Christian Holler、Carsten Book、Gary Kwong, Jesse Ruderman、Andrew McCreight 和 Phil Ringnalda 在 Thunderbird 中发现多个内存安全问题。如果用户受到诱骗打开特制的消息，攻击者可能利用这些漏洞，通过应用程序崩溃造成拒绝服务或执行任意代码。
(CVE-2016-2836)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

已在 Icedove（Debian 版本的 Mozilla Thunderbird 邮件客户端）中发现多种安全问题：多个内存安全错误可能导致执行任意代码或拒绝服务。

对于 Debian 7“Wheezy”，这些问题已在版本 1:45.3.0-1~deb7u1 中修复。

建议您升级 icedove 程序包。

注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

已在 Icedove（Debian 版本的 Mozilla Thunderbird 邮件客户端）中发现多种安全问题：多个内存安全错误可能导致执行任意代码或拒绝服务。

在 Mozilla Firefox Web 浏览器中发现多种安全问题：多种内存安全错误、缓冲区溢出及其他实现错误，可能导致执行任意代码、跨站脚本、信息泄露以及绕过同源策略。

firefox 的更新现在可用于 Red Hat Enterprise Linux 5、Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7。

Red Hat 产品安全团队已将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。

Mozilla Firefox 是一款开源 Web 浏览器。

此更新将 Firefox 升级到 45.3.0 ESR 版。

安全补丁：

* 在处理畸形 Web 内容时发现多个缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。（CVE-2016-2836、CVE-2016-5258、CVE-2016-5259、CVE-2016-5252、CVE-2016-5263、CVE-2016-2830、CVE-2016-2838、CVE-2016-5254、CVE-2016-5262、CVE-2016-5264、CVE-2016-5265、CVE-2016-2837）

Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢原始报告者 Looben Yang、Carsten Book、Christian Holler、Gary Kwong、Jesse Ruderman、Andrew McCreight、Phil Ringnalda、Philipp、Toni Huttunen、Georg Koppen、Abhishek Arya、Atte Kettunen、Nils、Nikita Arykov 及 Abdulrahman Alqabandi。

此 MozillaThunderbird 更新可修复下列问题：

- Thunderbird 45.3.0 的更新 (boo#991809)

- 不可在 mail.compose.other.header 中使用 Disposition-Notification-To

- 在收到的消息中，“编辑新消息”功能预先将发送者填写为撰写者。

- 某些消息造成草稿汇总数据库崩溃。安全补丁：

- MFSA 2016-62/CVE-2016-2836 多项内存安全危害

- MFSA 2016-63/CVE-2016-2830 (bmo#1255270) 页面关闭时 Favicon 网络连接可持续存在

- MFSA 2016-64/CVE-2016-2838 (bmo#1279814) 渲染具有双向内容的 SVG 时发生缓冲区溢出

- MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo 转译因 FFmpeg 0.10 的内存分配问题而崩溃

- MFSA 2016-67/CVE-2016-5252 (bmo#1268854) 2D 图形渲染期间发生堆栈下溢

- MFSA 2016-70/CVE-2016-5254 (bmo#1266963) 使用 alt 键和顶层菜单时出现释放后使用问题

- MFSA 2016-72/CVE-2016-5258 (bmo#1279146) WebRTC 会话关闭期间 DTLS 出现释放后使用问题

- MFSA 2016-73/CVE-2016-5259 (bmo#1282992) 含有嵌套同步事件的服务工作线程出现释放后使用问题

- MFSA 2016-76/CVE-2016-5262 (bmo#1277475) marquee 标签上的脚本可在沙盒 iframe 中执行

- MFSA 2016-77/CVE-2016-2837 (bmo#1274637) 视频回放期间 ClearKey 内容解密模块 (CDM) 发生缓冲区溢出

- MFSA 2016-78/CVE-2016-5263 (bmo#1276897) 显示转换过程中发生类型混淆问题

- MFSA 2016-79/CVE-2016-5264 (bmo#1286183) 应用 SVG 效果时发生释放后使用问题

- MFSA 2016-80/CVE-2016-5265 (bmo#1278013) 使用本地 HTML 文件和已保存的快捷方式文件时发生同源策略冲突

- 潜在缓冲区溢出问题的补丁 (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch]

- 为 appdata.xml 添加一个屏幕截图

Versions of Mozilla Firefox ESR less than or equal to 45.2 are unpatched for the following vulnerabilities :

 - A flaw exists due to the program failing to close connections after requesting favicons. This may allow a context-dependent attacker to continue to send requests to the user's browser and gain access to potentially sensitive information.
 - A flaw exists in 'js/src/frontend/Parser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::array_splice_impl()' function in 'js/src/jsarray.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain unspecified user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. 
 - A flaw exists in the 'OSXNotificationCenter::ShowAlertWithIconData()' function in 'widget/cocoa/OSXNotificationCenter.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free condition exists in 'dom/media/GraphDriver.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'Http2Session::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/Http2Session.cpp' and 'SpdySession31::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/SpdySession31.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'ClearKeyDecryptor::Decrypt()' function in 'media/gmp-clearkey/0.1/ClearKeyDecryptionManager.cpp' used by the Encrypted Media Extensions (EME) API. The issue is triggered as user-supplied input is not properly validated when handling video files. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2016-2837)
 - A use-after-free error exists in the 'nsXULPopupManager::KeyDown()' function in 'layout/xul/nsXULPopupManager.cpp'. The issue is triggered when using the alt key in conjunction with top level menu items in Firefox. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.(CVE-2016-5254)
 - A use-after-free error exists in 'WebRTC'. The issue is triggered when handling 'DTLS' objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5258)
 - A flaw exists that is due to event handler attributes on a 'marquee' tag being executed inside a sandboxed iframe that does not have the allow-scripts flag set. This may allow a context-dependent attacker to bypass XSS protection mechanisms. (CVE-2016-5262)
 - A use-after-free error exists in the 'nsNodeUtils::NativeAnonymousChildListChange()' function. The issue is triggered when applying effects to SVG element. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5264)

Versions of Mozilla Firefox prior to 48.0 are unpatched for the following vulnerabilities :

 - A flaw is triggered as certain input is not properly validated when handling the 'BitmapInfoHeader' in icons. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/frontend/Parser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::array_splice_impl()' function in 'js/src/jsarray.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw is triggered as certain unspecified user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'OSXNotificationCenter::ShowAlertWithIconData()' function in 'widget/cocoa/OSXNotificationCenter.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Http2Session::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/Http2Session.cpp' and 'SpdySession31::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/SpdySession31.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in the 'Assembler::bind()' function in 'js/src/jit/arm/Assembler-arm.cpp' that is triggered when handling certain labels. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CodeGeneratorShared::assignBailoutId()' function in 'js/src/jit/shared/CodeGenerator-shared.cpp' that is triggered when handling allocation errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in 'woff2_dec.cc' that is triggered as certain input is not properly validated when decompressing files. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'SetPaintPattern()' function in 'gfx/2d/DrawTargetSkia.cpp' that is triggered when handling gradients with non-finite endpoints. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'PeerConnectionMedia::ProtocolProxyQueryHandler::OnProxyAvailable()' function in 'media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'media/mtransport/nr_timer.cpp' that is triggered when handling timers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A race condition exists in the 'MatchKeyHash()' function in 'security/pkix/lib/pkixocsp.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'ClearKeyDecryptor::Decrypt()' function in 'media/gmp-clearkey/0.1/ClearKeyDecryptionManager.cpp' used by the Encrypted Media Extensions (EME) API. The issue is triggered as user-supplied input is not properly validated when handling video files. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw is triggered as file URIs dragged from a web page to a different piece of software failed to have the contents properly filtered. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw is triggered when handling right-to-left character sets with left-to-right character sets. This may allow a context-dependent attacker to spoof the address bar.
 - A flaw is triggered when handling certain specific 'about:' URLs. This may allow a context-dependent attacker to spoof the contents of system information or error messages.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' due to the program leaking potentially sensitive resources of URLs through the Resource Timing API during page navigation. This may allow a context-dependent attacker to potentially disclose sensitive information.
 - An integer overflow condition exists in the 'WebSocketChannel::ProcessInput()' function in 'netwerk/protocol/websocket/WebSocketChannel.cpp'. The issue is triggered as user-supplied input is not properly validated when handling specially crafted 'WebSocketChannel' packets. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::NativeAnonymousChildListChange()' function. The issue is triggered when applying effects to SVG element. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'js::PreliminaryObjectArray::sweep()' function in JavaScript. The issue is triggered when handling objects and pointers during incremental garbage collection. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'WebRTC'. The issue is triggered when handling DTLS objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the r'estorableFormNodes()' function in 'toolkit/modules/sessionstore/XPathGenerator.jsm' that is due to the program persistently storing passwords in in plaintext in session restore data. This may allow a context-dependent attacker to potentially gain access to password information.
 - A use-after-free error exists in the 'WorkerPrivate::DestroySyncLoop()' function in 'dom/workers/WorkerPrivate.cpp'. The issue is triggered when handling nested sync event loops in Service Workers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'nsDisplayList::HitTest()' function in 'layout/base/nsDisplayList.cpp' that is triggered during the handling of display transformations. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'nsBaseChannel::Redirect()' function in 'netwerk/base/nsBaseChannel.cpp' that is triggered when a malicious shortcut is called from the same directory as a local HTML file. This may allow a local attacker to bypass the same-origin policy.
 - An underflow condition exists in the 'mozilla::gfx::BasePoint4d()' function in 'gfx/2d/Matrix.h'. The issue is triggered as user-supplied input is not properly validated when calculating clipping regions in 2D graphics. This may allow a context-dependent attacker to cause a stack buffer underflow, potentially allowing the execution of arbitrary code.
 - An overflow condition exists in the 'nsBidi::BracketData::ProcessPDI()' function in 'layout/base/nsBidi.cpp'. The issue is triggered as user-supplied input is not properly validated when rendering SVG format graphics with directional content. This may allow a context-dependent attacker to cause a heap-based buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'Cairo' graphics layer that is triggered when allocating the 'LibAV' header during video decoding. This may allow a context-dependent attacker to crash the Cairo graphics layer.
 - A flaw is due to event handler attributes on a 'marquee' tag being executed inside a sandboxed iframe that does not have the allow-scripts flag set. This may allow a context-dependent attacker to bypass XSS protection mechanisms.
 - A flaw is due to the program failing to close connections after requesting favicons. This may allow a context-dependent attacker to continue to send requests to the user's browser and gain access to potentially sensitive information.
 - A use-after-free error exists in the 'nsXULPopupManager::KeyDown()' function in 'layout/xul/nsXULPopupManager.cpp'. The issue is triggered when using the alt key in conjunction with top level menu items in Firefox. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw is triggered when decoding url-encoded values in 'data:' URLs. This may allow a context-dependent attacker to use non-ASCII or emoji characters to spoof the address bar.
 - A flaw exists in 'toolkit/mozapps/update/updater/updater.cpp' that is due to the 'Updater', when opened using the callback application path parameter, creating a copy of a user specified file as a callback file with a locked hardlink. This may allow a local attacker to run the target file and gain elevated privileges.
 - An unspecified flaw exists that is triggered during the handling of TTC detection. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided.
 - An out-of-bounds access flaw exists in the 'ReconstructTransformedHmtx()' function in 'woff2_dec.cc' that may allow a context-dependent attacker to have an unspecified impact.
 - An unspecified flaw exists in 'woff2_dec.cc' that may allow a context-dependent attacker to have an unspecified impact.
 - An unspecified flaw exists in 'woff2_dec.cc' that is triggered during memory allocation, which may allow a context-dependent attacker to crash a process linked against the library.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93682	Ubuntu 14.04 LTS / 16.04 LTS：Thunderbird 漏洞 (USN-3073-1)	Nessus	Ubuntu Local Security Checks	2016/9/23	2024/8/27	high
93831	Debian DLA-640-1：icedove 安全更新	Nessus	Debian Local Security Checks	2016/10/4	2021/1/11	high
93849	Debian DSA-3686-1：icedove - 安全更新	Nessus	Debian Local Security Checks	2016/10/5	2021/1/11	high
92731	Debian DSA-3640-1：firefox-esr - 安全更新	Nessus	Debian Local Security Checks	2016/8/5	2021/1/11	critical
92717	RHEL 5/6/7：firefox (RHSA-2016:1551)	Nessus	Red Hat Local Security Checks	2016/8/4	2020/5/29	critical
93363	openSUSE 安全更新：MozillaThunderbird (openSUSE-2016-1057)	Nessus	SuSE Local Security Checks	2016/9/8	2021/1/19	critical
9485	Mozilla Firefox ESR < 45.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/8/26	2019/11/6	medium
9484	Mozilla Firefox < 48.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/8/26	2019/3/6	medium

检测

插件搜索

high

high

high

critical

critical

critical

medium

medium