 報告 Firefox 51 版和 Firefox ESR 45.7 版中出現記憶體安全錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-5398) - 以 asm.js 為目標的 JIT 噴射加上堆積噴射可繞過 ASLR 和 DEP 保護，造成潛在的記憶體損毀攻擊。(CVE-2017-5400) - 可經由網路內容觸發的當機，其中因為邏輯錯誤導致 ErrorResult 參照未指派記憶體。所造成的當機問題可遭惡意利用。(CVE-2017-5401) - 在處理字型時若已破壞 FontFace 物件，其後又觸發 FontFace 物件的事件，會發生釋放後使用錯誤。這會造成可能遭惡意利用的當機。(CVE-2017-5402) - 操控選取的範圍時，若一個節點在原生匿名樹狀結構之內，而另一個節點在樹狀結構之外，會發生釋放後使用錯誤。這會造成可能遭惡意利用的當機。(CVE-2017-5404) - FTP 連線中的特定回應程式碼可能會造成在 FTP 作業中使用未初始化的連接埠值。(CVE-2017-5405) - 使用的 SVG 篩選器若沒有在目標 iframe 上使用定點數學實作，惡意頁面會從目標使用者擷取像素值。這可以用來跨網域擷取歷程記錄資訊並讀取文字值。如此即違反同源原則，導致資訊洩漏。(CVE-2017-5407) - 沒有檢查是否有允許跨來源使用的 CORS 標頭，視訊檔案便直接載入跨來源標題，導致可能洩露視訊標題資訊。(CVE-2017-5408) - 不具權限的使用者可以呼叫 Mozilla Windows 更新程式，透過具有特殊存取權限的 Mozilla 維護服務，將特殊路徑傳遞給回呼參數來刪除任意本機檔案。請注意：此攻擊必須有本機系統存取權，且只會影響 Windows。其他作業系統不受影響。(CVE-2017-5409) - 記憶體損毀造成在 JavaScript 的記憶體回收期間發生可能遭惡意利用的當機，這是因為增量式清除記憶體的管理錯誤所致。(CVE-2017-5410) 請注意，Tenable Network Security 已直接從 Mozilla 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端 Windows 主機上安裝的 Mozilla Firefox 版本比 52.0 舊。因此，會受到多個弱點影響：- Mozilla 開發人員與社群成員 Boris Zbarsky、Christian Holler、Honza Bambas、Jon Coppeard、Randell Jesup、Andre Bargull、Kan-Ru Chen 和 Nathan Froyd 報告 Firefox 51 版和 Firefox ESR 45.7 版中出現記憶體安全錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-5398) - Mozilla 開發人員與社群成員 Carsten Book、Calixte Denizet、Christian Holler、Andrew McCreight、David Bolter、David Keeler、Jon Coppeard、Tyson Smith、Ronald Crane、Tooru Fujisawa、Ben Kelly、Bob Owen、Jed Davis、Julian Seward、Julian Hector、Philipp、Markus Stange 和 Andre Bargull 報告 Firefox 51 版出現記憶體安全錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-5399) - 以 asm.js 為目標的 JIT 噴射加上堆積噴射可繞過 ASLR 和 DEP 保護，造成潛在的記憶體損毀攻擊。(CVE-2017-5400) - 可經由網路內容觸發的當機，其中因為邏輯錯誤導致 ErrorResult 參照未指派記憶體。所造成的當機問題可遭惡意利用。(CVE-2017-5401) - 在處理字型時若已破壞 FontFace 物件，其後又觸發 FontFace 物件的事件，會發生釋放後使用錯誤。這會造成可能遭惡意利用的當機。(CVE-2017-5402) - 在 DOM 中新增物件的範圍時，有可能使用 addRange 新增錯誤根物件的範圍。這會觸發釋放後使用錯誤，造成可能遭惡意利用的當機。(CVE-2017-5403) - 操控選取的範圍時，若一個節點在原生匿名樹狀結構之內，而另一個節點在樹狀結構之外，會發生釋放後使用錯誤。這會造成可能遭惡意利用的當機。(CVE-2017-5404) - FTP 連線中的特定回應程式碼可能會造成在 FTP 作業中使用未初始化的連接埠值。(CVE-2017-5405) - 在有些畫布作業期間，Skia 圖形程式庫中會發生分割錯誤，這是因為遮罩/裁剪交集和空遮罩的問題所致。(CVE-2017-5406) - 使用的 SVG 篩選器若沒有在目標 iframe 上使用定點數學實作，惡意頁面會從目標使用者擷取像素值。這可以用來跨網域擷取歷程記錄資訊並讀取文字值。如此即違反同源原則，導致資訊洩漏。(CVE-2017-5407) - 沒有檢查是否有允許跨來源使用的 CORS 標頭，視訊檔案便直接載入跨來源標題，導致可能洩露視訊標題資訊。(CVE-2017-5408) - 不具權限的使用者可以呼叫 Mozilla Windows 更新程式，透過具有特殊存取權限的 Mozilla 維護服務，將特殊路徑傳遞給回呼參數來刪除任意本機檔案。請注意：此攻擊必須有本機系統存取權，且只會影響 Windows。其他作業系統不受影響。(CVE-2017-5409) - 記憶體損毀造成在 JavaScript 的記憶體回收期間發生可能遭惡意利用的當機，這是因為增量式清除記憶體的管理錯誤所致。(CVE-2017-5410) - 在緩衝區儲存空間作業期間，WebGL 內容專用的 ANGLE 圖形程式庫中會發生釋放後使用錯誤。有時可能會釋放仍在使用中的緩衝區儲存空間，造成可能遭惡意利用的當機。請注意：此問題存在於只有 Windows 系統會使用的 libGLES。其他作業系統不受影響。(CVE-2017-5411) - SVG 篩選器顏色值作業期間發生緩衝區溢位讀取錯誤，造成資料外洩。(CVE-2017-5412) - 在有些雙向版面配置作業期間會發生分割錯誤。(CVE-2017-5413) - 在具現化時，檔案選擇器對話方塊會選擇並顯示錯誤的本機預設目錄。這在有些作業系統上會造成資訊洩漏，例如作業系統或本機帳戶名稱。(CVE-2017-5414) - 攻擊會使用 blob URL 和指令碼來偽造以 blob: 開頭的任意位址列 URL 作為通訊協定，造成使用者混淆並進而執行詐騙攻擊。(CVE-2017-5415) - 在特定情況下，網路事件接聽程式會過早釋放。這在實務上似乎會造成 NULL 解除參照。(CVE-2017-5416) - 將內容從主要的瀏覽器窗格拖放至惡意網站的位址列時可能會變更位址列，使得瀏覽之後顯示的位置不符合新載入頁面的 URL。這會導致詐騙攻擊。(CVE-2017-5417) - 剖析某些 HTTP 摘要授權要求時會發生越界讀取錯誤，造成只要透過讀取含有符合特別設定之模式的隨機記憶體，即會導致資訊洩漏。(CVE-2017-5418) - 如果惡意網站反覆觸發強制回應驗證提示，瀏覽器 UI 最終會停止回應，必須透過作業系統關機。這是拒絕服務 (DOS) 攻擊。(CVE-2017-5419) - 惡意頁面載入的 javascript: url 會清空位址列中顯示的 URL 來混淆其位置，讓攻擊者得以偽造現有頁面，且不會正確顯示惡意頁面的位址。(CVE-2017-5420) - 如果有啟用快顯視窗，惡意網站就可以偽造列印預覽視窗的內容，造成使用者分不清楚目前載入的是哪個網站。(CVE-2017-5421) - 如果惡意網站在單一超連結中使用一連串的 view-source: (檢視原始碼) 通訊協定，選取超連結時會觸發不可利用的瀏覽器損毀。此問題已修正，view-source: (檢視原始碼) 已不再具有連結性。(CVE-2017-5422) - 從主要安裝目錄啟動時，會嘗試載入不存在的 chrome.manifest 檔案。如果具有本機存取權的惡意使用者在此目錄中放置 chrome.manifest 及其他參照檔案，啟動時就會載入並啟動這些檔案。這會造成在未經同意之下加入惡意軟體，或是修改參照的安裝檔案。(CVE-2017-5427) 請注意，Tenable Network Security 已直接從 Mozilla 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Versions of Mozilla Firefox ESR earlier than 45.8 are unpatched for the following vulnerabilities :

 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/jsgc.cpp' that is triggered as certain input is not properly validated when handling zone groups. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'netwerk/streamconv/converters/nsMultiMixedConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'netwerk/cache/nsDiskCacheDeviceSQL.cpp' that is triggered when handling cache eviction. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.- A use-after-free condition exists that is triggered when handling NPAPI plugin references. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/base/nsDocument.cpp' that is triggered when handling frame request callbacks rescheduling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::array_sort()' function in 'js/src/jsarray.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'cairo_cff_font_write_cid_fontdict()' function in 'cairo-cff-subset.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists in the 'FontFaceSet' class in 'layout/style/FontFaceSet.cpp' that is triggered when handling events for FontFace objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the JavaScript Garbage Collection mechanism that is triggered during incremental sweeping on memory cleanups. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/ErrorResult.h' that is triggered when handling ErrorResult references. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling ranges in selections with one node inside and one node outside of a native anonymous tree. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'HTMLTrackElement::LoadResource()' function in 'dom/html/HTMLTrackElement.cpp' that is triggered as CORS headers are not checked when loading video captions. This may allow a context-dependent attacker to disclose video captions.
 - A path truncation flaw exist in the 'NS_main()' function in 'toolkit/mozapps/update/updater/updater.cpp' that is triggered when passing callback parameters through the Mozilla Maintenance Service. This may allow a local attacker to delete arbitrary files with elevated privileges.
 - A flaw exists in the 'FilterNodeLightingSoftware::SetAttribute()' function template in 'gfx/2d/FilterNodeSoftware.cpp' that is triggered when handling subnormal surfaceScale values. With a specially crafted SVG filter, a context-dependent attacker can perform a side-channel attack, potentially resulting in disclosure of history information or text values across domains.

Versions of Mozilla Firefox prior to 52 are unpatched for the following vulnerabilities :

 - A flaw exists that is triggered when using a JIT-spray targeting 'asm.js' in conjunction with a heap spray that may allow a context-dependent attacker to bypass the Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) protection mechanisms.
 - A flaw exists in the 'txMozillaXMLOutput::createResultDocument()' function in 'dom/xslt/xslt/txMozillaXMLOutput.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/network/UDPSocketParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'js/src/jit/arm/MacroAssembler-arm.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocShell::CreateAboutBlankContentViewer()' function in 'docshell/base/nsDocShell.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated when handling SMIL RAII objects. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated when handling accessibles. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'trace()' function in 'xpcom/base/CycleCollectedJSContext.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An integer underflow condition exists in the 'apply_lookup()' function in 'hb-ot-layout-gsubgpos-private.hh' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A flaw exists in the 'nsWebBrowser::RemoveWebBrowserListener()' function in 'embedding/browser/nsWebBrowser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/u2f/U2F.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Element::DescribeAttribute()' function in 'dom/base/Element.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'xpcom/ds/nsSupportsArray.cpp' that is triggered when handling 'nsISupportsArrays'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/workers/ServiceWorkerPrivate.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'layout/printing/nsPrintEngine.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'netwerk/cache2/CacheIndex.cpp' that is triggered when handling cache index serialization. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'media/webrtc/trunk/webrtc/modules/video_coding/rtt_filter.cc' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to the camera system service that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/jsgc.cpp' that is triggered as certain input is not properly validated when handling zone groups. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'netwerk/streamconv/converters/nsMultiMixedConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'netwerk/cache/nsDiskCacheDeviceSQL.cpp' that is triggered when handling cache eviction. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free condition exists that is triggered when handling NPAPI plugin references. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/base/nsDocument.cpp' that is triggered when handling frame request callbacks rescheduling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::array_sort()' function in 'js/src/jsarray.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'cairo_cff_font_write_cid_fontdict()' function in 'cairo-cff-subset.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when using addRange to add the range to an incorrect root object. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'FontFaceSet' class in 'layout/style/FontFaceSet.cpp' that is triggered when handling events for FontFace objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the JavaScript Garbage Collection mechanism that is triggered during incremental sweeping on memory cleanups. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/ErrorResult.h' that is triggered when handling 'ErrorResult' references. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling ranges in selections with one node inside and one node outside of a native anonymous tree. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling SVG filter color value operations. This may allow a context-dependent attacker to potentially disclose sensitive memory contents.
 - A flaw exists in the 'HTMLTrackElement::LoadResource()' function in 'dom/html/HTMLTrackElement.cpp' that is triggered as CORS headers are not checked when loading video captions. This may allow a context-dependent attacker to disclose video captions.
 - A path truncation flaw exist in the 'NS_main()' function in 'toolkit/mozapps/update/updater/updater.cpp' that is triggered when passing callback parameters through the Mozilla Maintenance Service. This may allow a local attacker to delete arbitrary files with elevated privileges.
 - A flaw exists in the 'FilterNodeLightingSoftware::SetAttribute()' function template in 'gfx/2d/FilterNodeSoftware.cpp' that is triggered when handling subnormal surfaceScale values. With a specially crafted SVG filter, a context-dependent attacker can perform a side-channel attack, potentially resulting in disclosure of history information or text values across domains.
 - An out-of-bounds access flaw exists that is triggered when handling bidirectional layout operations. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided by the vendor.
 - A flaw exists in the 'Location' class in 'dom/base/Location.cpp' that is triggered when using a Blob URL. This may allow a context-dependent attacker to spoof the address bar.
 - A flaw exists in the 'HTMLInputElement' class in 'dom/html/HTMLInputElement.cpp' that is triggered when handling the local default directory for a file picker dialog. This may allow a context-dependent attacker to disclose information e.g. about the operating system or the local account name.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97832	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2017:0732-1)	Nessus	SuSE Local Security Checks	2017/3/20	2021/1/19	critical
97825	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2017:0714-1)	Nessus	SuSE Local Security Checks	2017/3/20	2021/1/6	critical
97592	FreeBSD : mozilla -- multiple vulnerabilities (96eca031-1313-4daf-9be2-9d6e1c4f1eb5)	Nessus	FreeBSD Local Security Checks	2017/3/8	2021/1/4	critical
97825	SUSE SLED12 / SLES12セキュリティ更新プログラム：MozillaFirefox（SUSE-SU-2017:0714-1）	Nessus	SuSE Local Security Checks	2017/3/20	2021/1/6	critical
97832	SUSE SLES11セキュリティ更新プログラム：MozillaFirefox（SUSE-SU-2017:0732-1）	Nessus	SuSE Local Security Checks	2017/3/20	2021/1/19	critical
97592	FreeBSD: mozilla -- 複数の脆弱性（96eca031-1313-4daf-9be2-9d6e1c4f1eb5）	Nessus	FreeBSD Local Security Checks	2017/3/8	2021/1/4	critical
97638	Mozilla Firefox ESR < 45.8 Multiple Vulnerabilities	Nessus	Windows	2017/3/9	2019/11/13	critical
97639	Mozilla Firefox < 52.0 Multiple Vulnerabilities	Nessus	Windows	2017/3/9	2019/11/13	critical
97638	Mozilla Firefox ESR < 45.8の複数の脆弱性	Nessus	Windows	2017/3/9	2019/11/13	critical
97639	Mozilla Firefox < 52.0の複数の脆弱性	Nessus	Windows	2017/3/9	2019/11/13	critical
97638	Mozilla Firefox ESR < 45.8 多个漏洞	Nessus	Windows	2017/3/9	2019/11/13	critical
97639	Mozilla Firefox < 52.0 多个漏洞	Nessus	Windows	2017/3/9	2019/11/13	critical
97638	Mozilla Firefox ESR < 45.8 多個弱點	Nessus	Windows	2017/3/9	2019/11/13	critical
97639	Mozilla Firefox < 52.0 多個弱點	Nessus	Windows	2017/3/9	2019/11/13	critical
9987	Mozilla Firefox ESR < 45.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/3/8	2019/11/6	high
9986	Mozilla Firefox < 52 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/3/8	2019/3/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical