This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues :

Mozilla Firefox was updated to 38.7.0 ESR (bsc#969894)

  - MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous     memory safety hazards (rv:45.0 / rv:38.7)

  - MFSA 2016-17/CVE-2016-1954 Local file overwriting and     potential privilege escalation through CSP reports

  - MFSA 2016-20/CVE-2016-1957 A memory leak in     libstagefright when deleting an array during MP4     processing was fixed.

  - MFSA 2016-21/CVE-2016-1958 The displayed page address     can be overridden

  - MFSA 2016-23/CVE-2016-1960 A use-after-free in HTML5     string parser was fixed.

  - MFSA 2016-24/CVE-2016-1961 A use-after-free in SetBody     was fixed.

  - MFSA 2016-25/CVE-2016-1962 A use-after-free when using     multiple WebRTC data channels was fixed.

  - MFSA 2016-27/CVE-2016-1964 A use-after-free during XML     transformations was fixed.

  - MFSA 2016-28/CVE-2016-1965 Addressbar spoofing though     history navigation and Location protocol property was     fixed.

  - MFSA 2016-31/CVE-2016-1966 Memory corruption with     malicious NPAPI plugin was fixed.

  - MFSA 2016-34/CVE-2016-1974 A out-of-bounds read in the     HTML parser following a failed allocation was fixed.

  - MFSA 2016-35/CVE-2016-1950 A buffer overflow during     ASN.1 decoding in NSS was fixed.

  - MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/     CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/     CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/     CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Various font     vulnerabilities were fixed in the embedded Graphite 2     library

Mozilla NSS was updated to fix :

  - MFSA 2016-15/CVE-2016-1978 Use-after-free in NSS during     SSL connections in low memory

  - MFSA 2016-35/CVE-2016-1950 Buffer overflow during ASN.1     decoding in NSS

  - MFSA 2016-36/CVE-2016-1979 Use-after-free during     processing of DER encoded keys in NSS

Mozilla NSPR was updated to version 4.12 (bsc#969894)

  - added a PR_GetEnvSecure function, which attempts to     detect if the program is being executed with elevated     privileges, and returns NULL if detected. It is     recommended to use this function in general purpose     library code.

  - fixed a memory allocation bug related to the PR_*printf     functions

  - exported API PR_DuplicateEnvironment, which had already     been added in NSPR 4.10.9

  - added support for FreeBSD aarch64

  - several minor correctness and compatibility fixes

  - Enable atomic instructions on mips (bmo#1129878)

  - Fix mips assertion failure when creating thread with     custom stack size (bmo#1129968)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update contains Mozilla Thunderbird 45.2. (boo#983549)

It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail.

The following vulnerabilities were fixed :

  - CVE-2016-2818, CVE-2016-2815: Memory safety bugs     (boo#983549, MFSA2016-49)

Contains the following security fixes from the 45.1 release:
(boo#977333)

  - CVE-2016-2806, CVE-2016-2807: Miscellaneous memory     safety hazards (boo#977375, boo#977376, MFSA 2016-39)

Contains the following security fixes from the 45.0 release:
(boo#969894)

  - CVE-2016-1952, CVE-2016-1953: Miscellaneous memory     safety hazards (MFSA 2016-16)

  - CVE-2016-1954: Local file overwriting and potential     privilege escalation through CSP reports (MFSA 2016-17)

  - CVE-2016-1955: CSP reports fail to strip location     information for embedded iframe pages (MFSA 2016-18)

  - CVE-2016-1956: Linux video memory DOS with Intel drivers     (MFSA 2016-19)

  - CVE-2016-1957: Memory leak in libstagefright when     deleting an array during MP4 processing (MFSA 2016-20)

  - CVE-2016-1960: Use-after-free in HTML5 string parser     (MFSA 2016-23)

  - CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24)

  - CVE-2016-1964: Use-after-free during XML transformations     (MFSA 2016-27)

  - CVE-2016-1974: Out-of-bounds read in HTML parser     following a failed allocation (MFSA 2016-34)

The graphite font shaping library was disabled, addressing the following font vulnerabilities :

  - MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/     CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/     CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/     CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

The following tracked packaging changes are included :

  - fix build issues with gcc/binutils combination used in     Leap 42.2 (boo#984637)

  - gcc6 fixes (boo#986162)

  - running on 48bit va aarch64 (boo#984126)

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, integer overflows, buffer overflows and other implementation errors may lead to the execution of arbitrary code or denial of service.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Several flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Firefox to crash or, potentially, execute     arbitrary code with the privileges of the user running     Firefox. (CVE-2016-1952, CVE-2016-1954, CVE-2016-1957,     CVE-2016-1958, CVE-2016-1960, CVE-2016-1961,     CVE-2016-1962, CVE-2016-1973, CVE-2016-1974,     CVE-2016-1964, CVE-2016-1965, CVE-2016-1966)

  - Multiple security flaws were found in the graphite2     font library shipped with Firefox. A web page     containing malicious content could cause Firefox to     crash or, potentially, execute arbitrary code with the     privileges of the user running Firefox. (CVE-2016-1977,     CVE-2016-2790, CVE-2016-2791, CVE-2016-2792,     CVE-2016-2793, CVE-2016-2794, CVE-2016-2795,     CVE-2016-2796, CVE-2016-2797, CVE-2016-2798,     CVE-2016-2799, CVE-2016-2800, CVE-2016-2801,     CVE-2016-2802)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201605-06 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, NSS, NSPR, and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms, or have other unspecified       impacts.
  Workaround :

    There is no known workaround at this time.

來自 Red Hat 安全性公告 2016:0373：

現已提供適用於 Red Hat Enterprise Linux 5、6 和 7 的更新版 firefox 套件，可修正多個安全性問題。

Red Hat 產品安全性團隊已將此更新評等為具有重大安全性影響。可針對每個弱點從〈參照〉一節的 CVE 連結中取得常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

Mozilla Firefox 是開放原始碼的網頁瀏覽器。XULRunner 為 Mozilla Firefox 提供 XUL 執行階段環境。

處理格式有誤之網頁內容時發現多個瑕疵。包含惡意內容的網頁可造成 Firefox 損毀，或可能利用執行 Firefox 之使用者的權限來執行任意程式碼。(CVE-2016-1952、CVE-2016-1954、CVE-2016-1957、CVE-2016-1958、CVE-2016-1960、CVE-2016-1961、CVE-2016-1962、CVE-2016-1973、CVE-2016-1974、CVE-2016-1964、CVE-2016-1965、CVE-2016-1966)

在 Firefox 隨附的 graphite2 字型程式庫中發現多個安全性瑕疵。包含惡意內容的網頁可造成 Firefox 損毀，或可能利用執行 Firefox 之使用者的權限來執行任意程式碼。(CVE-2016-1977、CVE-2016-2790、CVE-2016-2791、CVE-2016-2792、CVE-2016-2793、CVE-2016-2794、CVE-2016-2795、CVE-2016-2796、CVE-2016-2797、CVE-2016-2798、CVE-2016-2799、CVE-2016-2800、CVE-2016-2801、CVE-2016-2802)

Red Hat 要感謝 Mozilla 專案報告這些問題。上游確認 Bob Clary、Christoph Diehl、Christian Holler、Andrew McCreight、Daniel Holbert、Jesse Ruderman、Randell Jesup、Nicolas Golubovic、Jose Martinez、Romina Santillan、Abdulrahman Alqabandi、ca0nguyen、lokihardt、Dominique Hazael-Massieux、Nicolas Gregoire、Tsubasa Iinuma、GCHQ 的 Communications Electronics Security Group (UK)、Holger Fuhrmannek、Ronald Crane 和 Tyson Smith 為這些問題的原始報告者。

所有 Firefox 使用者皆應升級至這些更新版套件，其中包含可更正這些問題的 Firefox 38.7.0 ESR 版。安裝更新之後，Firefox 必須重新啟動，變更才會生效。

Francis Gabriel 在 NSS 的 ASN.1 解碼期間發現一個緩衝區溢位問題。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1950)

Bob Clary、Christoph Diehl、Christian Holler、Andrew McCreight、Daniel Holbert、Jesse Ruderman、Randell Jesup、Carsten Book、Gian-Carlo Pascutto、Tyson Smith、Andrea Marchesini 與 Jukka Jylanki 在 Firefox 中發現多個記憶體安全問題。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1952、CVE-2016-1953)

Nicolas Golubovic 發現 CSP 違規報告可用來覆寫本機檔案。如果使用者遭到誘騙而在停用附加元件簽章及安裝解除封裝之附加元件的情況下開啟特製的網站，攻擊者便可能利用此弱點取得其他權限。(CVE-2016-1954)

Muneaki Nishimura 發現 CSP 違規報告中包含跨來源 iframe 導覽的完整路徑。攻擊者可能惡意利用此弱點來竊取機密資料。(CVE-2016-1955)

Ucha Gobejishvili 發現執行特定 WebGL 操作導致某些 Intel GPU 記憶體資源耗盡，而需要重新開機。如果使用者遭到誘騙而開啟特製的網站，攻擊者可能惡意利用此弱點引發拒絕服務。(CVE-2016-1956)

Jose Martinez 與 Romina Santillan 發現，在某些情況下，於 MPEG4 視訊檔案處理期間，libstagefright 中有一個記憶體洩漏情形。如果使用者遭到誘騙而開啟特製的網站，攻擊者可能惡意利用此弱點，透過記憶體消耗造成拒絕服務。(CVE-2016-1957)

Abdulrahman Alqabandi 發現，在某些情況下，位址列可能為空白，或填滿頁面定義的內容。如果使用者遭到誘騙而開啟特製的網站，攻擊者可能加以惡意利用，藉此發動 URL 偽造攻擊。
(CVE-2016-1958)

Looben Yang 在 Service Worker Manager 中發現一個超出邊界讀取錯誤。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1959)

在 HTML5 字串剖析器中發現一個釋放後使用錯誤。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1960)

在 HTMLDocument 的 SetBody 函式中發現一個釋放後使用錯誤。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1961)

Dominique Hazael-Massieux 發現使用多個 WebRTC 資料通道時有一個釋放後使用錯誤。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。
(CVE-2016-1962)

據發現，在 FileReader API 讀取本機檔案時修改本機檔案會造成 Firefox 損毀。如果使用者遭誘騙而開啟特製的網站，攻擊者可能趁機以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1963)

Nicolas Gregoire 發現 XML 轉換期間有一個釋放後使用錯誤。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1964)

Tsubasa Iinuma 發現一個機制會造成位址列顯示使用歷程記錄導覽與位置通訊協定內容的不正確 URL。如果使用者遭到誘騙而開啟特製的網站，攻擊者可能加以惡意利用，藉此發動 URL 偽造攻擊。(CVE-2016-1965)

在 NPAPI 子系統中發現一個記憶體損毀問題。如果使用者遭到誘騙而開啟已安裝惡意外掛程式的特製網站，攻擊者可能加以惡意利用，透過損毀應用程式造成拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。
(CVE-2016-1966)

Jordi Chancel 在使用具有工作階段還原的 performance.getEntries 與歷程記錄導覽時發現一個同源原則繞過錯誤。如果使用者遭到誘騙而開啟特製的網站，攻擊者可能加以惡意利用而竊取機密資料。
(CVE-2016-1967)

Luke Li 發現在某些情況下，Brotli 解壓縮期間存在一個緩衝區溢位情形。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1968)

Ronald Crane 發現 WebRTC 的 GetStaticInstance 中有一個釋放後使用問題。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1973)

Ronald Crane 發現在某些情況下，在 HTML 剖析器中發生配置失敗之後存在一個超出邊界讀取錯誤。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1974)

Holger Fuhrmannek、Tyson Smith 與 Holger Fuhrmannek 報告 Graphite 2 程式庫中存有多個記憶體安全問題。如果使用者遭到誘騙而開啟特製網站，攻擊者可能加以惡意利用，透過損毀應用程式來引發拒絕服務，或以叫用 Firefox 的使用者權限執行任意程式碼。(CVE-2016-1977、CVE-2016-2790、CVE-2016-2791、CVE-2016-2792、CVE-2016-2793、CVE-2016-2794、CVE-2016-2795、CVE-2016-2796、CVE-2016-2797、CVE-2016-2798、CVE-2016-2799、CVE-2016-2800、CVE-2016-2801、CVE-2016-2802)

此 MozillaFirefox、mozilla-nspr、mozilla-nss 更新可修正下列問題：

Mozilla Firefox 已更新至 38.7.0 ESR 版 (bsc#969894)

- MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 其他記憶體安全危險 (rv:45.0 / rv:38.7)

- MFSA 2016-17/CVE-2016-1954 透過 CSP 報告發生的本機檔案覆寫問題和潛在的權限提升問題

- MFSA 2016-20/CVE-2016-1957 已修正在處理 MP4 期間刪除陣列時，libstagefright 中發生的記憶體洩漏情形。

- MFSA 2016-21/CVE-2016-1958 可覆寫顯示的頁面位址

- MFSA 2016-23/CVE-2016-1960 已修正 HTML5 字串剖析器中的釋放後使用問題。

- MFSA 2016-24/CVE-2016-1961 已修正 SetBody 中的釋放後使用問題。

- MFSA 2016-25/CVE-2016-1962 已修正使用多個 WebRTC 資料通道時的釋放後使用問題。

- MFSA 2016-27/CVE-2016-1964 已修正 XML 轉換期間的釋放後使用問題。

- MFSA 2016-28/CVE-2016-1965 已修正透過歷程記錄導覽與位置通訊協定內容造成的位址列偽造問題。

- MFSA 2016-31/CVE-2016-1966 已修正因惡意 NPAPI 外掛程式造成的記憶體損毀問題。

- MFSA 2016-34/CVE-2016-1974 已修正配置失敗後的 HTML 剖析器出現的超出邊界讀取問題。

- MFSA 2016-35/CVE-2016-1950 已修正在 NSS 中解碼 ASN.1 期間發生的緩衝區溢位。

- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 多種字型弱點已在內嵌 Graphite 2 程式庫中修正

Mozilla NSS 已更新，可修正：

- MFSA 2016-15/CVE-2016-1978 在記憶體不足的情況下，SSL 連線期間，NSS 中發生的釋放後使用問題

- MFSA 2016-35/CVE-2016-1950 NSS 中 ASN.1 解碼期間發生的緩衝區溢位問題

- MFSA 2016-36/CVE-2016-1979 處理 NSS 中的 DER 編碼金鑰期間發生的釋放後使用問題

Mozilla NSPR 已更新至 4.12 版 (bsc#969894)

- 已新增 PR_GetEnvSecure 函式，其會嘗試偵測程式是否正以提升的權限執行，如果偵測到便傳回 NULL。建議在一般目的程式庫程式碼中使用此函式。

- 已修正一個與 PR_*printf 函式相關的記憶體配置錯誤

- 已匯出 API PR_DuplicateEnvironment，其已在 NSPR 4.10.9 中新增

- 已新增 FreeBSD aarch64 的支援

- 數個次要正確性與相容性修正

- 在 mips 中啟用不可部分完成指令 (bmo#1129878)

- 修正以自訂堆疊大小建立執行緒時的 mips 宣告失敗 (bmo#1129968)

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

此更新包含 Mozilla Thunderbird 45.2。(boo#983549)

修正了多個安全性問題，這些問題大多會影響在瀏覽器內容中使用的電子郵件程式，例如檢視網頁或 HTMl 格式的電子郵件。

下列弱點已修正：

- CVE-2016-2818、CVE-2016-2815：記憶體安全性錯誤 (boo#983549、MFSA2016-49)

包含下列來自 45.1 版的安全性修正：
(boo#977333)

- CVE-2016-2806、CVE-2016-2807：其他記憶體安全性危險 (boo#977375、boo#977376、MFSA 2016-39)

包含下列來自 45.0 版的安全性修正：
(boo#969894)

- CVE-2016-1952、CVE-2016-1953：其他記憶體安全危險 (MFSA 2016-16)

- CVE-2016-1954：透過 CSP 報告發生的本機檔案覆寫和潛在的權限提升 (MFSA 2016-17)

- CVE-2016-1955：CSP 報告無法去除內嵌 iframe 頁面中的位置資訊 (MFSA 2016-18)

- CVE-2016-1956：Linux 視訊記憶體因 Intel 驅動程式而發生 DOS　(MFSA 2016-19)

- CVE-2016-1957：在處理 MP4 期間刪除陣列時　libstagefright 中發生的記憶體洩漏 (MFSA 2016-20)

- CVE-2016-1960：HTML5 字串剖析器中的釋放後使用 (MFSA 2016-23)

- CVE-2016-1961：SetBody 中的釋放後使用 (MFSA 2016-24)

- CVE-2016-1964：XML 轉換期間發生的釋放後使用 (MFSA 2016-27)

- CVE-2016-1974：配置失敗後的 HTML 剖析器中出現的超出邊界讀取 (MFSA 2016-34)

graphite 字型成形程式庫已停用，解決了下列字型弱點：

- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

包括下列追蹤套件變更：

- 修正 Leap 42.2 中使用的 gcc/binutils 組合之版本問題 (boo#984637)

- gcc6 修正　(boo#986162)

- 在 48 位元 va aarch64 上執行 (boo#984126)

在 Icedove (Mozilla Thunderbird 郵件用戶端的 Debian 版本) 中發現多個安全性問題：多個記憶體安全性錯誤、整數溢位、緩衝區溢位與其他實作錯誤可能導致執行任意程式碼或拒絕服務。

遠端主機受到 GLSA-201605-06 中所述的弱點影響 (Mozilla 產品：多個弱點)

在 Firefox、NSS、NSPR 和 Thunderbird 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者還可能發動攔截式攻擊、取得敏感資訊、偽造位址列、發動點擊劫持攻擊、繞過安全性限制和保護機制，或造成其他不明影響。
 因應措施：

目前尚無已知的因應措施。

The version of Firefox installed on the remote host is prior to 45.0 and is affected by multiple vulnerabilities : 

 - Mozilla Network Security Services (NSS) contains an overflow condition. The issue is triggered as user-supplied input is not properly validated when parsing ASN.1 structures. With a specially crafted certificate, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-1950) 
 - A flaw exists in the 'ValueNumberer::fixupOSROnlyLoop()' function in 'jit/ValueNumbering.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw in the 'Downscaler::BeginFrame()' function in 'image/Downscaler.cpp' exists that is triggered when failing to compute filters for image downscaling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952, CVE-2016-1953)
 - A flaw exists in the 'JSScript::maybeSweepTypes()' function in 'vm/TypeInference.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists in the 'DispatchEvents()' function in 'layout/style/nsAnimationManager.h' and 'layout/style/nsTransitionManager.h' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists in 'dom/base/Console.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists in the 'PeerConnectionMedia::SelfDestruct_m()' function in 'media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)
 - A flaw exists in the 'nsICODecoder::ReadDirEntry()' function in 'image/decoders/nsICODecoder.cpp' that is triggered when rendering ICO sub-images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'nsIDNService::IDNA2008ToUnicode()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling image decoding. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'DiscardTransferables()' function in 'vm/StructuredClone.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exits in the 'Assembler::GetCF32Target()' function in 'jit/arm/Assembler-arm.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'GetPcScript()' function in 'jit/JitFrames.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'JSFunction::isDerivedClassConstructor()' function in 'js/src/jsfun.cpp' that is triggered when handling lazy self-hosted functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'js/src/jit/Lowering.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exits in the 'EventListenerManager::HandleEventInternal()' function in 'dom/events/EventListenerManager.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'layout/base/nsRefreshDriver.cpp' that is triggered when handling transition events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'dom/media/systemservices/CamerasChild.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'dom/xslt/xslt/txMozillaTextOutput.cpp' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in 'dom/gamepad/windows/WindowsGamepad.cpp' that is triggered when handling 'WindowsGamepadService' shutdown. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)
 - A flaw exists in the 'nsCSPContext::SendReports()' function in 'dom/security/nsCSPContext.cpp' that is triggered during the handling of Content Security Policy (CSP) violation reports. This may allow a context-dependent attacker to overwrite arbitrary files on a user's machine and potentially gain elevated privileges. (CVE-2016-1954)
 - A flaw exists in 'dom/security/nsCSPContext.cpp' that is due to Content Security Policy (CSP) violation reports containing full path information for cross-origin iframe navigations in violation of the CSP specification. This may allow a context-dependent attacker to gain unauthorized access to sensitive information. (CVE-2016-1955)
 - A flaw exists in 'gfx/gl/GLContext.cpp' when using Intel Video cards that is triggered when performing WebGL operations that require a large amount buffer to be allocated from video memory. This may allow a context-dependent to cause a consumption of memory resources that will persist until the system has been restarted. (CVE-2016-1956)
 - Google Stagefright contains a flaw that is triggered during the handling of array destruction during MPEG4 video file processing. This may allow a context-dependent attacker to cause a memory leak, with unspecified consequences. (CVE-2016-1957)
 - An unspecified flaw exists that may allow a context-dependent attacker to spoof the user's address bar. No further details have been provided. (CVE-2016-1958)
 - A flaw exists  in Service Worker Manager that is triggered when handling the Clients API. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1959)
 - A flaw exists in  use-after-free error in the HTML5 string parser. The issue is triggered when parsing a set of table-related tags in a foreign fragment context such as SVG. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1960)
 - A flaw exists in use-after-free error in the 'nsHTMLDocument::SetBody()' function in 'dom/html/nsHTMLDocument.cpp'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1961)
 - A flaw exists in use-after-free error in 'netwerk/sctp/datachannel/DataChannel.cpp' when using multiple 'WebRTC' data channel connections and freeing a data channel connection from within a call. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1962)
 - A flaw exists in the 'FileReader::DoReadData()' function in 'dom/base/FileReader.cpp'. The issue is triggered as user-supplied input is not properly validated when handling modifications to local files that occur while they are being read with the FileReader API. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1963)
 - A flaw exists in use-after-free error in the 'txAttribute::execute()' function in 'dom/xslt/xslt/txInstructions.cpp' that is triggered when handling XML transformation operations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1964)
 - A flaw exists in the 'nsLocation::SetProtocol()' function in 'dom/base/nsLocation.cpp' that is triggered when handling history navigation in combination with the location protocol property. This may allow a context-dependent attacker to spoof the contents of the address bar. (CVE-2016-1965)
 - A flaw exists that is triggered when handling history navigation in a restored browser session. This may potentially allow a context-dependent attacker to gain unauthorized access to cross-origin URL information. (CVE-2016-1967)
 - A pointer underflow condition exists in the 'Brotli' library. The issue is triggered as user-supplied input is not properly validated when the library is performing decompression. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2016-1968)
 - A use-after-free flaw exists in the Netscape Plugin Application Programming Interface (NPAPI) plugin within the 'nsNPObjWrapper::GetNewOrUsed()' function in 'dom/plugins/base/nsJSNPRuntime.cpp'. The issue is triggered when handling malicious scripted web content in concert with the plugin. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1966)
 - An integer underflow condition exists in the 'srtp_unprotect()' function in 'netwerk/srtp/src/srtp/srtp.c' that is triggered when handling SRTP packet lenghts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1970)
 - A flaw exists in the 'I420VideoFrame::CreateFrame()' function in WebRTC. The issue is triggered as user-supplied input is not properly validated due to a missing status check. This may potentially allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1971)
 - 'ibvpx' contains a use-after-free error in 'vpx_ports/vpx_once.h' related to a race condition. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1972)
 - A race condition exists in 'dom/media/systemservices/CamerasChild.h'. The issue is triggered as user-supplied input is not properly validated when handling block-level statistics. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1975)
 - A use-after-free flaw exists in 'DesktopDisplayDevice::operator=' in 'media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.cc'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1976)
 - A flaw exists in use-after-free error that is triggered by a race condition in 'GetStaticInstance' in WebRTC. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1973)
 - A flaw exists in the 'nsScannerString::AppendUnicodeTo()' function in 'parser/htmlparser/nsScannerString.cpp'. The issue is triggered when the program fails to allocate memory during handling of unicode strings. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1974)
 - Mozilla Network Security Services (NSS) contains a use-after-free error in the 'PK11_ImportDERPrivateKeyInfoAndReturnKey()' function. The issue is triggered when handling DER encoded keys. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1979)

 The Graphite/Libgraphite component used in Mozilla Firefox contains the following vulnerabilities : 

 - An out-of-bounds write flaw exists in the 'setAttr()' function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1969)
 - A flaw exists in the 'Machine::Code::decoder::analysis::set_ref()' function. The issue is triggered as user-supplied input is not properly validated. With a specially crafted font, a context-dependent attacker can corrupt memory to cause a denial of service in a process linked against the library or potentially execute arbitrary code. (CVE-2016-1977)
 - A flaw exists in the 'GetTableInfo()' function in 'TtfUtil.cpp' related to the use of uninitialized memory when handling a specially crafted font. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-2790)
 - An out-of-bounds read flaw exists in the 'GlyphCache::glyph()' function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2791)
 - An out-of-bounds read flaw exist in the 'getAttr()' function in 'Slot.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2792)
 - An out-of-bounds read flaw in 'CachedCmap.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2793)
 - An out-of-bounds read flaw in the 'CmapSubtable12NextCodepoint()' function in 'TtfUtil.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2794)
 - A flaw exists in the 'FileFace::get_table_fn()' function related to the use of uninitialized memory when handling a specially crafted font. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-2795)
 - An out-of-bounds write flaw exixts in the 'vm::Machine::Code::Code()' function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2796)
 - An out-of-bounds read flaw exists in the 'CmapSubtable12Lookup()' function in 'TtfUtil.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2797)
 - An out-of-bounds read flaw exists in the 'GlyphCache::Loader::Loader()' function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2798)
 - An out-of-bounds write flaw exists in the 'setAttr()' function in 'Slot.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2799)
 - An out-of-bounds read flaw exists in the 'getAttr()' function in 'Slot.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2800)
 - An out-of-bounds read flaw exists in the 'CmapSubtable12Lookup()' function in 'TtfUtil.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2801)
 - An out-of-bounds read flaw existsin the 'CmapSubtable4NextCodepoint()' function in 'TtfUtil.cpp' that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2802)

The specific version of Firefox that the system is running is reportedly affected by the following vulnerabilities:

- Mozilla Firefox contains a flaw in the ValueNumberer::fixupOSROnlyLoop() function in jit/ValueNumbering.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the Downscaler::BeginFrame() function in image/Downscaler.cpp that is triggered when failing to compute filters for image downscaling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the JSScript::maybeSweepTypes() function in vm/TypeInference.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the DispatchEvents() function in layout/style/nsAnimationManager.h and layout/style/nsTransitionManager.h that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in dom/base/Console.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the PeerConnectionMedia::SelfDestruct_m() function in media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1952)

- Mozilla Firefox contains a flaw in the nsICODecoder::ReadDirEntry() function in image/decoders/nsICODecoder.cpp that is triggered when rendering ICO sub-images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the nsIDNService::IDNA2008ToUnicode() function in netwerk/dns/nsIDNService.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated when handling image decoding. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the DiscardTransferables() function in vm/StructuredClone.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the Assembler::GetCF32Target() function in jit/arm/Assembler-arm.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the GetPcScript() function in jit/JitFrames.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the JSFunction::isDerivedClassConstructor() function in js/src/jsfun.cpp that is triggered when handling lazy self-hosted functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in js/src/jit/Lowering.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the EventListenerManager::HandleEventInternal() function in dom/events/EventListenerManager.cpp. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in layout/base/nsRefreshDriver.cpp that is triggered when handling transition events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in dom/media/systemservices/CamerasChild.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- libvpx contains a flaw in the vp8_mb_init_dequantizer() function in vp8/decoder/decodeframe.c that is triggered as user-supplied input is not properly validated. With specially crafted media content, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- libvpx contains a flaw in the vp8_loop_filter_frame_init() function in media/libvpx/vp8/common/loopfilter.c that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in dom/xslt/xslt/txMozillaTextOutput.cpp that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in dom/gamepad/windows/WindowsGamepad.cpp that is triggered when handling WindowsGamepadService shutdown. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1953)

- Mozilla Firefox contains a flaw in the nsCSPContext::SendReports() function in dom/security/nsCSPContext.cpp that is triggered during the handling of Content Security Policy (CSP) violation reports. This may allow a context-dependent attacker to overwrite arbitrary files on a user's machine and potentially gain elevated privileges. (CVE-2016-1954)

- Mozilla Firefox contains a flaw in dom/security/nsCSPContext.cpp that is due to Content Security Policy (CSP) violation reports containing full path information for cross-origin iframe navigations in violation of the CSP specification. This may allow a context-dependent attacker to gain unauthorized access to sensitive information. (CVE-2016-1955)

- Mozilla Firefox contains a flaw in gfx/gl/GLContext.cpp when using Intel Video cards that is triggered when performing WebGL operations that require a large amount buffer to be allocated from video memory. This may allow a context-dependent to cause a consumption of memory resources that will persist until the system has been restarted. (CVE-2016-1956)

- Google Stagefright contains a flaw that is triggered during the handling of array destruction during MPEG4 video file processing. This may allow a context-dependent attacker to cause a memory leak, with unspecified consequences.
 (CVE-2016-1957)

- Mozilla Firefox contains an unspecified flaw that may allow a context-dependent attacker to spoof the user's address bar. No further details have been provided. (CVE-2016-1958)

- Mozilla Firefox contains a flaw in Service Worker Manager that is triggered when handling the Clients API. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1959)

- Mozilla Firefox contains a use-after-free error in the HTML5 string parser. The issue is triggered when parsing a set of table-related tags in a foreign fragment context such as SVG. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1960)

- Mozilla Firefox contains a use-after-free error in the nsHTMLDocument::SetBody() function in dom/html/nsHTMLDocument.cpp. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1961)

- Mozilla Firefox contains a use-after-free error in netwerk/sctp/datachannel/DataChannel.cpp when using multiple WebRTC data channel connections and freeing a data channel connection from within a call. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1962)

- Mozilla Firefox contains a flaw in the FileReader::DoReadData() function in dom/base/FileReader.cpp. The issue is triggered as user-supplied input is not properly validated when handling modifications to local files that occur while they are being read with the FileReader API. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1963)

- Mozilla Firefox contains a use-after-free error in the txAttribute::execute() function in dom/xslt/xslt/txInstructions.cpp that is triggered when handling XML transformation operations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1964)

- Mozilla Firefox contains a flaw in the nsLocation::SetProtocol() function in dom/base/nsLocation.cpp that is triggered when handling history navigation in combination with the location protocol property. This may allow a context-dependent attacker to spoof the contents of the address bar. (CVE-2016-1965)

- Mozilla Firefox contains a flaw that is triggered when handling history navigation in a restored browser session. This may potentially allow a context-dependent attacker to gain unauthorized access to cross-origin URL information. (CVE-2016-1967)

- Mozilla Firefox contains a pointer underflow condition in the Brotli library. The issue is triggered as user-supplied input is not properly validated when the library is performing decompression. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2016-1968)

- Mozilla Firefox contains a use-after-free flaw in the Netscape Plugin Application Programming Interface (NPAPI) plugin within the nsNPObjWrapper::GetNewOrUsed() function in dom/plugins/base/nsJSNPRuntime.cpp. The issue is triggered when handling malicious scripted web content in concert with the plugin. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1966)

- Mozilla Firefox contains an integer underflow condition in the srtp_unprotect() function in netwerk/srtp/src/srtp/srtp.c that is triggered when handling SRTP packet lenghts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1970)

- Mozilla Firefox contains a flaw in the I420VideoFrame::CreateFrame() function in WebRTC. The issue is triggered as user-supplied input is not properly validated due to a missing status check. This may potentially allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1971)

- Mozilla Firefox contains a race condition in dom/media/systemservices/CamerasChild.h. The issue is triggered as user-supplied input is not properly validated when handling block-level statistics. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1975)

- Mozilla Firefox contains a use-after-free flaw in DesktopDisplayDevice::operator= in media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.cc. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1976)

- libvpx contains a use-after-free error in vpx_ports/vpx_once.h related to a race condition. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 (CVE-2016-1972)

- Mozilla Firefox contains a use-after-free error that is triggered by a race condition in GetStaticInstance in WebRTC. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1973)

- Mozilla Firefox contains a flaw in the nsScannerString::AppendUnicodeTo() function in parser/htmlparser/nsScannerString.cpp. The issue is triggered when the program fails to allocate memory during handling of unicode strings. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1974)

- Mozilla Network Security Services (NSS) contains a use-after-free error in the PK11_ImportDERPrivateKeyInfoAndReturnKey() function. The issue is triggered when handling DER encoded keys. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 (CVE-2016-1979)

- Graphite/Libgraphite contains a flaw in the Machine::Code::decoder::analysis::set_ref() function. The issue is triggered as user-supplied input is not properly validated. With a specially crafted font, a context-dependent attacker can corrupt memory to cause a denial of service in a process linked against the library or potentially execute arbitrary code. (CVE-2016-1977)

- Graphite/Libgraphite contains a flaw in the GetTableInfo() function in TtfUtil.cpp related to the use of uninitialized memory when handling a specially crafted font. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-2790)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the GlyphCache::glyph() function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2791)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the getAttr() function in Slot.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2792)

- Graphite/Libgraphite contains an out-of-bounds read flaw in CachedCmap.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2793)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the CmapSubtable12NextCodepoint() function in TtfUtil.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2794)

- Graphite/Libgraphite contains a flaw in the FileFace::get_table_fn() function related to the use of uninitialized memory when handling a specially crafted font. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-2795)

- Graphite/Libgraphite contains an out-of-bounds write flaw in the vm::Machine::Code::Code() function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2796)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the CmapSubtable12Lookup() function in TtfUtil.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2797)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the GlyphCache::Loader::Loader() function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2798)

- Graphite/Libgraphite contains an out-of-bounds write flaw in the setAttr() function in Slot.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2799)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the getAttr() function in Slot.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2800)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the CmapSubtable12Lookup() function in TtfUtil.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2801)

- Graphite/Libgraphite contains an out-of-bounds read flaw in the CmapSubtable4NextCodepoint() function in TtfUtil.cpp that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-2802)

- Graphite/Libgraphite contains an out-of-bounds write flaw in the setAttr() function that is triggered when handling maliciously crafted fonts. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1969)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
89990	SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2016:0777-1)	Nessus	SuSE Local Security Checks	2016/3/17	2021/1/6	critical
91985	openSUSE Security Update : Mozilla Thunderbird (openSUSE-2016-848)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	high
91986	openSUSE Security Update : Mozilla Thunderbird (openSUSE-2016-851)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	high
90031	Debian DSA-3520-1 : icedove - security update	Nessus	Debian Local Security Checks	2016/3/21	2021/1/11	critical
99765	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2016-1002)	Nessus	Huawei Local Security Checks	2017/5/1	2021/1/6	critical
91379	GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)	Nessus	Gentoo Local Security Checks	2016/5/31	2022/12/5	critical
89816	Oracle Linux 5 / 6 / 7：firefox (ELSA-2016-0373)	Nessus	Oracle Linux Local Security Checks	2016/3/10	2024/10/22	critical
89826	Ubuntu 14.04 LTS：Firefox 弱點 (USN-2917-1)	Nessus	Ubuntu Local Security Checks	2016/3/10	2024/8/27	critical
89990	SUSE SLED11 / SLES11 安全性更新：MozillaFirefox、mozilla-nspr、mozilla-nss (SUSE-SU-2016:0777-1)	Nessus	SuSE Local Security Checks	2016/3/17	2021/1/6	critical
91985	openSUSE 安全性更新：Mozilla Thunderbird (openSUSE-2016-848)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	high
91986	openSUSE 安全性更新：Mozilla Thunderbird (openSUSE-2016-851)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	high
90031	Debian DSA-3520-1：icedove - 安全性更新	Nessus	Debian Local Security Checks	2016/3/21	2021/1/11	critical
91379	GLSA-201605-06：Mozilla 產品：多個弱點	Nessus	Gentoo Local Security Checks	2016/5/31	2022/12/5	critical
9207	Mozilla Firefox < 45.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/4/8	2019/3/6	high
802023	Firefox < 45 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2016/9/7		critical

检测

插件搜索

critical

high

high

critical

critical

critical

critical

critical

critical

high

high

critical

critical

high

critical