The Mozilla Firefox was updated to the new ESR 52.2 release, which fixes the following issues (bsc#1043960) :

  - MFSA 2017-16/CVE-2017-7758 Out-of-bounds read in Opus     encoder

  - MFSA 2017-16/CVE-2017-7749 Use-after-free during     docshell reloading

  - MFSA 2017-16/CVE-2017-7751 Use-after-free with content     viewer listeners

  - MFSA 2017-16/CVE-2017-5472 Use-after-free using     destroyed node when regenerating trees

  - MFSA 2017-16/CVE-2017-5470 Memory safety bugs fixed in     Firefox 54 and Firefox ESR 52.2

  - MFSA 2017-16/CVE-2017-7752 Use-after-free with IME input

  - MFSA 2017-16/CVE-2017-7750 Use-after-free with track     elements

  - MFSA 2017-16/CVE-2017-7768 32 byte arbitrary file read     through Mozilla Maintenance Service

  - MFSA 2017-16/CVE-2017-7778 Vulnerabilities in the     Graphite 2 library

  - MFSA 2017-16/CVE-2017-7754 Out-of-bounds read in WebGL     with ImageInfo object

  - MFSA 2017-16/CVE-2017-7755 Privilege escalation through     Firefox Installer with same directory DLL files

  - MFSA 2017-16/CVE-2017-7756 Use-after-free and     use-after-scope logging XHR header errors

  - MFSA 2017-16/CVE-2017-7757 Use-after-free in IndexedDB

  - MFSA 2017-16/CVE-2017-7761 File deletion and privilege     escalation through Mozilla Maintenance Service     helper.exe application

  - MFSA 2017-16/CVE-2017-7763 Mac fonts render some unicode     characters as spaces

  - MFSA 2017-16/CVE-2017-7765 Mark of the Web bypass when     saving executable files

  - MFSA 2017-16/CVE-2017-7764 (bmo#1364283,     bmo#http://www.unicode.org/reports/tr31/tr31-26     .html#Aspirational_Use_Scripts) Domain spoofing with     combination of Canadian Syllabics and other unicode     blocks

  - update to Firefox ESR 52.1 (bsc#1035082)

  - MFSA 2017-12/CVE-2016-10196 Vulnerabilities in Libevent     library

  - MFSA 2017-12/CVE-2017-5443 Out-of-bounds write during     BinHex decoding

  - MFSA 2017-12/CVE-2017-5429 Memory safety bugs fixed in     Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1

  - MFSA 2017-12/CVE-2017-5464 Memory corruption with     accessibility and DOM manipulation

  - MFSA 2017-12/CVE-2017-5465 Out-of-bounds read in     ConvolvePixel

  - MFSA 2017-12/CVE-2017-5466 Origin confusion when     reloading isolated data:text/html URL

  - MFSA 2017-12/CVE-2017-5467 Memory corruption when     drawing Skia content

  - MFSA 2017-12/CVE-2017-5460 Use-after-free in frame     selection

  - MFSA 2017-12/CVE-2017-5461 Out-of-bounds write in Base64     encoding in NSS

  - MFSA 2017-12/CVE-2017-5448 Out-of-bounds write in     ClearKeyDecryptor

  - MFSA 2017-12/CVE-2017-5449 Crash during bidirectional     unicode manipulation with animation

  - MFSA 2017-12/CVE-2017-5446 Out-of-bounds read when     HTTP/2 DATA frames are sent with incorrect data

  - MFSA 2017-12/CVE-2017-5447 Out-of-bounds read during     glyph processing

  - MFSA 2017-12/CVE-2017-5444 Buffer overflow while parsing     application/http-index-format content

  - MFSA 2017-12/CVE-2017-5445 Uninitialized values used     while parsing application/http- index-format content

  - MFSA 2017-12/CVE-2017-5442 Use-after-free during style     changes

  - MFSA 2017-12/CVE-2017-5469 Potential Buffer overflow in     flex-generated code

  - MFSA 2017-12/CVE-2017-5440 Use-after-free in     txExecutionState destructor during XSLT processing

  - MFSA 2017-12/CVE-2017-5441 Use-after-free with selection     during scroll events

  - MFSA 2017-12/CVE-2017-5439 Use-after-free in nsTArray     Length() during XSLT processing

  - MFSA 2017-12/CVE-2017-5438 Use-after-free in nsAutoPtr     during XSLT processing

  - MFSA 2017-12/CVE-2017-5436 Out-of-bounds write with     malicious font in Graphite 2

  - MFSA 2017-12/CVE-2017-5435 Use-after-free during     transaction processing in the editor

  - MFSA 2017-12/CVE-2017-5434 Use-after-free during focus     handling

  - MFSA 2017-12/CVE-2017-5433 Use-after-free in SMIL     animation functions

  - MFSA 2017-12/CVE-2017-5432 Use-after-free in text input     selection

  - MFSA 2017-12/CVE-2017-5430 Memory safety bugs fixed in     Firefox 53 and Firefox ESR 52.1

  - MFSA 2017-12/CVE-2017-5459 Buffer overflow in WebGL

  - MFSA 2017-12/CVE-2017-5462 DRBG flaw in NSS

  - MFSA 2017-12/CVE-2017-5455 Sandbox escape through     internal feed reader APIs

  - MFSA 2017-12/CVE-2017-5454 Sandbox escape allowing file     system read access through file picker

  - MFSA 2017-12/CVE-2017-5456 Sandbox escape allowing local     file system access

  - MFSA 2017-12/CVE-2017-5451 Addressbar spoofing with     onblur event

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 52.1.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5436, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448, CVE-2017-5449, CVE-2017-5451, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5459, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5467, CVE-2017-5469)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Mozilla developers and community, Nils, Holger Fuhrmannek, Atte Kettunen, Takeshi Terada, Huzaifa Sidhpurwala, Nicolas GrA(c)goire, Chamal De Silva, Chun Han Hsiao, Ivan Fratric of Google Project Zero, Anonymous working with Trend Micro's Zero Day Initiative, Haik Aftandilian, Paul Theriault, Julian Hector, Petr Cerny, Jordi Chancel, and Heather Miller of Google Skia team as the original reporters.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-12 advisory.

  - Fixed potential buffer overflows in generated Firefox code due to     [CVE-2016-6354](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6354) issue in Flex.
    (CVE-2017-5469)

  - A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in     an array are dropped from the animation controller while still in use. This results in a potentially     exploitable crash. (CVE-2017-5433)

  - A use-after-free vulnerability occurs during transaction processing in the editor during design mode     interactions. This results in a potentially exploitable crash. (CVE-2017-5435)

  - An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This     results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as     Mozilla products. (CVE-2017-5436)

  - An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due     to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The     NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated     with NSS version 3.28.4. (CVE-2017-5461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:1106 advisory.

    Mozilla Firefox is an open source web browser.

    This update upgrades Firefox to version 52.1.0 ESR.

    Security Fix(es):

    * Multiple flaws were found in the processing of malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the     user running Firefox. (CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434,     CVE-2017-5435, CVE-2017-5436, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441,     CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448,     CVE-2017-5449, CVE-2017-5451, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5459, CVE-2017-5460,     CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5467, CVE-2017-5469)

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Mozilla     developers and community, Nils, Holger Fuhrmannek, Atte Kettunen, Takeshi Terada, Huzaifa Sidhpurwala,     Nicolas Grgoire, Chamal De Silva, Chun Han Hsiao, Ivan Fratric of Google Project Zero, Anonymous working     with Trend Micro's Zero Day Initiative, Haik Aftandilian, Paul Theriault, Julian Hector, Petr Cerny, Jordi     Chancel, and Heather Miller of Google Skia team as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3260-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain     sensitive information, spoof the addressbar contents or other UI elements, escape the sandbox to read     local files, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash,     or execute arbitrary code. (CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434,     CVE-2017-5435, CVE-2017-5436, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441,     CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448,     CVE-2017-5449, CVE-2017-5451, CVE-2017-5453, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5458,     CVE-2017-5459, CVE-2017-5460, CVE-2017-5461, CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5467,     CVE-2017-5468, CVE-2017-5469)

    A flaw was discovered in the DRBG number generation in NSS. If an attacker were able to perform a machine-     in-the-middle attack, this flaw could potentially be exploited to view sensitive information.
    (CVE-2017-5462)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 53.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-10 advisory.

  - Fixed potential buffer overflows in generated Firefox code due to     [CVE-2016-6354](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6354) issue in Flex.
    (CVE-2017-5469)

  - A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in     an array are dropped from the animation controller while still in use. This results in a potentially     exploitable crash. (CVE-2017-5433)

  - A use-after-free vulnerability occurs during transaction processing in the editor during design mode     interactions. This results in a potentially exploitable crash. (CVE-2017-5435)

  - An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This     results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as     Mozilla products. (CVE-2017-5436)

  - An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due     to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The     NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with     NSS version 3.29.5. (CVE-2017-5461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2017-1636:03 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards     compliance, performance and portability.
    Security issues fixed with this release:
    CVE-2017-5429
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5430
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5432
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5433
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5434
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5435
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5436
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5437
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5438
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5439
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5440
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5441
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5442
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5443
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5444
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5445
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5446
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5447
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5448
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5449
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5451
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5454
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5455
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5456
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5459
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5460
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5464
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5465
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5466
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5467
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5469
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 52.1.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5436, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448, CVE-2017-5449, CVE-2017-5451, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5459, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5467, CVE-2017-5469)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Mozilla developers and community, Nils, Holger Fuhrmannek, Atte Kettunen, Takeshi Terada, Huzaifa Sidhpurwala, Nicolas Gregoire, Chamal De Silva, Chun Han Hsiao, Ivan Fratric of Google Project Zero, Anonymous working with Trend Micro's Zero Day Initiative, Haik Aftandilian, Paul Theriault, Julian Hector, Petr Cerny, Jordi Chancel, and Heather Miller of Google Skia team as the original reporters.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-1106 advisory.

    [52.1.0-2.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [52.1.0-2]
    - Update to 52.1.0 ESR (Build3)

    [52.1.0-1]
    - Update to 52.1.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox and mozilla-nss fixes the following issues: Security issues fixed :

  - Fixes in Firefox ESR 52.2 (bsc#1043960,MFSA 2017-16)

  - CVE-2017-7758: Out-of-bounds read in Opus encoder

  - CVE-2017-7749: Use-after-free during docshell reloading

  - CVE-2017-7751: Use-after-free with content viewer     listeners

  - CVE-2017-5472: Use-after-free using destroyed node when     regenerating trees

  - CVE-2017-5470: Memory safety bugs fixed in Firefox 54     and Firefox ESR 52.2

  - CVE-2017-7752: Use-after-free with IME input

  - CVE-2017-7750: Use-after-free with track elements

  - CVE-2017-7768: 32 byte arbitrary file read through     Mozilla Maintenance Service

  - CVE-2017-7778: Vulnerabilities in the Graphite 2 library

  - CVE-2017-7754: Out-of-bounds read in WebGL with     ImageInfo object

  - CVE-2017-7755: Privilege escalation through Firefox     Installer with same directory DLL files

  - CVE-2017-7756: Use-after-free and use-after-scope     logging XHR header errors

  - CVE-2017-7757: Use-after-free in IndexedDB

  - CVE-2017-7761: File deletion and privilege escalation     through Mozilla Maintenance Service helper.exe     application

  - CVE-2017-7763: Mac fonts render some unicode characters     as spaces

  - CVE-2017-7765: Mark of the Web bypass when saving     executable files

  - CVE-2017-7764: Domain spoofing with combination of     Canadian Syllabics and other unicode blocks

  - update to Firefox ESR 52.1 (bsc#1035082,MFSA 2017-12)

  - CVE-2016-10196: Vulnerabilities in Libevent library

  - CVE-2017-5443: Out-of-bounds write during BinHex     decoding

  - CVE-2017-5429: Memory safety bugs fixed in Firefox 53,     Firefox ESR 45.9, and Firefox ESR 52.1

  - CVE-2017-5464: Memory corruption with accessibility and     DOM manipulation

  - CVE-2017-5465: Out-of-bounds read in ConvolvePixel

  - CVE-2017-5466: Origin confusion when reloading isolated     data:text/html URL

  - CVE-2017-5467: Memory corruption when drawing Skia     content

  - CVE-2017-5460: Use-after-free in frame selection

  - CVE-2017-5461: Out-of-bounds write in Base64 encoding in     NSS

  - CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor

  - CVE-2017-5449: Crash during bidirectional unicode     manipulation with animation

  - CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA     frames are sent with incorrect data

  - CVE-2017-5447: Out-of-bounds read during glyph     processing

  - CVE-2017-5444: Buffer overflow while parsing     application/http-index-format content

  - CVE-2017-5445: Uninitialized values used while parsing     application/http- index-format content

  - CVE-2017-5442: Use-after-free during style changes

  - CVE-2017-5469: Potential Buffer overflow in     flex-generated code

  - CVE-2017-5440: Use-after-free in txExecutionState     destructor during XSLT processing

  - CVE-2017-5441: Use-after-free with selection during     scroll events

  - CVE-2017-5439: Use-after-free in nsTArray Length()     during XSLT processing

  - CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT     processing

  - CVE-2017-5436: Out-of-bounds write with malicious font     in Graphite 2

  - CVE-2017-5435: Use-after-free during transaction     processing in the editor

  - CVE-2017-5434: Use-after-free during focus handling

  - CVE-2017-5433: Use-after-free in SMIL animation     functions

  - CVE-2017-5432: Use-after-free in text input selection

  - CVE-2017-5430: Memory safety bugs fixed in Firefox 53     and Firefox ESR 52.1

  - CVE-2017-5459: Buffer overflow in WebGL

  - CVE-2017-5462: DRBG flaw in NSS

  - CVE-2017-5455: Sandbox escape through internal feed     reader APIs

  - CVE-2017-5454: Sandbox escape allowing file system read     access through file picker

  - CVE-2017-5456: Sandbox escape allowing local file system     access

  - CVE-2017-5451: Addressbar spoofing with onblur event

  - General

  - CVE-2015-5276: Fix for C++11 std::random_device short     reads (bsc#945842) Bugfixes :

  - workaround for Firefox hangs (bsc#1031485, bsc#1025108)

  - Update to gcc-5-branch head.

  - Includes fixes for (bsc#966220), (bsc#962765),     (bsc#964468), (bsc#939460), (bsc#930496), (bsc#930392)     and (bsc#955382).

  - Add fix to revert accidential libffi ABI breakage on     AARCH64. (bsc#968771)

  - Build s390[x] with --with-tune=z9-109 --with-arch=z900     on SLE11 again. (bsc#954002)

  - Fix libffi include install. (bsc#935510)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox. (CVE-2017-5429, CVE-2017-5430,     CVE-2017-5432, CVE-2017-5433, CVE-2017-5434,     CVE-2017-5435, CVE-2017-5436, CVE-2017-5438,     CVE-2017-5439, CVE-2017-5440,     CVE-2017-5441, CVE-2017-5442, CVE-2017-5443,     CVE-2017-5444, CVE-2017-5445, CVE-2017-5446,     CVE-2017-5447, CVE-2017-5448, CVE-2017-5449,     CVE-2017-5451, CVE-2017-5454, CVE-2017-5455,     CVE-2017-5456, CVE-2017-5459, CVE-2017-5460,     CVE-2017-5464, CVE-2017-5465, CVE-2017-5466,     CVE-2017-5467,     CVE-2017-5469,CVE-2016-10195,CVE-2016-10196,CVE-2016-10     197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox. (CVE-2017-5429, CVE-2017-5430,     CVE-2017-5432, CVE-2017-5433, CVE-2017-5434,     CVE-2017-5435, CVE-2017-5436,     CVE-2017-5438, CVE-2017-5439, CVE-2017-5440,     CVE-2017-5441, CVE-2017-5442, CVE-2017-5443,     CVE-2017-5444, CVE-2017-5445, CVE-2017-5446,     CVE-2017-5447, CVE-2017-5448, CVE-2017-5449,     CVE-2017-5451, CVE-2017-5454, CVE-2017-5455,     CVE-2017-5456, CVE-2017-5459, CVE-2017-5460,     CVE-2017-5464, CVE-2017-5465, CVE-2017-5466,     CVE-2017-5467,     CVE-2017-5469,CVE-2016-10195,CVE-2016-10196,CVE-2016-10     197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A mechanism to bypass file system access protections in the sandbox using the file system request     constructor through an IPC message. This allows for read and write access to the local file system. This     vulnerability affects Firefox ESR < 52.1 and Firefox < 53. (CVE-2017-5456)

Note that Nessus relies on the presence of the package as reported by the vendor.

Mozilla Foundation reports :

Please reference CVE/URL list for details

The version of Firefox ESR installed on the remote Windows host is prior to 52.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-12 advisory.

  - Fixed potential buffer overflows in generated Firefox code due to     [CVE-2016-6354](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6354) issue in Flex.
    (CVE-2017-5469)

  - A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in     an array are dropped from the animation controller while still in use. This results in a potentially     exploitable crash. (CVE-2017-5433)

  - A use-after-free vulnerability occurs during transaction processing in the editor during design mode     interactions. This results in a potentially exploitable crash. (CVE-2017-5435)

  - An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This     results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as     Mozilla products. (CVE-2017-5436)

  - An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due     to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The     NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated     with NSS version 3.28.4. (CVE-2017-5461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 53.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-10 advisory.

  - Fixed potential buffer overflows in generated Firefox code due to     [CVE-2016-6354](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6354) issue in Flex.
    (CVE-2017-5469)

  - A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in     an array are dropped from the animation controller while still in use. This results in a potentially     exploitable crash. (CVE-2017-5433)

  - A use-after-free vulnerability occurs during transaction processing in the editor during design mode     interactions. This results in a potentially exploitable crash. (CVE-2017-5435)

  - An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This     results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as     Mozilla products. (CVE-2017-5436)

  - An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due     to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The     NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with     NSS version 3.29.5. (CVE-2017-5461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101055	SUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2017:1669-1)	Nessus	SuSE Local Security Checks	2017/6/27	2025/12/15	critical
101457	Virtuozzo 7 : firefox (VZLSA-2017-1106)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	critical
275653	Mozilla Firefox ESR < 52.1	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
99572	RHEL 7 : firefox (RHSA-2017:1106)	Nessus	Red Hat Local Security Checks	2017/4/21	2025/3/21	critical
99626	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3260-1)	Nessus	Ubuntu Local Security Checks	2017/4/24	2024/8/27	critical
275671	Mozilla Firefox < 53.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
289401	MiracleLinux 7 : firefox-52.1.0-2.0.1.el7.AXS7 (AXSA:2017-1636:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
99539	CentOS 7 : firefox (CESA-2017:1106)	Nessus	CentOS Local Security Checks	2017/4/21	2025/12/25	critical
99565	Oracle Linux 7 : firefox (ELSA-2017-1106)	Nessus	Oracle Linux Local Security Checks	2017/4/21	2025/8/29	critical
102694	SUSE SLES11 Security Update : MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss (SUSE-SU-2017:2235-1)	Nessus	SuSE Local Security Checks	2017/8/23	2025/11/26	critical
100687	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1092)	Nessus	Huawei Local Security Checks	2017/6/9	2025/12/16	critical
100688	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1093)	Nessus	Huawei Local Security Checks	2017/6/9	2025/12/16	critical
221054	Linux Distros Unpatched Vulnerability : CVE-2017-5456	Nessus	Misc.	2025/3/4	2026/1/28	critical
99496	FreeBSD : mozilla -- multiple vulnerabilities (5e0a038a-ca30-416d-a2f5-38cbf5e7df33)	Nessus	FreeBSD Local Security Checks	2017/4/20	2025/12/25	critical
99631	Mozilla Firefox ESR < 52.1	Nessus	Windows	2017/4/24	2025/11/18	critical
99632	Mozilla Firefox < 53.0	Nessus	Windows	2017/4/24	2025/11/18	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical