Mozilla Foundation reports :

CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data

CVE-2017-7844: Visited history information leak through SVG image

The version of Firefox installed on the remote Windows host is prior to 57.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-27 advisory.

  - When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB     and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this     stored data will persist across multiple private browsing mode sessions because it is not cleared when     exiting. (CVE-2017-7843)

  - A combination of an external SVG image referenced on a page and the coloring of anchor links stored within     this image can be used to determine which pages a user has in their history. This can allow a malicious     website to query user history.  Note: This issue only affects Firefox 57. Earlier releases are not     affected. (CVE-2017-7844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 57.0.1. It is, therefore, affected by multiple vulnerabilities.

Note: CVE-2017-7844 only affects version 57. Earlier releases are not affected.

リモートのmacOSまたはMac OS XホストにインストールされているMozilla Firefoxのバージョンは57.0.1より前です。したがって、複数の脆弱性による影響を受けます。注意：CVE-2017-7844は、バージョン57にのみ影響します。以前のリリースは影響を受けません。

Mozilla Foundation による報告：

CVE-2017-7843:プライベートブラウジングモードのWeb workerがIndexedDBデータを書き込む可能性があります

CVE-2017-7844:SVG画像からのアクセス履歴情報の漏洩

遠端 macOS 或 Mac OS X 主機上安裝的 Mozilla Firefox 版本比 57.0.1 版舊。因此，會受到多個弱點影響。請注意：CVE-2017-7844 僅影響 57 版。較舊版本不受影響。

远程 Windows 主机上安装的 Firefox 版本低于 57.0.1。因此受到公告 mfsa2017-27 中提及的多个漏洞的影响。

  - 使用隐私浏览模式时Web 工作线程可将持久性数据写入 IndexedDB 并成为唯一的用户指纹。IndexedDB 在隐私浏览模式中不应可用且此存储的数据将在多个隐私浏览模式会话中持续存在因为退出时未清除这些数据。 (CVE-2017-7843)

  - 页面上引用的外部 SVG 图像与此图像中存储的定位标记链接颜色的组合可用于确定用户的历史记录中有哪些页面。这可允许恶意网站查询用户历史记录。注意此问题仅影响 Firefox 57。较早的版本不受影响。 (CVE-2017-7844)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Windows 主機上安裝的 Firefox 版本是 57.0.1 之前版本。因此會受到 mfsa2017-27 公告中所提及的多個弱點影響。

  - 使用「隱私瀏覽」模式時web 背景工作可以將持續資料寫入 IndexedDB 並以唯一的方式指紋識別使用者。IndexedDB 不應在隱私瀏覽模式中使用且此儲存的資料將在多個隱私瀏覽模式工作階段中持續存在因為結束時並未將其清除。 (CVE-2017-7843)

  - 結合頁面上參照的外部 SVG 影像與儲存在此影像中之錨點連結的色彩時可用來判斷使用者的歷程記錄中擁有哪些頁面。這可允許惡意網站查詢使用者歷程記錄。注意︰此問題只會影響 Firefox 57。較舊的版本不受影響。 (CVE-2017-7844)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 57.0.1。因而会受到多个漏洞的影响。注意：CVE-2017-7844 仅影响 57 版本。较早的版本不受影响。

リモートの Windows ホストにインストールされている Firefox のバージョンは、57.0.1 より前です。したがって、mfsa2017-27アドバイザリに記載されているように、複数の脆弱性の影響を受けます。

  - プライベートブラウジングモードが使用されている場合、Web ワーカーは IndexedDB に永続データを書き込み、ユーザーを一意にフィンガープリントできるようになります。IndexedDBはプライベートブラウジングモードで利用できないはずで、この保存されたデータは終了時にクリアされないため、複数のプライベートブラウジングモードセッションにまたがって保持されます。CVE-2017-7843

  - ページで参照される外部 SVG 画像と、この画像内に保存されるアンカーリンクの色との組み合わせにより、ユーザーが履歴に存在するページを特定できます。これにより、悪意のある Web サイトがユーザー履歴をクエリする可能性があります。注: この問題の影響を受けるのは、Firefox 57 のみです。以前のリリースは影響を受けません。CVE-2017-7844

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 57.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-27 advisory.

  - When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB     and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this     stored data will persist across multiple private browsing mode sessions because it is not cleared when     exiting. (CVE-2017-7843)

  - A combination of an external SVG image referenced on a page and the coloring of anchor links stored within     this image can be used to determine which pages a user has in their history. This can allow a malicious     website to query user history.  Note: This issue only affects Firefox 57. Earlier releases are not     affected. (CVE-2017-7844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201802-03 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page, possibly resulting in the execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to perform Man-in-the-Middle attacks,       obtain sensitive information, spoof the address bar, conduct clickjacking       attacks, bypass security restrictions and protection mechanisms, or have       other unspecified impact.
  Workaround :

    There is no known workaround at this time.

リモートの macOS または Mac OS X ホストにインストールされている Firefox のバージョンは、57.0.1 より前のものです。したがって、mfsa2017-27アドバイザリに記載されているように、複数の脆弱性の影響を受けます。

  - プライベートブラウジングモードが使用されている場合、Web ワーカーは IndexedDB に永続データを書き込み、ユーザーを一意にフィンガープリントできるようになります。IndexedDBはプライベートブラウジングモードで利用できないはずで、この保存されたデータは終了時にクリアされないため、複数のプライベートブラウジングモードセッションにまたがって保持されます。CVE-2017-7843

  - ページで参照される外部 SVG 画像と、この画像内に保存されるアンカーリンクの色との組み合わせにより、ユーザーが履歴に存在するページを特定できます。これにより、悪意のある Web サイトがユーザー履歴をクエリする可能性があります。注: この問題の影響を受けるのは、Firefox 57 のみです。以前のリリースは影響を受けません。CVE-2017-7844

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートホストは、GLSA-201802-03（Mozilla Firefox：複数の脆弱性）で説明されている脆弱性に影響されています。複数の脆弱性がMozilla Firefoxで発見されています。詳細については、記載されているCVE識別番号を参照してください。影響：リモートの攻撃者が、ユーザーを誘導して特別に細工されたWebページを表示させる可能性があります。その結果、プロセスの権限で任意のコードが実行されたり、サービス拒否状態が引き起こされたりする可能性があります。さらに、リモートの攻撃者が、中間者攻撃を実行し、機密情報を取得し、アドレスバーを偽装し、クリックジャッキング攻撃を実施し、セキュリティ制限および保護メカニズムをバイパスし、その他の特定されていない影響を及ぼすことがあります。回避策：現時点では、既知の回避策はありません。

遠端 macOS 或 Mac OS X 主機上安裝的 Firefox 版本低於 57.0.1。因此會受到 mfsa2017-27 公告中所提及的多個弱點影響。

  - 使用「隱私瀏覽」模式時web 背景工作可以將持續資料寫入 IndexedDB 並以唯一的方式指紋識別使用者。IndexedDB 不應在隱私瀏覽模式中使用且此儲存的資料將在多個隱私瀏覽模式工作階段中持續存在因為結束時並未將其清除。 (CVE-2017-7843)

  - 結合頁面上參照的外部 SVG 影像與儲存在此影像中之錨點連結的色彩時可用來判斷使用者的歷程記錄中擁有哪些頁面。這可允許惡意網站查詢使用者歷程記錄。注意︰此問題只會影響 Firefox 57。較舊的版本不受影響。 (CVE-2017-7844)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機受到 GLSA-201802-03 中所述的弱點影響 (Mozilla Firefox：多個弱點) 在 Mozilla Firefox 中發現多個弱點。如需詳細資料，請檢閱提及的 CVE 識別碼。影響：遠端攻擊者可引誘使用者檢視特製的網頁，並可能以處理程序的權限來執行任意程式碼，或導致拒絕服務情形。此外，遠端攻擊者還可能發動攔截式攻擊、取得敏感資訊、偽造位址列、發動點擊劫持攻擊、繞過安全性限制和保護機制，或造成其他不明影響。因應措施：目前尚無已知的因應措施。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 57.0.1。因此受到公告 mfsa2017-27 中提及的多个漏洞的影响。

  - 使用隐私浏览模式时Web 工作线程可将持久性数据写入 IndexedDB 并成为唯一的用户指纹。IndexedDB 在隐私浏览模式中不应可用且此存储的数据将在多个隐私浏览模式会话中持续存在因为退出时未清除这些数据。 (CVE-2017-7843)

  - 页面上引用的外部 SVG 图像与此图像中存储的定位标记链接颜色的组合可用于确定用户的历史记录中有哪些页面。这可允许恶意网站查询用户历史记录。注意此问题仅影响 Firefox 57。较早的版本不受影响。 (CVE-2017-7844)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机受到 GLSA-201802-03 中所述漏洞的影响（Mozilla Firefox：多个漏洞）在 Mozilla Firefox 中发现多个漏洞。如需详细信息，请查看供参考的 CVE 标识符。影响：远程攻击者可诱骗用户查看特制网页，可能导致以进程的权限执行任意代码或拒绝服务情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、欺骗地址栏、执行点击劫持攻击、绕过安全限制和保护机制，或造成其他不明影响。解决方法：目前无任何已知的解决方法。

Versions of Mozilla Firefox earlier than 57.0.1 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'PerDocumentStyleDataImpl::visited_styles_enabled()' function in 'servo/components/style/gecko/data.rs'. The issue is triggered when handling the CSS ':visited' selector for a document being used as an SVG image. With a specially crafted web page, a context-dependent attacker disclose visited history information. (CVE-2017-7844)
 - A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode. (CVE-2017-7843)

Versions of Mozilla Firefox earlier than 57 are unpatched for the following vulnerabilities :

 - A race condition exists in 'dom/media/systemservices/MediaParent.cpp' that is triggered when getting deviceId keys. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/proxy/DeadObjectProxy.cpp' that is triggered when handling object proxies. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'xpcom/threads/SystemGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'nr_transport_addr_fmt_ifname_addr_string()' function in 'media/mtransport/third_party/nICEr/src/net/transport_addr.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a stack-based buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GPUProcessHost::OnChannelClosed()' function in 'gfx/ipc/GPUProcessHost.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'gfx/layers/AtomicRefCountedWithFinalize.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NewReactionRecord()' function in 'js/src/builtin/Promise.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'VerifyCMSDetachedSignatureIncludingCertificate()' function in 'security/manager/ssl/nsDataSignatureVerifier.cpp' that is triggered when handling PKCS#7 signedData content. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ContainerLayerComposite::mPrepared()' function in 'gfx/layers/composite/ContainerLayerComposite.cpp' that is triggered when handling layers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MArgumentsLength::computeRange()' function in 'js/src/jit/RangeAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'widget/windows/AudioSession.cpp' that is triggered when handling AudioSession objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when handling WebGL texture images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocShell::~nsDocShell()' function in 'docshell/base/nsDocShell.cpp' that is triggered when notifying observers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'CleanupOSFileConstants()' function in 'dom/system/OSFileConstants.cpp' related to use of uninitialized memory. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ApplicationReputationService::~ApplicationReputationService()' function in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered as certain pointers are not properly cleared. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EnumerableOwnProperties()' function in 'js/src/builtin/Object.cpp' that is triggered when rooting objects. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'CompositorBridgeChild::RecvDidComposite()' function in 'gfx/layers/ipc/CompositorBridgeChild.cpp' that is triggered when handling texture pools. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsViewManager::~nsViewManager()' function in 'view/nsViewManager.cpp' that is triggered as the PresShell object is not properly handled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TLSFilterTransaction::Close()' function in 'netwerk/protocol/http/TunnelUtils.cpp' that is triggered as timers are not properly handled when a transaction is canceled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EventStateManager::DispatchCrossProcessEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling drag events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling properties of adopted nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'PropertyReadNeedsTypeBarrier()' function in 'jit/MIR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A logic flaw exists in the 'IsMarkedBlack()' function in 'js/src/gc/Barrier.cpp' that is triggered during gray marking asserts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that triggered when flushing and resizing the layout, which may cause the PressShell object to be freed while still in use. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as navigations in cross-origin iframes are revealed. Using the Resource Timing API, a context-dependent attacker to gain access to cross-origin URL information.
 - A flaw exists that is triggered as the security wrapper fails to deny access to certain exposed properties using the deprecated exposedProps mechanism on proxy objects. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of the combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave. This combinations do not display properly in punycode. With a specially crafted domain including a dotless version of  'i', a context-dependent attacker can spoof a domain.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of Arabic and Indic vowel marker characters that are combined with Latin characters in a domain name, which can cause the non-latin characters to be eclipsed in the address bar. This may allow a context-dependent attacker to spoof a domain.
 - A flaw exists that is triggered as data: URLs loaded into new tabs do not properly inherit the Content Security Policy (CSP) of the original page. This may allow a context-dependent attacker to bypass protection mechanisms.
 - A flaw exists in the 'nsMixedContentBlocker::AsyncOnChannelRedirect()' function in 'dom/security/nsMixedContentBlocker.cpp' that is triggered as mixed content blocking was not properly applied to resources when being redirected from an HTTPS environment to an HTTP environment. This may allow a context-dependent attacker to bypass restricts and load blocked content on pages.
 - A flaw exists in the 'CurlWrapper::Init()' function in 'toolkit/components/telemetry/pingsender/pingsender_unix_common.cpp' that is triggered as it fails to validate the libcurl library before loading it. This may allow a local attacker to replace libcurl files and gain elevated privileges.
 - A flaw exists in the 'nsContentSink::ProcessMETATag()' function in 'dom/base/nsContentSink.cpp' that is triggered during the handling of <meta> tags in SVG passed via <img> tags. This may allow a context-dependent attacker to set cookies for a page.
 - A flaw exists in 'netwerk/dns/nsIDNService.cpp' that is triggered as Punycode format text is not properly displayed in international domain names when triggered by a sub-domain. This may allow a context-dependent attacker to conduct a limited spoofing attack.
 - A flaw exists in the 'stripUnsafeProtocolOnPaste()' function in 'base/content/browser.js' that is triggered during the handling of control characters before javascript: URLs. This may allow a context-dependent attacker to bypass self-XSS protection mechanisms.
 - A flaw exists in the '_writeItem()' function in 'toolkit/components/places/BookmarkHTMLUtils.jsm' that allows a cross-site scripting (self-XSS) attack. This flaw exists exists because the program does not validate input to exported bookmarks before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in their own browser.
 - A flaw exists that is triggered as the referrer policy is not always honored when handling <link> elements. This may allow a context-dependent attacker to bypass the referrer policy.
 - A flaw exists in the 'PerDocumentStyleDataImpl::visited_styles_enabled()' function in 'servo/components/style/gecko/data.rs'. The issue is triggered when handling the CSS ':visited' selector for a document being used as an SVG image. With a specially crafted web page, a context-dependent attacker disclose visited history information.
 - A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode.
 - An overflow condition exists that is triggered as certain input is not properly validated when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during conditional branches handling out-of-bounds checks. Using a vulnerable code pattern, or a JIT engine or interpreter to generate such a pattern, an attacker can perform a Flush+Reload or Evict+Reload side-channel attack on the cache and disclose parts of the privileged kernel memory.
 - A flaw exists in the fundamental design related to out-of-order process execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached before exceptions are raised for restricted memory access. Using transient instructions in combination with a Flush+Reload side-channel attack a local attacker can disclose parts of the privileged kernel memory.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
105026	FreeBSD : mozilla -- multiple vulnerabilities (b7e23050-2d5d-4e61-9b48-62e89db222ca)	Nessus	FreeBSD Local Security Checks	2017/12/6	2025/11/12	high
105040	Mozilla Firefox < 57.0.1	Nessus	Windows	2017/12/6	2025/11/18	high
105039	Mozilla Firefox < 57.0.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/12/6	2025/11/12	high
105039	Mozilla Firefox < 57.0.1の複数の脆弱性（macOS）	Nessus	MacOS X Local Security Checks	2017/12/6	2025/11/12	high
105026	FreeBSD: mozilla -- 複数の脆弱性（b7e23050-2d5d-4e61-9b48-62e89db222ca）	Nessus	FreeBSD Local Security Checks	2017/12/6	2025/11/12	high
105039	Mozilla Firefox < 57.0.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/12/6	2025/11/12	high
105040	Mozilla Firefox < 57.0.1	Nessus	Windows	2017/12/6	2025/11/18	high
105040	Mozilla Firefox < 57.0.1	Nessus	Windows	2017/12/6	2025/11/18	high
105039	Mozilla Firefox < 57.0.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/12/6	2025/11/12	high
105040	Mozilla Firefox < 57.0.1	Nessus	Windows	2017/12/6	2025/11/18	high
275696	Mozilla Firefox < 57.0.1	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	high
106884	GLSA-201802-03 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/2/20	2025/10/29	critical
275696	Mozilla Firefox < 57.0.1	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	high
106884	GLSA-201802-03：Mozilla Firefox：複数の脆弱性	Nessus	Gentoo Local Security Checks	2018/2/20	2025/10/29	critical
275696	Mozilla Firefox < 57.0.1	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	high
106884	GLSA-201802-03：Mozilla Firefox：多個弱點	Nessus	Gentoo Local Security Checks	2018/2/20	2025/10/29	critical
275696	Mozilla Firefox < 57.0.1	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	high
106884	GLSA-201802-03：Mozilla Firefox：多个漏洞	Nessus	Gentoo Local Security Checks	2018/2/20	2025/10/29	critical
700323	Mozilla Firefox < 57.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	low
700322	Mozilla Firefox < 57 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

critical

high

critical

high

critical

high

critical

low

critical