遠端主機受到 GLSA-201605-06 中所述的弱點影響 (Mozilla 產品：多個弱點)

在 Firefox、NSS、NSPR 和 Thunderbird 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者還可能發動攔截式攻擊、取得敏感資訊、偽造位址列、發動點擊劫持攻擊、繞過安全性限制和保護機制，或造成其他不明影響。
 因應措施：

目前尚無已知的因應措施。

此 MozillaFirefox、mozilla-nspr、mozilla-nss 更新可修正下列問題：

Mozilla Firefox 已更新至 38.7.0 ESR 版 (bsc#969894)

- MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 其他記憶體安全危險 (rv:45.0 / rv:38.7)

- MFSA 2016-17/CVE-2016-1954 透過 CSP 報告發生的本機檔案覆寫問題和潛在的權限提升問題

- MFSA 2016-20/CVE-2016-1957 已修正在處理 MP4 期間刪除陣列時，libstagefright 中發生的記憶體洩漏情形。

- MFSA 2016-21/CVE-2016-1958 可覆寫顯示的頁面位址

- MFSA 2016-23/CVE-2016-1960 已修正 HTML5 字串剖析器中的釋放後使用問題。

- MFSA 2016-24/CVE-2016-1961 已修正 SetBody 中的釋放後使用問題。

- MFSA 2016-25/CVE-2016-1962 已修正使用多個 WebRTC 資料通道時的釋放後使用問題。

- MFSA 2016-27/CVE-2016-1964 已修正 XML 轉換期間的釋放後使用問題。

- MFSA 2016-28/CVE-2016-1965 已修正透過歷程記錄導覽與位置通訊協定內容造成的位址列偽造問題。

- MFSA 2016-31/CVE-2016-1966 已修正因惡意 NPAPI 外掛程式造成的記憶體損毀問題。

- MFSA 2016-34/CVE-2016-1974 已修正配置失敗後的 HTML 剖析器出現的超出邊界讀取問題。

- MFSA 2016-35/CVE-2016-1950 已修正在 NSS 中解碼 ASN.1 期間發生的緩衝區溢位。

- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 多種字型弱點已在內嵌 Graphite 2 程式庫中修正

Mozilla NSS 已更新，可修正：

- MFSA 2016-15/CVE-2016-1978 在記憶體不足的情況下，SSL 連線期間，NSS 中發生的釋放後使用問題

- MFSA 2016-35/CVE-2016-1950 NSS 中 ASN.1 解碼期間發生的緩衝區溢位問題

- MFSA 2016-36/CVE-2016-1979 處理 NSS 中的 DER 編碼金鑰期間發生的釋放後使用問題

Mozilla NSPR 已更新至 4.12 版 (bsc#969894)

- 已新增 PR_GetEnvSecure 函式，其會嘗試偵測程式是否正以提升的權限執行，如果偵測到便傳回 NULL。建議在一般目的程式庫程式碼中使用此函式。

- 已修正一個與 PR_*printf 函式相關的記憶體配置錯誤

- 已匯出 API PR_DuplicateEnvironment，其已在 NSPR 4.10.9 中新增

- 已新增 FreeBSD aarch64 的支援

- 數個次要正確性與相容性修正

- 在 mips 中啟用不可部分完成指令 (bmo#1129878)

- 修正以自訂堆疊大小建立執行緒時的 mips 宣告失敗 (bmo#1129968)

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

此更新包含 Mozilla Thunderbird 45.2。(boo#983549)

修正了多個安全性問題，這些問題大多會影響在瀏覽器內容中使用的電子郵件程式，例如檢視網頁或 HTMl 格式的電子郵件。

下列弱點已修正：

- CVE-2016-2818、CVE-2016-2815：記憶體安全性錯誤 (boo#983549、MFSA2016-49)

包含下列來自 45.1 版的安全性修正：
(boo#977333)

- CVE-2016-2806、CVE-2016-2807：其他記憶體安全性危險 (boo#977375、boo#977376、MFSA 2016-39)

包含下列來自 45.0 版的安全性修正：
(boo#969894)

- CVE-2016-1952、CVE-2016-1953：其他記憶體安全危險 (MFSA 2016-16)

- CVE-2016-1954：透過 CSP 報告發生的本機檔案覆寫和潛在的權限提升 (MFSA 2016-17)

- CVE-2016-1955：CSP 報告無法去除內嵌 iframe 頁面中的位置資訊 (MFSA 2016-18)

- CVE-2016-1956：Linux 視訊記憶體因 Intel 驅動程式而發生 DOS　(MFSA 2016-19)

- CVE-2016-1957：在處理 MP4 期間刪除陣列時　libstagefright 中發生的記憶體洩漏 (MFSA 2016-20)

- CVE-2016-1960：HTML5 字串剖析器中的釋放後使用 (MFSA 2016-23)

- CVE-2016-1961：SetBody 中的釋放後使用 (MFSA 2016-24)

- CVE-2016-1964：XML 轉換期間發生的釋放後使用 (MFSA 2016-27)

- CVE-2016-1974：配置失敗後的 HTML 剖析器中出現的超出邊界讀取 (MFSA 2016-34)

graphite 字型成形程式庫已停用，解決了下列字型弱點：

- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

包括下列追蹤套件變更：

- 修正 Leap 42.2 中使用的 gcc/binutils 組合之版本問題 (boo#984637)

- gcc6 修正　(boo#986162)

- 在 48 位元 va aarch64 上執行 (boo#984126)

在 Iceweasel（Debian 版本的 Mozilla Firefox Web 浏览器）中发现多个安全问题：多个内存安全错误、缓冲区溢出、释放后使用，以及可导致执行任意代码、拒绝服务、地址栏欺骗和覆盖本地文件的其他实现错误。

更新后的 Thunderbird 程序包修复了多个安全问题，现在可用于 Red Hat Enterprise Linux 5、6 和 7。

Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

Mozilla Thunderbird 是独立的邮件和新闻组客户端。

在对畸形 Web 内容的处理中发现多个缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。（CVE-2016-1952、CVE-2016-1954、CVE-2016-1957、CVE-2016-1960、CVE-2016-1961、CVE-2016-1974、CVE-2016-1964、CVE-2016-1966）

在 Thunderbird 随附的 graphite2 字体库中发现多个安全缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。
（CVE-2016-1977、CVE-2016-2790、CVE-2016-2791、CVE-2016-2792、CVE-2016-2793、CVE-2016-2794、CVE-2016-2795、CVE-2016-2796、CVE-2016-2797、CVE-2016-2798、CVE-2016-2799、CVE-2016-2800、CVE-2016-2801、CVE-2016-2802）

Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢这些问题的原始报告者 Bob Clary、Christoph Diehl、Christian Holler、Andrew McCreight、Daniel Holbert、Jesse Ruderman、Randell Jesup、Nicolas Golubovic、Jose Martinez、Romina Santillan、ca0nguyen、lokihardt、Nicolas Gregoire、GCHQ 下属 Communications Electronics Security Group (UK)、Holger Fuhrmannek、Ronald Crane 和 Tyson Smith。

有关这些缺陷的技术详细信息，请参阅针对 Thunderbird 38.7.0 的 Mozilla 安全公告。在本勘误表的“参考”部分可以找到 Mozilla 公告的链接。

所有 Thunderbird 用户都应升级这些更新后的程序包，其中包含已修正了这些问题的 Thunderbird 版本 38.7.0。
安装更新后，必须重新启动 Thunderbird 才能使更改生效。

来自 Red Hat 安全公告 2016:0460：

更新后的 Thunderbird 程序包修复了多个安全问题，现在可用于 Red Hat Enterprise Linux 5、6 和 7。

Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

Mozilla Thunderbird 是独立的邮件和新闻组客户端。

在对畸形 Web 内容的处理中发现多个缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。（CVE-2016-1952、CVE-2016-1954、CVE-2016-1957、CVE-2016-1960、CVE-2016-1961、CVE-2016-1974、CVE-2016-1964、CVE-2016-1966）

在 Thunderbird 随附的 graphite2 字体库中发现多个安全缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。
（CVE-2016-1977、CVE-2016-2790、CVE-2016-2791、CVE-2016-2792、CVE-2016-2793、CVE-2016-2794、CVE-2016-2795、CVE-2016-2796、CVE-2016-2797、CVE-2016-2798、CVE-2016-2799、CVE-2016-2800、CVE-2016-2801、CVE-2016-2802）

Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢这些问题的原始报告者 Bob Clary、Christoph Diehl、Christian Holler、Andrew McCreight、Daniel Holbert、Jesse Ruderman、Randell Jesup、Nicolas Golubovic、Jose Martinez、Romina Santillan、ca0nguyen、lokihardt、Nicolas Gregoire、GCHQ 下属 Communications Electronics Security Group (UK)、Holger Fuhrmannek、Ronald Crane 和 Tyson Smith。

有关这些缺陷的技术详细信息，请参阅针对 Thunderbird 38.7.0 的 Mozilla 安全公告。在本勘误表的“参考”部分可以找到 Mozilla 公告的链接。

所有 Thunderbird 用户都应升级这些更新后的程序包，其中包含已修正了这些问题的 Thunderbird 版本 38.7.0。
安装更新后，必须重新启动 Thunderbird 才能使更改生效。

在对畸形 Web 内容的处理中发现多个缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。（CVE-2016-1952、CVE-2016-1954、CVE-2016-1957、CVE-2016-1960、CVE-2016-1961、CVE-2016-1974、CVE-2016-1964、CVE-2016-1966）

在 Thunderbird 随附的 graphite2 字体库中发现多个安全缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。
（CVE-2016-1977、CVE-2016-2790、CVE-2016-2791、CVE-2016-2792、CVE-2016-2793、CVE-2016-2794、CVE-2016-2795、CVE-2016-2796、CVE-2016-2797、CVE-2016-2798、CVE-2016-2799、CVE-2016-2800、CVE-2016-2801、CVE-2016-2802）

安装更新后，必须重新启动 Thunderbird 才能使更改生效。

MozillaThunderbird 已更新到版本 38.7.0，修复了以下问题：

- 更新到 Thunderbird 38.7.0 (boo#969894)

- MFSA 2015-81/CVE-2015-4477 (bmo#1179484) MediaStream 回放中的释放后使用

- MFSA 2015-136/CVE-2015-7207 (bmo#1185256) 使用 performance.getEntries 和历史记录导航时违反同源策略

- MFSA 2016-16/CVE-2016-1952 多项内存安全危害

- MFSA 2016-17/CVE-2016-1954 (bmo#1243178) 通过 CSP 报告发生的本地文件覆盖和潜在的权限升级

- MFSA 2016-20/CVE-2016-1957 (bmo#1227052) 在处理 MP4 期间删除数组时，libstagefright 中发生内存泄漏

- MFSA 2016-21/CVE-2016-1958 (bmo#1228754) 可覆盖显示的页面地址

- MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) HTML5 字符串解析器中的释放后使用

- MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) SetBody 中的释放后使用

- MFSA 2016-25/CVE-2016-1962 (bmo#1240760) 使用多个 WebRTC 数据通道时的释放后使用

- MFSA 2016-27/CVE-2016-1964 (bmo#1243335) XML 转换期间存在释放后使用

- MFSA 2016-28/CVE-2016-1965 (bmo#1245264) 通过历史记录导航和位置协议属性进行地址栏欺骗

- MFSA 2016-31/CVE-2016-1966 (bmo#1246054) 因恶意 NPAPI 插件造成的内存损坏

- MFSA 2016-34/CVE-2016-1974 (bmo#1228103) 分配失败后的 HTML 解析器中存在越界读取

- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Graphite 2 库中的字体漏洞

Mozilla Foundation 报告：

MFSA 2016-16 多项内存安全危害 (rv:45.0 / rv:38.7)

MFSA 2016-17 通过 CSP 报告发生的本地文件覆盖和潜在的权限升级

MFSA 2016-18 CSP 报告无法剥离嵌入 iframe 页面的位置信息

MFSA 2016-19 Linux 视频内存因 Intel 驱动程序而发生 DOS

MFSA 2016-20 在处理 MP4 期间删除数组时，libstagefright 中发生内存泄漏

MFSA 2016-21 可覆盖显示的页面地址

MFSA 2016-22 Service Worker Manager 中发生 Service Worker Manager 越界读取

MFSA 2016-23 HTML5 字符串解析器中的释放后使用

MFSA 2016-24 SetBody 中的释放后使用

MFSA 2016-25 使用多种 WebRTC 数据通道时的释放后使用

MFSA 2016-26 修改 FileReader 所读取的文件时的内存损坏

MFSA 2016-27 XML 转换期间的释放后使用

MFSA 2016-28 通过历史记录导航和位置协议属性进行地址栏欺骗

MFSA 2016-29 使用 perfomance.getEntries 和具有会话还原功能的历史记录导航时违反同源策略

MFSA 2016-31 因恶意 NPAPI 插件造成的内存损坏

MFSA 2016-32 在程序检查过程中发现 WebRTC 和 LibVPX 漏洞

MFSA 2016-33 WebRTC 的 GetStaticInstance 中的释放后使用

MFSA 2016-34 分配失败后的 HTML 解析器中的越界读取

更新后的 firefox 程序包修复了多种安全问题，现在可用于Red Hat Enterprise Linux 5、6 和 7。

Red Hat 产品安全团队将此更新评级为具有严重安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

Mozilla Firefox 是一款开源 Web 浏览器。XULRunner 提供用于 Mozilla Firefox 的 XUL Runtime 环境。

在对畸形 Web 内容的处理中发现多个缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。（CVE-2016-1952、CVE-2016-1954、CVE-2016-1957、CVE-2016-1958、CVE-2016-1960、CVE-2016-1961、CVE-2016-1962、CVE-2016-1973、CVE-2016-1974、CVE-2016-1964、CVE-2016-1965、CVE-2016-1966）

在 Firefox 随附的 graphite2 字体库中发现多个安全缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。（CVE-2016-1977、CVE-2016-2790、CVE-2016-2791、CVE-2016-2792、CVE-2016-2793、CVE-2016-2794、CVE-2016-2795、CVE-2016-2796、CVE-2016-2797、CVE-2016-2798、CVE-2016-2799、CVE-2016-2800、CVE-2016-2801、CVE-2016-2802）

Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢这些问题的原始报告者 Bob Clary、Christoph Diehl、Christian Holler、Andrew McCreight、Daniel Holbert、Jesse Ruderman、Randell Jesup、Nicolas Golubovic、Jose Martinez、Romina Santillan、Abdulrahman Alqabandi、ca0nguyen、lokihardt、Dominique Hazael-Massieux、Nicolas Gregoire、Tsubasa Iinuma、GCHQ 的 Communications Electronics Security Group (UK)、Holger Fuhrmannek、Ronald Crane 和 Tyson Smith。

所有 Firefox 用户应升级这些更新后的程序包，其中包含已修正了这些问题的 Firefox 版本 38.7.0 ESR。安装更新后，必须重新启动 Firefox 才能使更改生效。

此 MozillaFirefox、mozilla-nspr、mozilla-nss 更新可修复以下问题：

MozillaFirefox 已更新到 Firefox 45.0 (boo#969894)

- 需要 NSPR 4.12 / NSS 3.21.1

- 通过 Hello 共享的实时浏览器选项卡

- 按钮栏中的同步选项卡按钮

- 通过 Firefox 帐户从其他设备同步的选项卡现在在搜索时会显示在智能地址栏的下拉区域中

- 引入新首选项 (network.dns.blockDotOnion) 以允许在 DNS 级别阻断 .onion

- 已删除选项卡群组 (Panorama) 功能

- MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 多项内存安全危害

- MFSA 2016-17/CVE-2016-1954 (bmo#1243178) 通过 CSP 报告发生的本地文件覆盖和潜在的权限升级

- MFSA 2016-18/CVE-2016-1955 (bmo#1208946) CSP 报告无法剥离嵌入 iframe 页面的位置信息

- MFSA 2016-19/CVE-2016-1956 (bmo#1199923) Linux 视频内存因 Intel 驱动程序而发生 DOS

- MFSA 2016-20/CVE-2016-1957 (bmo#1227052) 在处理 MP4 期间删除数组时，libstagefright 中发生内存泄漏

- MFSA 2016-21/CVE-2016-1958 (bmo#1228754) 可覆盖显示的页面地址

- MFSA 2016-22/CVE-2016-1959 (bmo#1234949) Service Worker Manager 中发生 Service Worker Manager 越界读取

- MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) HTML5 字符串解析器中的释放后使用

- MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) SetBody 中的释放后使用

- MFSA 2016-25/CVE-2016-1962 (bmo#1240760) 使用多个 WebRTC 数据通道时的释放后使用

- MFSA 2016-26/CVE-2016-1963 (bmo#1238440) 修改 FileReader 所读取的文件时发生内存损坏

- MFSA 2016-27/CVE-2016-1964 (bmo#1243335) XML 转换期间存在释放后使用

- MFSA 2016-28/CVE-2016-1965 (bmo#1245264) 通过历史记录导航和位置协议属性进行地址栏欺骗

- MFSA 2016-29/CVE-2016-1967 (bmo#1246956) 使用 perfomance.getEntries 和具有会话还原的历史记录导航时的同源策略冲突

- MFSA 2016-30/CVE-2016-1968 (bmo#1246742) 在 Brotli 解压缩期间存在缓冲区溢出

- MFSA 2016-31/CVE-2016-1966 (bmo#1246054) 因恶意 NPAPI 插件造成的内存损坏

- MFSA 2016-32/CVE-2016-1970/CVE-2016-1971/CVE-2016-1975/ CVE-2016-1976/CVE-2016-1972 通过代码检查发现的 WebRTC 和 LibVPX 漏洞

- MFSA 2016-33/CVE-2016-1973 (bmo#1219339) WebRTC 的 GetStaticInstance 中的释放后使用

- MFSA 2016-34/CVE-2016-1974 (bmo#1228103) 分配失败后的 HTML 解析器中存在越界读取

- MFSA 2016-35/CVE-2016-1950 (bmo#1245528) 在 NSS 的 ASN.1 解码期间发生缓冲区溢出（已通过要求 3.21.1 来修复）

- MFSA 2016-36/CVE-2016-1979 (bmo#1185033) 处理 NSS 中的 DER 编码密钥期间发生释放后使用（已通过要求 3.21.1 来修复）

- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Graphite 2 库中的字体漏洞

mozilla-nspr 已更新到版本 4.12

- 添加了 PR_GetEnvSecure 函数，其会尝试检测程序是否正以提升的权限执行，如果检测到便返回 NULL。建议在通用库代码中使用此函数。

- 修复了一个与 PR_*printf 函数相关的内存分配缺陷

- 导出了 API PR_DuplicateEnvironment，其已在 NSPR 4.10.9 中添加

- 添加了对 FreeBSD aarch64 的支持

- 多个次要正确性和兼容性补丁

mozilla-nss 已更新到 NSS 3.21.1 (bmo#969894)

- Firefox 45.0 所需

- MFSA 2016-35/CVE-2016-1950 (bmo#1245528) 在 NSS 的 ASN.1 解码期间发生缓冲区溢出（已通过要求 3.21.1 来修复）

- MFSA 2016-36/CVE-2016-1979 (bmo#1185033) 处理 NSS 中的 DER 编码密钥期间发生释放后使用（已通过要求 3.21.1 来修复）

The version of Firefox installed on the remote host is prior to 45.0 and is affected by multiple vulnerabilities : 

 - Mozilla Network Security Services (NSS) contains an overflow condition. The issue is triggered as user-supplied input is not properly validated when parsing ASN.1 structures. With a specially crafted certificate, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-1950) 
 - A flaw exists in the 'ValueNumberer::fixupOSROnlyLoop()' function in 'jit/ValueNumbering.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw in the 'Downscaler::BeginFrame()' function in 'image/Downscaler.cpp' exists that is triggered when failing to compute filters for image downscaling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952, CVE-2016-1953)
 - A flaw exists in the 'JSScript::maybeSweepTypes()' function in 'vm/TypeInference.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists in the 'DispatchEvents()' function in 'layout/style/nsAnimationManager.h' and 'layout/style/nsTransitionManager.h' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists in 'dom/base/Console.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists in the 'PeerConnectionMedia::SelfDestruct_m()' function in 'media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists in the 'nsICODecoder::ReadDirEntry()' function in 'image/decoders/nsICODecoder.cpp' that is triggered when rendering ICO sub-images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'nsIDNService::IDNA2008ToUnicode()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling image decoding. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'DiscardTransferables()' function in 'vm/StructuredClone.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exits in the 'Assembler::GetCF32Target()' function in 'jit/arm/Assembler-arm.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'GetPcScript()' function in 'jit/JitFrames.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'JSFunction::isDerivedClassConstructor()' function in 'js/src/jsfun.cpp' that is triggered when handling lazy self-hosted functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'js/src/jit/Lowering.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exits in the 'EventListenerManager::HandleEventInternal()' function in 'dom/events/EventListenerManager.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'layout/base/nsRefreshDriver.cpp' that is triggered when handling transition events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'dom/media/systemservices/CamerasChild.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'dom/xslt/xslt/txMozillaTextOutput.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'dom/gamepad/windows/WindowsGamepad.cpp' that is triggered when handling 'WindowsGamepadService' shutdown. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'nsCSPContext::SendReports()' function in 'dom/security/nsCSPContext.cpp' that is triggered during the handling of Content Security Policy (CSP) violation reports. This may allow a context-dependent attacker to overwrite arbitrary files on a user's machine and potentially gain elevated privileges. (CVE-2016-1954)
 - A flaw exists in 'dom/security/nsCSPContext.cpp' that is due to Content Security Policy (CSP) violation reports containing full path information for cross-origin iframe navigations in violation of the CSP specification. This may allow a context-dependent attacker to gain unauthorized access to sensitive information. (CVE-2016-1955)
 - A flaw exists in 'gfx/gl/GLContext.cpp' when using Intel Video cards that is triggered when performing WebGL operations that require a large amount buffer to be allocated from video memory. This may allow a context-dependent to cause a consumption of memory resources that will persist until the system has been restarted. (CVE-2016-1956)
 - Google Stagefright contains a flaw that is triggered during the handling of array destruction during MPEG4 video file processing. This may allow a context-dependent attacker to cause a memory leak, with unspecified consequences. (CVE-2016-1957)
 - An unspecified flaw exists that may allow a context-dependent attacker to spoof the user's address bar. No further details have been provided. (CVE-2016-1958)
 - A flaw exists  in Service Worker Manager that is triggered when handling the Clients API. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1959)
 - A flaw exists in  use-after-free error in the HTML5 string parser. The issue is triggered when parsing a set of table-related tags in a foreign fragment context such as SVG. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1960)
 - A flaw exists in use-after-free error in the 'nsHTMLDocument::SetBody()' function in 'dom/html/nsHTMLDocument.cpp'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1961)
 - A flaw exists in use-after-free error in 'netwerk/sctp/datachannel/DataChannel.cpp' when using multiple 'WebRTC' data channel connections and freeing a data channel connection from within a call. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1962)
 - A flaw exists in the 'FileReader::DoReadData()' function in 'dom/base/FileReader.cpp'. The issue is triggered as user-supplied input is not properly validated when handling modifications to local files that occur while they are being read with the FileReader API. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1963)
 - A flaw exists in use-after-free error in the 'txAttribute::execute()' function in 'dom/xslt/xslt/txInstructions.cpp' that is triggered when handling XML transformation operations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1964)
 - A flaw exists in the 'nsLocation::SetProtocol()' function in 'dom/base/nsLocation.cpp' that is triggered when handling history navigation in combination with the location protocol property. This may allow a context-dependent attacker to spoof the contents of the address bar. (CVE-2016-1965)
 - A flaw exists that is triggered when handling history navigation in a restored browser session. This may potentially allow a context-dependent attacker to gain unauthorized access to cross-origin URL information. (CVE-2016-1967)
 - A pointer underflow condition exists in the 'Brotli' library. The issue is triggered as user-supplied input is not properly validated when the library is performing decompression. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2016-1968)
 - A use-after-free flaw exists in the Netscape Plugin Application Programming Interface (NPAPI) plugin within the 'nsNPObjWrapper::GetNewOrUsed()' function in 'dom/plugins/base/nsJSNPRuntime.cpp'. The issue is triggered when handling malicious scripted web content in concert with the plugin. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1966)
 - An integer underflow condition exists in the 'srtp_unprotect()' function in 'netwerk/srtp/src/srtp/srtp.c' that is triggered when handling SRTP packet lenghts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1970)
 - A flaw exists in the 'I420VideoFrame::CreateFrame()' function in WebRTC. The issue is triggered as user-supplied input is not properly validated due to a missing status check. This may potentially allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1971)
 - 'ibvpx' contains a use-after-free error in 'vpx_ports/vpx_once.h' related to a race condition. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1972)
 - A race condition exists in 'dom/media/systemservices/CamerasChild.h'. The issue is triggered as user-supplied input is not properly validated when handling block-level statistics. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1975)
 - A use-after-free flaw exists in 'DesktopDisplayDevice::operator=' in 'media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.cc'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1976)
 - A flaw exists in use-after-free error that is triggered by a race condition in 'GetStaticInstance' in WebRTC. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1973)
 - A flaw exists in the 'nsScannerString::AppendUnicodeTo()' function in 'parser/htmlparser/nsScannerString.cpp'. The issue is triggered when the program fails to allocate memory during handling of unicode strings. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1974)
 - Mozilla Network Security Services (NSS) contains a use-after-free error in the 'PK11_ImportDERPrivateKeyInfoAndReturnKey()' function. The issue is triggered when handling DER encoded keys. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1979)

 The Graphite/Libgraphite component used in Mozilla Firefox contains the following vulnerabilities : 

 - An out-of-bounds write flaw exists in the 'setAttr()' function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1969)
 - A flaw exists in the 'Machine::Code::decoder::analysis::set_ref()' function. The issue is triggered as user-supplied input is not properly validated. With a specially crafted font, a context-dependent attacker can corrupt memory to cause a denial of service in a process linked against the library or potentially execute arbitrary code. (CVE-2016-1977)
 - A flaw exists in the 'GetTableInfo()' function in 'TtfUtil.cpp' related to the use of uninitialized memory when handling a specially crafted font. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-2790)
 - An out-of-bounds read flaw exists in the 'GlyphCache::glyph()' function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2791)
 - An out-of-bounds read flaw exist in the 'getAttr()' function in 'Slot.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2792)
 - An out-of-bounds read flaw in 'CachedCmap.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2793)
 - An out-of-bounds read flaw in the 'CmapSubtable12NextCodepoint()' function in 'TtfUtil.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2794)
 - A flaw exists in the 'FileFace::get_table_fn()' function related to the use of uninitialized memory when handling a specially crafted font. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-2795)
 - An out-of-bounds write flaw exixts in the 'vm::Machine::Code::Code()' function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2796)
 - An out-of-bounds read flaw exists in the 'CmapSubtable12Lookup()' function in 'TtfUtil.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2797)
 - An out-of-bounds read flaw exists in the 'GlyphCache::Loader::Loader()' function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2798)
 - An out-of-bounds write flaw exists in the 'setAttr()' function in 'Slot.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2799)
 - An out-of-bounds read flaw exists in the 'getAttr()' function in 'Slot.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2800)
 - An out-of-bounds read flaw exists in the 'CmapSubtable12Lookup()' function in 'TtfUtil.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2801)
 - An out-of-bounds read flaw existsin the 'CmapSubtable4NextCodepoint()' function in 'TtfUtil.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2802)

The specific version of Firefox that the system is running is reportedly affected by the following vulnerabilities:

- Mozilla Firefox contains a flaw in the ValueNumberer::fixupOSROnlyLoop() function in jit/ValueNumbering.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the Downscaler::BeginFrame() function in image/Downscaler.cpp that is triggered when failing to compute filters for image downscaling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the JSScript::maybeSweepTypes() function in vm/TypeInference.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the DispatchEvents() function in layout/style/nsAnimationManager.h and layout/style/nsTransitionManager.h that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in dom/base/Console.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the PeerConnectionMedia::SelfDestruct_m() function in media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the nsICODecoder::ReadDirEntry() function in image/decoders/nsICODecoder.cpp that is triggered when rendering ICO sub-images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the nsIDNService::IDNA2008ToUnicode() function in netwerk/dns/nsIDNService.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated when handling image decoding. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the DiscardTransferables() function in vm/StructuredClone.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the Assembler::GetCF32Target() function in jit/arm/Assembler-arm.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the GetPcScript() function in jit/JitFrames.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the JSFunction::isDerivedClassConstructor() function in js/src/jsfun.cpp that is triggered when handling lazy self-hosted functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in js/src/jit/Lowering.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the EventListenerManager::HandleEventInternal() function in dom/events/EventListenerManager.cpp. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in layout/base/nsRefreshDriver.cpp that is triggered when handling transition events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in dom/media/systemservices/CamerasChild.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- libvpx contains a flaw in the vp8_mb_init_dequantizer() function in vp8/decoder/decodeframe.c that is triggered as user-supplied input is not properly validated. With specially crafted media content, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- libvpx contains a flaw in the vp8_loop_filter_frame_init() function in media/libvpx/vp8/common/loopfilter.c that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in dom/xslt/xslt/txMozillaTextOutput.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in dom/gamepad/windows/WindowsGamepad.cpp that is triggered when handling WindowsGamepadService shutdown. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the nsCSPContext::SendReports() function in dom/security/nsCSPContext.cpp that is triggered during the handling of Content Security Policy (CSP) violation reports. This may allow a context-dependent attacker to overwrite arbitrary files on a user's machine and potentially gain elevated privileges. (CVE-2016-1954)

- Mozilla Firefox contains a flaw in dom/security/nsCSPContext.cpp that is due to Content Security Policy (CSP) violation reports containing full path information for cross-origin iframe navigations in violation of the CSP specification. This may allow a context-dependent attacker to gain unauthorized access to sensitive information. (CVE-2016-1955)

- Mozilla Firefox contains a flaw in gfx/gl/GLContext.cpp when using Intel Video cards that is triggered when performing WebGL operations that require a large amount buffer to be allocated from video memory. This may allow a context-dependent to cause a consumption of memory resources that will persist until the system has been restarted. (CVE-2016-1956)

- Google Stagefright contains a flaw that is triggered during the handling of array destruction during MPEG4 video file processing. This may allow a context-dependent attacker to cause a memory leak, with unspecified consequences.
 (CVE-2016-1957)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to spoof the user's address bar. No further details have been provided. (CVE-2016-1958)

- Mozilla Firefox contains a flaw in Service Worker Manager that is triggered when handling the Clients API. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1959)

- Mozilla Firefox contains a use-after-free error in the HTML5 string parser. The issue is triggered when parsing a set of table-related tags in a foreign fragment context such as SVG. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1960)

- Mozilla Firefox contains a use-after-free error in the nsHTMLDocument::SetBody() function in dom/html/nsHTMLDocument.cpp. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1961)

- Mozilla Firefox contains a use-after-free error in netwerk/sctp/datachannel/DataChannel.cpp when using multiple WebRTC data channel connections and freeing a data channel connection from within a call. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1962)

- Mozilla Firefox contains a flaw in the FileReader::DoReadData() function in dom/base/FileReader.cpp. The issue is triggered as user-supplied input is not properly validated when handling modifications to local files that occur while they are being read with the FileReader API. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1963)

- Mozilla Firefox contains a use-after-free error in the txAttribute::execute() function in dom/xslt/xslt/txInstructions.cpp that is triggered when handling XML transformation operations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1964)

- Mozilla Firefox contains a flaw in the nsLocation::SetProtocol() function in dom/base/nsLocation.cpp that is triggered when handling history navigation in combination with the location protocol property. This may allow a context-dependent attacker to spoof the contents of the address bar. (CVE-2016-1965)

- Mozilla Firefox contains a flaw that is triggered when handling history navigation in a restored browser session. This may potentially allow a context-dependent attacker to gain unauthorized access to cross-origin URL information. (CVE-2016-1967)

- Mozilla Firefox contains a pointer underflow condition in the Brotli library. The issue is triggered as user-supplied input is not properly validated when the library is performing decompression. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2016-1968)

- Mozilla Firefox contains a use-after-free flaw in the Netscape Plugin Application Programming Interface (NPAPI) plugin within the nsNPObjWrapper::GetNewOrUsed() function in dom/plugins/base/nsJSNPRuntime.cpp. The issue is triggered when handling malicious scripted web content in concert with the plugin. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1966)

- Mozilla Firefox contains an integer underflow condition in the srtp_unprotect() function in netwerk/srtp/src/srtp/srtp.c that is triggered when handling SRTP packet lenghts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1970)

- Mozilla Firefox contains a flaw in the I420VideoFrame::CreateFrame() function in WebRTC. The issue is triggered as user-supplied input is not properly validated due to a missing status check. This may potentially allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1971)

- Mozilla Firefox contains a race condition in dom/media/systemservices/CamerasChild.h. The issue is triggered as user-supplied input is not properly validated when handling block-level statistics. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1975)

- Mozilla Firefox contains a use-after-free flaw in DesktopDisplayDevice::operator= in media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.cc. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1976)

- libvpx contains a use-after-free error in vpx_ports/vpx_once.h related to a race condition. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 (CVE-2016-1972)

- Mozilla Firefox contains a use-after-free error that is triggered by a race condition in GetStaticInstance in WebRTC. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1973)

- Mozilla Firefox contains a flaw in the nsScannerString::AppendUnicodeTo() function in parser/htmlparser/nsScannerString.cpp. The issue is triggered when the program fails to allocate memory during handling of unicode strings. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1974)

- Mozilla Network Security Services (NSS) contains a use-after-free error in the PK11_ImportDERPrivateKeyInfoAndReturnKey() function. The issue is triggered when handling DER encoded keys. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 (CVE-2016-1979)

- Graphite/Libgraphite contains a flaw in the Machine::Code::decoder::analysis::set_ref() function. The issue is triggered as user-supplied input is not properly validated. With a specially crafted font, a context-dependent attacker can corrupt memory to cause a denial of service in a process linked against the library or potentially execute arbitrary code. (CVE-2016-1977)

- Graphite/Libgraphite contains a flaw in the GetTableInfo() function in TtfUtil.cpp related to the use of uninitialized memory when handling a specially crafted font. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-2790)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the GlyphCache::glyph() function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2791)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the getAttr() function in Slot.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2792)

- Graphite/Libgraphite contains an out-of-bounds read flaw in CachedCmap.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2793)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the CmapSubtable12NextCodepoint() function in TtfUtil.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2794)

- Graphite/Libgraphite contains a flaw in the FileFace::get_table_fn() function related to the use of uninitialized memory when handling a specially crafted font. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-2795)

- Graphite/Libgraphite contains an out-of-bounds write flaw in the vm::Machine::Code::Code() function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2796)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the CmapSubtable12Lookup() function in TtfUtil.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2797)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the GlyphCache::Loader::Loader() function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2798)

- Graphite/Libgraphite contains an out-of-bounds write flaw in the setAttr() function in Slot.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2799)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the getAttr() function in Slot.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2800)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the CmapSubtable12Lookup() function in TtfUtil.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2801)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the CmapSubtable4NextCodepoint() function in TtfUtil.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2802)

- Graphite/Libgraphite contains an out-of-bounds write flaw in the setAttr() function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1969)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91379	GLSA-201605-06：Mozilla 產品：多個弱點	Nessus	Gentoo Local Security Checks	2016/5/31	2022/12/5	critical
89990	SUSE SLED11 / SLES11 安全性更新：MozillaFirefox、mozilla-nspr、mozilla-nss (SUSE-SU-2016:0777-1)	Nessus	SuSE Local Security Checks	2016/3/17	2021/1/6	critical
91985	openSUSE 安全性更新：Mozilla Thunderbird (openSUSE-2016-848)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	high
91986	openSUSE 安全性更新：Mozilla Thunderbird (openSUSE-2016-851)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	high
89792	Debian DSA-3510-1：iceweasel - 安全更新	Nessus	Debian Local Security Checks	2016/3/10	2021/1/11	critical
89971	CentOS 5 / 6 / 7：thunderbird (CESA-2016:0460)	Nessus	CentOS Local Security Checks	2016/3/17	2021/1/4	high
89981	Oracle Linux 6 / 7：thunderbird (ELSA-2016-0460)	Nessus	Oracle Linux Local Security Checks	2016/3/17	2024/10/22	high
89988	Scientific Linux 安全更新：SL5.x、SL6.x、SL7.x i386/x86_64 中的 thunderbird	Nessus	Scientific Linux Local Security Checks	2016/3/17	2021/1/14	high
90170	openSUSE 安全更新：MozillaThunderbird (openSUSE-2016-395)	Nessus	SuSE Local Security Checks	2016/3/25	2021/1/19	critical
90240	openSUSE 安全更新：MozillaThunderbird (openSUSE-2016-402)	Nessus	SuSE Local Security Checks	2016/3/28	2021/1/19	critical
89765	FreeBSD：mozilla -- 多种漏洞 (2225c5b4-1e5a-44fc-9920-b3201c384a15)	Nessus	FreeBSD Local Security Checks	2016/3/9	2021/1/4	critical
89774	RHEL 5/6/7：firefox (RHSA-2016:0373)	Nessus	Red Hat Local Security Checks	2016/3/9	2020/5/29	critical
89915	openSUSE 安全更新：Firefox (openSUSE-2016-334)	Nessus	SuSE Local Security Checks	2016/3/14	2021/1/19	critical
9207	Mozilla Firefox < 45.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/4/8	2019/3/6	high
802023	Firefox < 45 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2016/9/7		critical

检测

插件搜索

critical

critical

high

high

critical

high

high

high

critical

critical

critical

critical

critical

high

critical