The version of Firefox installed on the remote Windows host is prior to 57.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-24 advisory.

  - Mozilla developers and community members Boris Zbarsky, Carsten Book, Christian Holler, Byron Campen, Jan     de Mooij, Jason Kratzer, Jesse Schwartzentruber, Marcia Knous, Randell Jesup, Tyson Smith, and Ting-Yu     Chou reported memory safety bugs present in Firefox 56. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort that some of these could be exploited to run arbitrary     code. (CVE-2017-7827)

  - A use-after-free vulnerability can occur when flushing and resizing layout because the     <code>PressShell</code> object has been freed while still in use. This results in a potentially     exploitable crash during these operations. (CVE-2017-7828)

  - The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin     policy violation and could allow for data theft of URLs loaded by users. (CVE-2017-7830)

  - A vulnerability where the security wrapper does not deny access to some exposed properties using the     deprecated <code>exposedProps</code> mechanism on proxy objects. These properties should be explicitly     unavailable to proxy objects. (CVE-2017-7831)

  - The combined, single character, version of the letter 'i' with any of the potential accents in unicode,     such as acute or grave, can be spoofed in the addressbar by the dotless version of 'i' followed by the     same accent as a second character with most font sets. This allows for domain spoofing attacks because     these combined domain names do not display as punycode. (CVE-2017-7832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモートの Windows ホストにインストールされている Firefox のバージョンは、57.0 より前です。したがって、mfsa2017-24 アドバイザリに記載されている複数の脆弱性の影響を受けます。

  - Mozilla 開発者およびコミュニティメンバーの Boris Zbarsky 氏、Carsten Book 氏、Christian Holler 氏、Byron Campen 氏、Jan de Mooij 氏、Jason Kratzer 氏、Jesse Schwartzentruber 氏、Marcia Knous 氏、Randell Jesup 氏、Tyson Smith 氏、Ting-Yu Chou 氏は、Firefox 56 に存在するメモリ安全性のバグを報告しました。これらのバグの一部にはメモリ破損の証拠が示されており、当社では、十分な労力をもってすればこれらの一部を悪用し、任意のコードを実行することが可能であると推測しています。(CVE-2017-7827)

  - <code>PressShell</code> オブジェクトが使用中に解放されているため、レイアウトをフラッシュおよびサイズ変更する際に、メモリ解放後使用 (Use-After-Free) の脆弱性が発生する可能性があります。これにより、これらの操作中に悪用可能なクラッシュが引き起こされる可能性があります。(CVE-2017-7828)

  - Resource Timing API が、クロスオリジン iframe のナビゲーションを不適切に漏洩していました。これは同一オリジンポリシー違反であり、ユーザーがロードした URL のデータが盗まれる可能性があります。(CVE-2017-7830)

  - セキュリティラッパーが、プロキシオブジェクト上の非推奨の <code>exposedProps</code> メカニズムを使用して、一部の漏洩したプロパティへのアクセスを拒否しない脆弱性。これらのプロパティは、プロキシオブジェクトでは明示的に使用できないようにする必要があります。(CVE-2017-7831)

  - 文字「i」と Unicode の潜在的なアクセント (鋭アクセントや重アクセントなど) を組み合わせた単一文字バージョンは、ほとんどのフォントセットで、2 番目の文字として同じアクセントが続くドットなしバージョンの「i」によって、アドレスバーで偽装される可能性があります。これらの組み合わせドメイン名が punycode として表示されないため、ドメインのなりすまし攻撃が可能になります。(CVE-2017-7832)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 Windows 主機上安裝的 Firefox 版本是 57.0 之前版本。因此，該應用程式受到 mfsa2017-24 公告中提及的多個弱點影響。

  - Mozilla 開發人員和社群成員 Boris Zbarsky、Carsten Book、Christian Holler、Byron Campen、Jan de Mooij、Jason Kratzer、Jesse Schwartzentruber、Marcia Knous、Randell Jesup、Tyson Smith 和 Ting-Yu Chou 報告 Firefox 56 中存在記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-7827)

  - 由於 <code>PressShell</code> 物件在仍然使用中遭到釋放，因此可能在清空和調整版面配置大小時發生釋放後使用弱點。這樣會在上述作業期間造成可能遭惡意利用的當機。(CVE-2017-7828)

  - Resource Timing API 錯誤地洩漏跨來源 iframe 的導覽。這是同源原則違規，可能導致使用者載入的 URL 資料遭竊。(CVE-2017-7830)

  - 安全性包裝函式不會拒絕使用 Proxy 物件上不建議使用的 <code>exposeProps</code> 機制存取某些公開內容的弱點。這些內容應該明確不可用於 Proxy 物件。(CVE-2017-7831)

  - 在多數的字型集中，可以透過在網址列中使用無點的「i」字母，並在第二個字元後面跟著相同的重音符號，偽造字母「i」與 Unicode 中任何可能的重音符號 (例如銳音符或重音符) 的組合、單一字元版本。因為這些合併的網域名稱不會顯示為 punycode，這樣可能會允許網域偽造攻擊。(CVE-2017-7832)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Windows 主机上安装的 Firefox 版本低于 57.0。因此，该应用程序受到 mfsa2017-24 公告中提及的多个漏洞影响。

  - Mozilla 开发人员和社区成员 Boris Zbarsky、Carsten Book、Christian Holler、Byron Campen、Jan de Mooij、Jason Kratzer、Jesse Schwartzentruber、Marcia Knous、Randell Jesup、Tyson Smith 和 Ting-Yu Chou 报告 Firefox 56 中存在内存安全缺陷。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。(CVE-2017-7827)

  - 刷新和调整布局大小时出现释放后使用漏洞，原因在于 <code>PressShell</code> 对象在仍然使用时已经释放。这会导致在此类操作中造成潜在可利用的崩溃。(CVE-2017-7828)

  - Resource Timing API 错误显示了跨源 iframe 中的导航。这是同源策略违规，可能导致用户加载的 URL 数据遭窃。(CVE-2017-7830)

  - 存在一个漏洞，即安全封装程序未使用代理对象中已弃用的 <code>ExposureProps</code> 机制来拒绝访问某些已暴露的属性。这些属性应对代理对象明确不可用。(CVE-2017-7831)

  - 在大多数字体集中，Unicode 中字母“i”与任意重音符号 (例如尖音或重音) 组合而成的单个字符，都可以通过无点“i”后接相同重音符号的独立字符形式在地址栏中进行仿冒。这些组合域名不会显示为 punycode，因此会招致域欺骗攻击。(CVE-2017-7832)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 57.0。因此，该应用程序受到 mfsa2017-24 公告中提及的多个漏洞影响。

  - Mozilla 开发人员和社区成员 Boris Zbarsky、Carsten Book、Christian Holler、Byron Campen、Jan de Mooij、Jason Kratzer、Jesse Schwartzentruber、Marcia Knous、Randell Jesup、Tyson Smith 和 Ting-Yu Chou 报告 Firefox 56 中存在内存安全缺陷。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。(CVE-2017-7827)

  - 刷新和调整布局大小时出现释放后使用漏洞，原因在于 <code>PressShell</code> 对象在仍然使用时已经释放。这会导致在此类操作中造成潜在可利用的崩溃。(CVE-2017-7828)

  - Resource Timing API 错误显示了跨源 iframe 中的导航。这是同源策略违规，可能导致用户加载的 URL 数据遭窃。(CVE-2017-7830)

  - 存在一个漏洞，即安全封装程序未使用代理对象中已弃用的 <code>ExposureProps</code> 机制来拒绝访问某些已暴露的属性。这些属性应对代理对象明确不可用。(CVE-2017-7831)

  - 在大多数字体集中，Unicode 中字母“i”与任意重音符号 (例如尖音或重音) 组合而成的单个字符，都可以通过无点“i”后接相同重音符号的独立字符形式在地址栏中进行仿冒。这些组合域名不会显示为 punycode，因此会招致域欺骗攻击。(CVE-2017-7832)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox ESR 版本低于 52.5。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可遭利用的崩溃。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 57。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可遭利用的应用程序崩溃。

Mozilla Foundation reports :

CVE-2017-7828: Use-after-free of PressShell while restyling layout

CVE-2017-7830: Cross-origin URL information leak through Resource Timing API

CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects

CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers

CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters

CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections

CVE-2017-7835: Mixed content blocking incorrectly applies with redirects

CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X

CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies

CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN

CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism

CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags

CVE-2017-7842: Referrer Policy is not always respected for <link> elements

CVE-2017-7827: Memory safety bugs fixed in Firefox 57

CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.5. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 57. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable application crashes.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 57.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-24 advisory.

  - Mozilla developers and community members Boris Zbarsky, Carsten Book, Christian Holler, Byron Campen, Jan     de Mooij, Jason Kratzer, Jesse Schwartzentruber, Marcia Knous, Randell Jesup, Tyson Smith, and Ting-Yu     Chou reported memory safety bugs present in Firefox 56. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort that some of these could be exploited to run arbitrary     code. (CVE-2017-7827)

  - A use-after-free vulnerability can occur when flushing and resizing layout because the     <code>PressShell</code> object has been freed while still in use. This results in a potentially     exploitable crash during these operations. (CVE-2017-7828)

  - The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin     policy violation and could allow for data theft of URLs loaded by users. (CVE-2017-7830)

  - A vulnerability where the security wrapper does not deny access to some exposed properties using the     deprecated <code>exposedProps</code> mechanism on proxy objects. These properties should be explicitly     unavailable to proxy objects. (CVE-2017-7831)

  - The combined, single character, version of the letter 'i' with any of the potential accents in unicode,     such as acute or grave, can be spoofed in the addressbar by the dotless version of 'i' followed by the     same accent as a second character with most font sets. This allows for domain spoofing attacks because     these combined domain names do not display as punycode. (CVE-2017-7832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端 macOS 或 Mac OS X 主機上安裝的 Firefox 版本低於 57.0。因此，該應用程式受到 mfsa2017-24 公告中提及的多個弱點影響。

  - Mozilla 開發人員和社群成員 Boris Zbarsky、Carsten Book、Christian Holler、Byron Campen、Jan de Mooij、Jason Kratzer、Jesse Schwartzentruber、Marcia Knous、Randell Jesup、Tyson Smith 和 Ting-Yu Chou 報告 Firefox 56 中存在記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-7827)

  - 由於 <code>PressShell</code> 物件在仍然使用中遭到釋放，因此可能在清空和調整版面配置大小時發生釋放後使用弱點。這樣會在上述作業期間造成可能遭惡意利用的當機。(CVE-2017-7828)

  - Resource Timing API 錯誤地洩漏跨來源 iframe 的導覽。這是同源原則違規，可能導致使用者載入的 URL 資料遭竊。(CVE-2017-7830)

  - 安全性包裝函式不會拒絕使用 Proxy 物件上不建議使用的 <code>exposeProps</code> 機制存取某些公開內容的弱點。這些內容應該明確不可用於 Proxy 物件。(CVE-2017-7831)

  - 在多數的字型集中，可以透過在網址列中使用無點的「i」字母，並在第二個字元後面跟著相同的重音符號，偽造字母「i」與 Unicode 中任何可能的重音符號 (例如銳音符或重音符) 的組合、單一字元版本。因為這些合併的網域名稱不會顯示為 punycode，這樣可能會允許網域偽造攻擊。(CVE-2017-7832)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 macOS 或 Mac OS X 主機上安裝的 Mozilla Firefox ESR 版本比 52.5 舊。因此受到多個弱點影響，其中有些允許程式碼執行並可能遭惡意利用而當機。

遠端 macOS 或 Mac OS X 主機上安裝的 Mozilla Firefox 版本比 57 版舊。因此受到多個弱點影響，其中有些允許程式碼執行並可能遭惡意利用而使應用程式損毀。

Mozilla Foundation による報告：

CVE-2017-7828:レイアウトのスタイル変更中のPressShellのメモリ解放後使用（Use After Free）

CVE-2017-7830:リソースタイミングAPIを介したクロスオリジンURL情報漏洩

CVE-2017-7831:JavaScriptプロキシオブジェクトに関して公開されたプロパティの情報漏洩

CVE-2017-7832:点のない「i」の文字とそれに続くアクセントマーカーの使用を介したドメインスプーフィング

CVE-2017-7833:アラビア語およびインド語の母音マーカー文字を使用したドメインスプーフィング

CVE-2017-7834: data: URLが新しいタブで開かれ、CSP保護がバイパスされる

CVE-2017-7835:混合コンテンツのブロックがリダイレクトで不適切に適用される

CVE-2017-7836:LinuxとOS XでPingsenderがlibcurlを動的にロードする

CVE-2017-7837:<img>としてロードされたSVGでメタタグを使用してCookieを設定できる

CVE-2017-7838:国際ドメイン名内のラベルの個別のデコードに失敗して、IDN全体のpunycode表示がトリガーされる

CVE-2017-7839:javascript: URLの前の制御文字がセルフXSS回避メカニズムを無効にする

CVE-2017-7840:エクスポートされたブックマークが、ユーザーが指定したタグからスクリプト要素を削除しない

CVE-2017-7842:リファラーポリシーが<link>要素で常に尊重されるとは限らない

CVE-2017-7827:Firefox 57で修正されたメモリ安全性に関するバグ

CVE-2017-7826:Firefox 57とFirefox ESR 52.5で修正されたメモリ安全性に関するバグ

リモートのmacOSまたはMac OS XホストにインストールされているMozilla Firefox ESRのバージョンは52.5より前です。したがって、コードの実行を許す脆弱性や悪用可能なクラッシュを引き起こす脆弱性など、複数の脆弱性の影響を受けます。

リモートのmacOSまたはMac OS XホストにインストールされているMozilla Firefoxのバージョンは57より前です。したがって、コードの実行や悪用可能なアプリケーションのクラッシュを引き起こすなど、複数の脆弱性の影響を受けます。

リモートの macOS または Mac OS X ホストにインストールされている Firefox のバージョンは、57.0 より前のものです。したがって、mfsa2017-24 アドバイザリに記載されている複数の脆弱性の影響を受けます。

  - Mozilla 開発者およびコミュニティメンバーの Boris Zbarsky 氏、Carsten Book 氏、Christian Holler 氏、Byron Campen 氏、Jan de Mooij 氏、Jason Kratzer 氏、Jesse Schwartzentruber 氏、Marcia Knous 氏、Randell Jesup 氏、Tyson Smith 氏、Ting-Yu Chou 氏は、Firefox 56 に存在するメモリ安全性のバグを報告しました。これらのバグの一部にはメモリ破損の証拠が示されており、当社では、十分な労力をもってすればこれらの一部を悪用し、任意のコードを実行することが可能であると推測しています。(CVE-2017-7827)

  - <code>PressShell</code> オブジェクトが使用中に解放されているため、レイアウトをフラッシュおよびサイズ変更する際に、メモリ解放後使用 (Use-After-Free) の脆弱性が発生する可能性があります。これにより、これらの操作中に悪用可能なクラッシュが引き起こされる可能性があります。(CVE-2017-7828)

  - Resource Timing API が、クロスオリジン iframe のナビゲーションを不適切に漏洩していました。これは同一オリジンポリシー違反であり、ユーザーがロードした URL のデータが盗まれる可能性があります。(CVE-2017-7830)

  - セキュリティラッパーが、プロキシオブジェクト上の非推奨の <code>exposedProps</code> メカニズムを使用して、一部の漏洩したプロパティへのアクセスを拒否しない脆弱性。これらのプロパティは、プロキシオブジェクトでは明示的に使用できないようにする必要があります。(CVE-2017-7831)

  - 文字「i」と Unicode の潜在的なアクセント (鋭アクセントや重アクセントなど) を組み合わせた単一文字バージョンは、ほとんどのフォントセットで、2 番目の文字として同じアクセントが続くドットなしバージョンの「i」によって、アドレスバーで偽装される可能性があります。これらの組み合わせドメイン名が punycode として表示されないため、ドメインのなりすまし攻撃が可能になります。(CVE-2017-7832)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Versions of Mozilla Firefox earlier than 57 are unpatched for the following vulnerabilities :

 - A race condition exists in 'dom/media/systemservices/MediaParent.cpp' that is triggered when getting deviceId keys. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/proxy/DeadObjectProxy.cpp' that is triggered when handling object proxies. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'xpcom/threads/SystemGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'nr_transport_addr_fmt_ifname_addr_string()' function in 'media/mtransport/third_party/nICEr/src/net/transport_addr.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a stack-based buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GPUProcessHost::OnChannelClosed()' function in 'gfx/ipc/GPUProcessHost.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'gfx/layers/AtomicRefCountedWithFinalize.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NewReactionRecord()' function in 'js/src/builtin/Promise.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'VerifyCMSDetachedSignatureIncludingCertificate()' function in 'security/manager/ssl/nsDataSignatureVerifier.cpp' that is triggered when handling PKCS#7 signedData content. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ContainerLayerComposite::mPrepared()' function in 'gfx/layers/composite/ContainerLayerComposite.cpp' that is triggered when handling layers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MArgumentsLength::computeRange()' function in 'js/src/jit/RangeAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'widget/windows/AudioSession.cpp' that is triggered when handling AudioSession objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when handling WebGL texture images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocShell::~nsDocShell()' function in 'docshell/base/nsDocShell.cpp' that is triggered when notifying observers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'CleanupOSFileConstants()' function in 'dom/system/OSFileConstants.cpp' related to use of uninitialized memory. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ApplicationReputationService::~ApplicationReputationService()' function in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered as certain pointers are not properly cleared. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EnumerableOwnProperties()' function in 'js/src/builtin/Object.cpp' that is triggered when rooting objects. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'CompositorBridgeChild::RecvDidComposite()' function in 'gfx/layers/ipc/CompositorBridgeChild.cpp' that is triggered when handling texture pools. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsViewManager::~nsViewManager()' function in 'view/nsViewManager.cpp' that is triggered as the PresShell object is not properly handled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TLSFilterTransaction::Close()' function in 'netwerk/protocol/http/TunnelUtils.cpp' that is triggered as timers are not properly handled when a transaction is canceled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EventStateManager::DispatchCrossProcessEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling drag events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling properties of adopted nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'PropertyReadNeedsTypeBarrier()' function in 'jit/MIR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A logic flaw exists in the 'IsMarkedBlack()' function in 'js/src/gc/Barrier.cpp' that is triggered during gray marking asserts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that triggered when flushing and resizing the layout, which may cause the PressShell object to be freed while still in use. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as navigations in cross-origin iframes are revealed. Using the Resource Timing API, a context-dependent attacker to gain access to cross-origin URL information.
 - A flaw exists that is triggered as the security wrapper fails to deny access to certain exposed properties using the deprecated exposedProps mechanism on proxy objects. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of the combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave. This combinations do not display properly in punycode. With a specially crafted domain including a dotless version of  'i', a context-dependent attacker can spoof a domain.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of Arabic and Indic vowel marker characters that are combined with Latin characters in a domain name, which can cause the non-latin characters to be eclipsed in the address bar. This may allow a context-dependent attacker to spoof a domain.
 - A flaw exists that is triggered as data: URLs loaded into new tabs do not properly inherit the Content Security Policy (CSP) of the original page. This may allow a context-dependent attacker to bypass protection mechanisms.
 - A flaw exists in the 'nsMixedContentBlocker::AsyncOnChannelRedirect()' function in 'dom/security/nsMixedContentBlocker.cpp' that is triggered as mixed content blocking was not properly applied to resources when being redirected from an HTTPS environment to an HTTP environment. This may allow a context-dependent attacker to bypass restricts and load blocked content on pages.
 - A flaw exists in the 'CurlWrapper::Init()' function in 'toolkit/components/telemetry/pingsender/pingsender_unix_common.cpp' that is triggered as it fails to validate the libcurl library before loading it. This may allow a local attacker to replace libcurl files and gain elevated privileges.
 - A flaw exists in the 'nsContentSink::ProcessMETATag()' function in 'dom/base/nsContentSink.cpp' that is triggered during the handling of <meta> tags in SVG passed via <img> tags. This may allow a context-dependent attacker to set cookies for a page.
 - A flaw exists in 'netwerk/dns/nsIDNService.cpp' that is triggered as Punycode format text is not properly displayed in international domain names when triggered by a sub-domain. This may allow a context-dependent attacker to conduct a limited spoofing attack.
 - A flaw exists in the 'stripUnsafeProtocolOnPaste()' function in 'base/content/browser.js' that is triggered during the handling of control characters before javascript: URLs. This may allow a context-dependent attacker to bypass self-XSS protection mechanisms.
 - A flaw exists in the '_writeItem()' function in 'toolkit/components/places/BookmarkHTMLUtils.jsm' that allows a cross-site scripting (self-XSS) attack. This flaw exists exists because the program does not validate input to exported bookmarks before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in their own browser.
 - A flaw exists that is triggered as the referrer policy is not always honored when handling <link> elements. This may allow a context-dependent attacker to bypass the referrer policy.
 - A flaw exists in the 'PerDocumentStyleDataImpl::visited_styles_enabled()' function in 'servo/components/style/gecko/data.rs'. The issue is triggered when handling the CSS ':visited' selector for a document being used as an SVG image. With a specially crafted web page, a context-dependent attacker disclose visited history information.
 - A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode.
 - An overflow condition exists that is triggered as certain input is not properly validated when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during conditional branches handling out-of-bounds checks. Using a vulnerable code pattern, or a JIT engine or interpreter to generate such a pattern, an attacker can perform a Flush+Reload or Evict+Reload side-channel attack on the cache and disclose parts of the privileged kernel memory.
 - A flaw exists in the fundamental design related to out-of-order process execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached before exceptions are raised for restricted memory access. Using transient instructions in combination with a Flush+Reload side-channel attack a local attacker can disclose parts of the privileged kernel memory.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
104638	Mozilla Firefox < 57.0	Nessus	Windows	2017/11/16	2025/11/18	critical
104638	Mozilla Firefox < 57.0	Nessus	Windows	2017/11/16	2025/11/18	critical
104638	Mozilla Firefox < 57.0	Nessus	Windows	2017/11/16	2025/11/18	critical
104638	Mozilla Firefox < 57.0	Nessus	Windows	2017/11/16	2025/11/18	critical
275659	Mozilla Firefox < 57.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
104635	Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2025/11/14	critical
104636	Mozilla Firefox < 57 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2025/11/14	critical
104564	FreeBSD : mozilla -- multiple vulnerabilities (f78eac48-c3d1-4666-8de5-63ceea25a578)	Nessus	FreeBSD Local Security Checks	2017/11/15	2025/11/14	critical
104635	Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2025/11/14	critical
104636	Mozilla Firefox < 57 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2025/11/14	critical
275659	Mozilla Firefox < 57.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
275659	Mozilla Firefox < 57.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
104635	Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2025/11/14	critical
104636	Mozilla Firefox < 57 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2025/11/14	critical
104564	FreeBSD: mozilla -- 複数の脆弱性（f78eac48-c3d1-4666-8de5-63ceea25a578）	Nessus	FreeBSD Local Security Checks	2017/11/15	2025/11/14	critical
104635	Mozilla Firefox ESR < 52.5の複数の脆弱性（macOS）	Nessus	MacOS X Local Security Checks	2017/11/16	2025/11/14	critical
104636	Mozilla Firefox < 57の複数の脆弱性（macOS）	Nessus	MacOS X Local Security Checks	2017/11/16	2025/11/14	critical
275659	Mozilla Firefox < 57.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
700322	Mozilla Firefox < 57 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical