在 Thunderbird 中發現多個記憶體安全問題。如果使用者遭誘騙而開啟特製訊息，攻擊者可能惡意利用這些弱點，透過應用程式損毀造成拒絕服務或執行任意程式碼。(CVE-2016-9893、CVE-2017-5373)

Andrew Krasichkov 發現，即使內容安全性原則 (CSP) 不允許內嵌 JavaScript，卻仍執行 <marquee> 元素上的事件處理常式。如果使用者遭到誘騙而在瀏覽器內容中開啟特製的網站，攻擊者可能加以惡意利用而發動跨網站指令碼 (XSS) 攻擊。
(CVE-2016-9895)

在某些情況下，在 WebGL 中發生記憶體損毀問題。如果使用者遭誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2016-9897)

在某些情況下，操控編輯器中的 DOM 子樹狀目錄時，發生釋放後使用。如果使用者遭誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2016-9898)

在某些情況下，操控 DOM 事件和音效元素時，發生釋放後使用。如果使用者遭誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2016-9899)

據發現，載入 SVG 影像時應封鎖的外部資源可使用 data: URL 有關的文字插入問題。
攻擊者可能會利用此弱點取得敏感資訊。(CVE-2016-9900)

Jann Horn 發現 JavaScript 對應/集容易受到計時攻擊。如果使用者遭到誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點取得跨網域的敏感資訊。(CVE-2016-9904)

新增或移除子文件時在 EnumerateSubDocuments 中發生損毀。如果使用者遭到誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點執行任意程式碼。(CVE-2016-9905)

在某些情況下，JIT 程式碼配置可允許繞過 ASLR 保護。如果使用者遭誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2017-5375)

Nicolas Gregoire　發現在某些情況下，操控 XSLT 文件中的 XSL 時發生釋放後使用。如果使用者遭誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2017-5376)

Jann Horn 發現，可在頁面之間分享的 JavaScript 物件雜湊程式碼中發現物件的位址。如果使用者遭到誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點取得敏感資訊。(CVE-2017-5378)

在某些情況下，在 DOM 操控 SVG 內容期間發生釋放後使用。如果使用者遭誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2017-5380)

Armin Razmjou 發現某些 unicode glyphs 未觸發 punycode 顯示。如果使用者遭到誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點偽造 URL 列內容。(CVE-2017-5383)

Jerri Rice 發現開發工具 JSON 檢視程式中不安全的通訊方法。攻擊者可能會利用此弱點取得額外權限。(CVE-2017-5390)

Filipe Gomes　發現在某些情況下，媒體解碼器發生釋放後使用。如果使用者遭誘騙而在瀏覽內容中開啟特製的網站，攻擊者可能會利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2017-5396)

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 Firefox 中發現多個記憶體安全問題。如果使用者遭誘騙而開啟特製網站，攻擊者可能惡意利用這些弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2017-5373、CVE-2017-5374)

在某些情況下，JIT 程式碼配置可允許繞過 ASLR 保護。如果使用者遭誘騙而開啟特製網站，攻擊者可能惡意利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。
(CVE-2017-5375)

Nicolas Gregoire　發現在某些情況下，操控 XSLT 文件中的 XSL 時發生釋放後使用。如果使用者遭誘騙而開啟特製網站，攻擊者可能惡意利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2017-5376)

Atte Kettunen 發現在某些情況下，Skia 會發生記憶體損毀問題。如果使用者遭誘騙而開啟特製網站，攻擊者可能惡意利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。
(CVE-2017-5377)

Jann Horn 發現，可在頁面之間分享的 JavaScript 物件雜湊程式碼中發現物件的位址。如果使用者遭到誘騙而開啟特製的網站，攻擊者可能加以惡意利用，藉此取得敏感資訊。(CVE-2017-5378)

在某些情況下，網頁動畫會發生釋放後使用。如果使用者遭誘騙而開啟特製網站，攻擊者可能惡意利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。
(CVE-2017-5379)

在某些情況下，在 DOM 操控 SVG 內容期間發生釋放後使用。如果使用者遭誘騙而開啟特製網站，攻擊者可能惡意利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2017-5380)

Jann Horn 發現當一般名稱包含斜線時，憑證檢視器中的　'export' 函式會強制本機檔案系統瀏覽。如果使用者遭誘騙而匯出特製憑證，攻擊者可能會利用此弱點將具有任意檔案名稱的內容儲存到不安全的位置。
(CVE-2017-5381)

Jerri Rice 發現 RSS 摘要的摘要預覽可用來擷取具權限內容產生的錯誤和例外狀況。攻擊者可能會利用此弱點取得敏感資訊。(CVE-2017-5382)

Armin Razmjou 發現某些 unicode glyphs 未觸發 punycode 顯示。攻擊者可能會利用此弱點來偽造 URL 列內容。(CVE-2017-5383)

Paul Stone 和 Alex Chapman 發現完整 URL 路徑會暴露到 Proxy 自動組態 (PAC) 檔案指定的 JavaScript 函式。如果使用者啟用 Web Proxy 自動偵測 (WPAD)，攻擊者可能會利用此弱點來取得敏感資訊。
(CVE-2017-5384)

Muneaki Nishimura 發現在多部分頻道中傳送的資料將略過 Referrer-Policy 回應標頭。攻擊者可能加以惡意利用，藉此取得敏感資訊。
(CVE-2017-5385)

Muneaki Nishimura 發現 WebExtensions 會影響使用 data: protocol 的其他延伸模組。如果使用者遭誘騙而安裝特製附加元件，攻擊者可能會利用此弱點取得敏感資訊或取得額外權限。(CVE-2017-5386)

Mustafa Hasan 發現可使用 <track> 元素來判斷本機檔案是否存在。攻擊者可能會利用此弱點取得敏感資訊。(CVE-2017-5387)

Cullen Jennings 發現 WebRTC 可用來產生大量的 UDP 流量。攻擊者可能會利用此弱點來發動分散式拒絕服務 (DDOS) 攻擊。(CVE-2017-5388)

Kris Maglione 發現 WebExtensions 可使用 mozAddonManager API，作法為以適當的權限修改網站上的 CSP 標頭，然後使用主機要求將指令碼載入重新導向至惡意網站。如果使用者遭誘騙而安裝特製附加元件，攻擊者可能會利用此弱點在未經使用者同意的情況下安裝其他附加元件。
(CVE-2017-5389)

Jerri Rice 發現開發工具 JSON 檢視程式中不安全的通訊方法。攻擊者可能會利用此弱點取得額外權限。(CVE-2017-5390)

Jerri Rice 發現內容使用的 about: pages 可在 iframe 中載入有權限的 about: pages。攻擊者可能會利用此弱點以及這些 about: pages 中其中一個 content-injection 錯誤取得額外權限。(CVE-2017-5391)

Stuart Colville 發現 mozAddonManager 允許從公開存取網站 addons.mozilla.org 的 CDN 安裝延伸。如果使用者遭到誘騙而安裝特製的附加元件，攻擊者可能會利用此弱點結合 Mozilla 的 AMO 網站上的跨網站指令碼 (XSS) 攻擊，來安裝其他附加元件。(CVE-2017-5393)

Filipe Gomes　發現在某些情況下，媒體解碼器發生釋放後使用。如果使用者遭誘騙而開啟特製網站，攻擊者可能惡意利用此弱點，透過應用程式損毀造成拒絕服務或是執行任意程式碼。
(CVE-2017-5396).

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

現已提供適用於 Red Hat Enterprise Linux 5、Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7 的 thunderbird 更新。Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。Mozilla Thunderbird 是獨立式郵件與新聞群組用戶端。此更新會將 Thunderbird 升級至 45.7.0 版。安全性修正：* 在處理格式錯誤的 Web 內容過程中發現多個缺陷。包含惡意內容的網頁可導致 Thunderbird 損毀，或可能利用執行 Thunderbird 之使用者的權限來執行任意程式碼。(CVE-2017-5373、CVE-2017-5375、CVE-2017-5376、CVE-2017-5378、CVE-2017-5380、CVE-2017-5383、CVE-2017-5390、CVE-2017-5396) Red Hat 感謝 Mozilla 專案報告這些問題。上游確認 Jann Horn、Filipe Gomes、Nils、Armin Razmjou、Christian Holler、Gary Kwong、Andre Bargull、Jan de Mooij、Tom Schuster、Oriol、Rh0、Nicolas Gregoire 及 Jerri Rice 為原始報告者。

來自 Red Hat 安全公告 2017:0238： 現已提供適用於 Red Hat Enterprise Linux 5、Red Hat Enterprise Linux 6 與 Red Hat Enterprise Linux 7 的 thunderbird 更新。 Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。 Mozilla Thunderbird 是獨立式郵件與新聞群組用戶端。 此更新會將 Thunderbird 升級至 45.7.0 版。 安全性修正： * 在處理格式錯誤的 Web 內容過程中發現多個瑕疵。包含惡意內容的網頁可導致 Thunderbird 損毀，或可能利用執行 Thunderbird 之使用者的權限來執行任意程式碼。(CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378, CVE-2017-5380, CVE-2017-5383, CVE-2017-5390, CVE-2017-5396) Red Hat 感謝 Mozilla 專案報告這些問題。上游確認 Jann Horn、Filipe Gomes、Nils、Armin Razmjou、Christian Holler、Gary Kwong、Andre Bargull、Jan de Mooij、Tom Schuster、Oriol、Rh0、Nicolas Gregoire 及 Jerri Rice 為原始報告者。

遠端 macOS 或 Mac OS X 主機上安裝的 Mozilla Firefox ESR 版本為 45.7 之前的 45.x 版。因此，會受到以下弱點影響：- Mozilla 開發人員與社群人員 Christian Holler、Gary Kwong、Andre Bargull、Jan de Mooij、Tom Schuster 和 Oriol 報告 Firefox 50.1 版和 Firefox ESR 45.6 版中出現記憶體安全錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-5373) - JIT 程式碼配置可允許繞過 ASLR 和 DEP 保護，造成潛在的記憶體損毀攻擊。(CVE-2017-5375) - 操控 XSLT 文件中的 XSL 時出現釋放後使用錯誤 (CVE-2017-5376) - 有兩個頁面共用 JavaScript 物件的雜湊程式碼。這會造成指標遺失，因為可以透過雜湊程式碼發現物件的位址，還會造成使用這些雜湊程式碼的物件內容資料外洩。(CVE-2017-5378) - 在 DOM 操控 SVG 內容期間，透過模糊測試發現潛在的釋放後使用弱點。(CVE-2017-5380) - 含有特定 unicode 字符用於替代連字號和引號的 URL 無法正確觸發 punycode 顯示，使得可以在位址列中發動網域名稱偽造攻擊。(CVE-2017-5383) - WebExtension 指令碼可使用「data:」通訊協定來影響其他使用相同通訊協定的 Web 延伸所載入的頁面，造成受影響的延伸中出現潛在的資料洩漏或權限提升弱點。(CVE-2017-5386) - 開發人員工具中的 JSON 檢視器使用不安全的方法建立通訊通道，用以複製和檢視 JSON 或 HTTP 標頭資料，造成潛在的權限提升弱點。(CVE-2017-5390) - 若是在記憶體釋放媒體元素後觸發若干事件，在使用媒體檔案時，媒體解碼器中存在一個釋放後使用弱點。(CVE-2017-5396) 請注意，Tenable Network Security 已直接從 Mozilla 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端 Windows 主機上安裝的 Mozilla Firefox 版本比 51.0 舊。因此，會受到多個弱點影響：- Mozilla 開發人員與社群人員 Christian Holler、Gary Kwong、Andre Bargull、Jan de Mooij、Tom Schuster 和 Oriol 報告 Firefox 50.1 版和 Firefox ESR 45.6 版中出現記憶體安全錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-5373) - Mozilla 開發人員與社群成員 Gary Kwong、Olli Pettay、Tooru Fujisawa、Carsten Book、Andrew McCreight、Chris Pearce、Ronald Crane、Jan de Mooij、Julian Seward、Nicolas Pierron、Randell Jesup、Esther Monchari、Honza Bambas 和 Philipp 報告 Firefox 50.1 版中出現記憶體安全錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-5374) - JIT 程式碼配置可允許繞過 ASLR 和 DEP 保護，造成潛在的記憶體損毀攻擊。(CVE-2017-5375) - 操控 XSLT 文件中的 XSL 時出現釋放後使用錯誤 (CVE-2017-5376) - 使用轉換製作漸層時，Skia 中會出現記憶體損毀弱點，造成可能遭惡意利用的當機。(CVE-2017-5377) - 有兩個頁面共用 JavaScript 物件的雜湊程式碼。這會造成指標遺失，因為可以透過雜湊程式碼發現物件的位址，還會造成使用這些雜湊程式碼的物件內容資料外洩。(CVE-2017-5378) - 在與循環收集互動期間，透過模糊測試發現 Web 動畫中出現釋放後使用弱點。(CVE-2017-5379) - 在 DOM 操控 SVG 內容期間，透過模糊測試發現潛在的釋放後使用弱點。(CVE-2017-5380) - 當憑證中的「一般名稱」含有正斜線時，憑證檢視器中的「export」函式會強制執行本機檔案系統瀏覽，使得憑證內容可以用任意檔案名稱儲存在不安全的位置。(CVE-2017-5381) - RSS 摘要預覽可用來擷取特殊權限內容產生的錯誤和例外狀況，造成暴露出不應該出現在網路內容中的內部資訊。(CVE-2017-5382) - 含有特定 unicode 字符用於替代連字號和引號的 URL 無法正確觸發 punycode 顯示，使得可以在位址列中發動網域名稱偽造攻擊。(CVE-2017-5383) - Proxy 自動設定 (PAC) 檔案可指定一個 JavaScript 函式，要求所有包含完整 URL 路徑的 URL 要求，將暴露比在使用 HTTPS 情況下，傳送至 proxy 本身的更多資訊。通常 Proxy 自動設定檔案是由使用者或電腦擁有者親自指定且認定為無惡意，但如果使用者有啟用 Web Proxy 自動偵測 (WPAD)，就能從遠端提供此檔案。(CVE-2017-5384) - 在多部分通道中傳送的資料 (例如 multipart/x-mixed-replace MIME 類型) 會忽略參照位址原則回應標頭，造成可能洩漏使用該標頭的網站資訊。(CVE-2017-5385) - WebExtension 指令碼可使用「data:」通訊協定來影響其他使用相同通訊協定的 web 延伸所載入的頁面，造成受影響的延伸中出現潛在的資料洩漏或權限提升弱點。(CVE-2017-5386) - 發現存在特別要求的本機檔案，這是因為當 <track> 標記上的「source」屬性是指在本機載入來源頁面時所不存在的檔案，重複觸發「onerror」所致。(CVE-2017-5387) - 可使用 STUN 伺服器加上大量「webkitRTCPeerConnection」物件，在短時間內傳送大量 STUN 封包，這是因為 e10s 系統上沒有套用速率限制所致，造成得以發動拒絕服務攻擊。(CVE-2017-5388) - WebExtensions 可使用「mozAddonManager」API，作法為以適當的權限修改網站上的 CSP 標頭，然後使用主機要求將指令碼載入重新導向至惡意網站。如此可導致惡意延伸無需明確的使用者權限，即可另行安裝其他延伸。(CVE-2017-5389) - 開發人員工具中的 JSON 檢視器使用不安全的方法建立通訊通道，用以複製和檢視 JSON 或 HTTP 標頭資料，造成潛在的權限提升弱點。(CVE-2017-5390) - 網路內容使用的特殊「about:」頁面 (例如 RSS 摘要) 可以在 iframe 中載入特殊權限「about:」頁面。如果在其中一個頁面中發現內容插入錯誤，可能會造成潛在的權限提升弱點。(CVE-2017-5391) -「mozAddonManager」允許從公開存取網站 addons.mozilla.org 的 CDN 安裝延伸。這可能會讓惡意延伸得以從 CDN 另行安裝其他延伸，並加上在 Mozilla AMO 網站上發動 XSS 攻擊。(CVE-2017-5393) - 若是在記憶體釋放媒體元素後觸發若干事件，在使用媒體檔案時，媒體解碼器中存在一個釋放後使用弱點。(CVE-2017-5396) 請注意，Tenable Network Security 已直接從 Mozilla 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Versions of Mozilla Firefox ESR earlier than 45.7 are unpatched for the following vulnerabilities :

 - A flaw exists in JIT code allocation that may allow a context-dependent attacker to bypass the Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) protection mechanisms.
 - A use-after-free error exists in the 'txExecutionState::getVariable()' function in 'dom/xslt/xslt/txExecutionState.cpp' that is triggered when handling XSL in XSLT documents. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the program sharing hashed codes of JavaScripts objects between pages. This may allow a context-dependent attacker to gain access to potentially sensitive data by discovering the object's address through a pointer leak.
 - A use-after-free error exists in the 'PresShell::FlushPendingNotifications()' function in 'layout/base/PresShell.cpp' that is triggered during DOM manipulation of SVG content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the JSON viewer in the Developer Tools insecurely creating communication channels for copying and viewing JSON or HTTP headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data.
 - A flaw exists in the 'ICCallStubCompiler::guardFunApply()' function in 'js/src/jit/BaselineIC.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::createThisScriptedSingleton()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AddLazyFunctionsForCompartment()' function in 'js/src/jscompartment.cpp' that is triggered when handling references to a compartment's lazy functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::DefineTypedArrayElement()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DataViewObject::create()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::initEnvironmentChain()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the JavaScript JIT compiler that is triggered when handling windows. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDOMConstructor::HasInstance()' function in 'dom/base/nsDOMClassInfo.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocument::SetScriptGlobalObject()' function in 'dom/base/nsDocument.cpp' that is triggered when handling specially crafted media files. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered during the handling of a specially crafted URL that contains certain unicode glyphs for alternative hyphens and quotes. This may allow a context-dependent attacker to spoof the location bar.
 - A flaw exists that may allow WebExtension scripts to use the 'data: protocol' to affect pages loaded by other extensions. This may allow a context-dependent attacker to potentially disclose sensitive information or gain elevated privileges related to other extensions.

Versions of Mozilla Firefox prior to 51 are unpatched for the following vulnerabilities :

 - A flaw exists in JIT code allocation that may allow a context-dependent attacker to bypass the Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) protection mechanisms.
 - A use-after-free error exists in the 'txExecutionState::getVariable()' function in 'dom/xslt/xslt/txExecutionState.cpp' that is triggered when handling XSL in XSLT documents. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the program sharing hashed codes of JavaScript objects between pages. This may allow a context-dependent to gain access to potentially sensitive data by discovering the object's address through a pointer leak.
 - A use-after-free error exists in the 'nsDocument::GetAnimations()' function in 'dom/base/nsDocument.cpp' that is triggered when handling web animations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'PresShell::FlushPendingNotifications()' function in 'layout/base/PresShell.cpp' that is triggered during DOM manipulation of SVG content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the JSON viewer in the Developer Tools insecurely creating communication channels for copying and viewing JSON or HTTP headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data.
 - A flaw exists in the 'mozAddonManager' API that may allow a WebExtension attacker to modify CSP headers. This may allow a context-dependent attacker to use a host request to redirect script load to a malicious site, where it will install additional extensions without the user's consent.
 - A flaw exists in the 'RangeAnalysis::addBetaNodes()' function in 'js/src/jit/RangeAnalysis.cpp' related to improper comparisons being performed when adding beta nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/DOMMediaStream.cpp' that is triggered when handling media stream tracks. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Library::Create()' function in 'js/src/ctypes/Library.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Library::Create()' function in 'js/src/ctypes/Library.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/workers/ServiceWorkerRegistration.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsAttrAndChildArray::GrowBy()' function in 'dom/base/nsAttrAndChildArray.cpp' related to a missing return value check. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AppendUTF16toUTF8()' function in 'xpcom/string/nsReadableUtils.cpp' that is triggered when handling certain size calculations. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'xpcom/string/nsTSubstringTuple.cpp' that is triggered when handling substring tuble lengths. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An integer overflow condition exists in the 'RTCPPacketInformation::AddApplicationData()' function in 'webrtc/modules/rtp_rtcp/source/rtcp_receiver_help.cc' that is triggered when handling RTCP APP packets. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GetDatabaseFileURL()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered when handling file: URIs. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'gfx/2d/PathRecording.h' that is triggered when handling event recorders. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ICCallStubCompiler::guardFunApply()' function in 'js/src/jit/BaselineIC.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::createThisScriptedSingleton()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AddLazyFunctionsForCompartment()' function in 'js/src/jscompartment.cpp' that is triggered when handling references to a compartment's lazy functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::DefineTypedArrayElement()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DataViewObject::create()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::initEnvironmentChain()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the JavaScript JIT compiler that is triggered when handling windows. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDOMConstructor::HasInstance()' function in 'dom/base/nsDOMClassInfo.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocument::SetScriptGlobalObject()' function in 'dom/base/nsDocument.cpp' that is triggered when handling specially crafted media files. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'security/manager/pki/resources/content/pippki.js' that allows traversing outside of a restricted path. The issue is due to the export functions in the certificate viewer not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). This may allow a context-dependent attacker to make changes to the save destination for certificate content.
 - A flaw exists that may allow a remote attacker to use the preview feature for RSS feeds to view potentially sensitive privileged content errors and exceptions.
 - A flaw exists that is triggered during the handling of a specially crafted URL that contains certain unicode glyphs for alternative hyphens and quotes. This may allow a context-dependent attacker to spoof the location bar.
 - A flaw exists that is triggered during the handling of a specially crafted Proxy Auto-Config (PAC) file. This file may potentially specify which JavaScript function is called for URL requests, allowing a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw exists in 'dom/base/nsDocument.cpp' that is triggered as data sent with multipart channels, such as the multipart/x-mixed-replace MIME type, ignores the bypass referrer-policy response header. This may allow a context-dependent attacker to and gain access to sensitive information related to sites using the header.
 - A flaw exists that may allow WebExtension scripts to use the 'data: protocol' to affect pages loaded by other extensions. This may allow a context-dependent attacker to potentially disclose sensitive information or gain elevated privileges related to other extensions.
 - A flaw exists in 'mobile/android/chrome/content/browser.js' that is triggered when handling a series of JavaScript events in fullscreen mode. This may allow a context-dependent attacker to spoof the location bar.
 - A flaw exists that is triggered as certain 'about: pages' used by web content may load other privileged 'about: pages' within an iframe. This may potentially allow a context-dependent attacker to gain elevated privileges.
 - A flaw exists that is triggered as weak proxy objects may have weak references on multiple threads, instead of only one. This may potentially allow a context-dependent attacker to corrupt memory and execute arbitrary code.
 - A flaw exists in 'toolkit/mozapps/extensions/AddonManager.jsm' that is triggered as mozAddonManager allows for extension installation from the CDN for addons.mozilla.org. This may potentially allow a malicious extension to install additional extensions.
 - A flaw exists that is triggered when the location bar of a new page has been scrolled out of view. This may potentially allow a context-dependent attacker to spoof the location bar.
 - A flaw exists in the 'HTMLTrackElement::SetReadyState()' function in 'dom/html/HTMLTrackElement.cpp' that is triggered when handling TRACK tag error messages. This may allow a context-dependent attacker to enumerate the existence of local files.
 - A flaw exists in 'media/mtransport/nr_socket_prsock.cpp' that is triggered when a STUN server is used in conjunction with a saturation of webkitRTCPeerConnection objects, which may in turn produce a high volume of STUN packets. This may allow a remote attacker to generate significant UDP traffic, resulting in an amplification denial-of-service attack. When performed by multiple machines, a distributed denial-of-service (DDoS) attack can be carried out very effectively.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96871	Ubuntu 14.04 LTS / 16.04 LTS：thunderbird 弱點 (USN-3165-1)	Nessus	Ubuntu Local Security Checks	2017/1/30	2024/8/27	critical
96872	Ubuntu 14.04 LTS / 16.04 LTS：Firefox 弱點 (USN-3175-1)	Nessus	Ubuntu Local Security Checks	2017/1/30	2024/8/27	critical
96949	RHEL 5 / 6 / 7：thunderbird (RHSA-2017:0238)	Nessus	Red Hat Local Security Checks	2017/2/2	2024/11/4	critical
96970	Oracle Linux 6 / 7：thunderbird (ELSA-2017-0238)	Nessus	Oracle Linux Local Security Checks	2017/2/3	2024/10/22	critical
96773	Mozilla Firefox ESR 45.x < 45.7 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/1/25	2019/11/13	critical
96776	Mozilla Firefox < 51.0 多個弱點	Nessus	Windows	2017/1/25	2019/11/13	critical
9928	Mozilla Firefox ESR < 45.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/1/31	2019/11/6	high
9927	Mozilla Firefox < 51 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/1/31	2019/3/6	high

检测

插件搜索

critical

critical

critical

critical

critical

critical

high

high