遠端 Windows 主機上安裝的 Thunderbird 版本比 52.2 舊。因此會受到 mfsa2017-17 公告中所提及的多個弱點影響。

  - Graphite 2 程式庫中存在數個安全性弱點包括超出邊界讀取、緩衝區溢位讀取和寫入以及使用未初始化記憶體。這些問題已在 Graphite 2 版 1.3.10中解決。 (CVE-2017-7778)

  - 重新產生 CSS 版面配置時嘗試使用樹狀結構中不再存在的節點時框架載入器在樹狀結構重建期間發生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-5472)

  - 在重新載入 docshell 期間使用錯誤的 URL 產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7749)

  - 當 <code><track></code> 元素保留對舊視窗的參照時 (如果該視窗已在 DOM 中取代)會在視訊控製作業期間產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7750)

  - 內容檢視器接聽程式的一個釋放後使用弱點會導致可能遭惡意利用的當機。 (CVE-2017-7751)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

執行 MAIN 4.05 版的遠端 NewStart CGSL 主機安裝了受多個弱點影響的 thunderbird 套件：- WebGL 有緩衝區溢位問題，此問題可透過網頁內容觸發，導致可能遭到惡意利用的損毀。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5459) - 在文字版面配置期間處理字形寬度時，發生越界讀取情形。這樣會造成可能遭惡意利用的當機，攻擊者可能也得以讀取原本應該無法存取的記憶體。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5447) - 當 HTTP/2 連線至伺服器時，該伺服器傳送含有錯誤資料內容的資料框架，因而發生越界讀取情形。這可能會導致潛在的惡意利用當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5446) - 在進行版面配置及處理與 CSS 動畫搭配使用的雙向 Unicode 文字時，可能會觸發可能遭到惡意利用的損毀。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5449) - 操控 DOM 元素時若變更樣式，會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5442) - 解碼格式不正確形成的 BinHex 格式封存檔時，會產生越界寫入弱點。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5443) - 剖析 application/http-index-format 格式內容時，若標頭內含格式不正確的資料，會產生緩衝區溢位弱點。這樣會讓攻擊者得以從記憶體中進行越界讀取。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5444) - 在捲動事件期間按住選取項目時，產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5441) - 在裁剪區域邊界以外繪製內容時使用 Skia 內容，可能會發生記憶體損毀及當機情形。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5467) - 此機制會繞過沙箱中的檔案系統存取保護，使用檔案選擇器透過使用相關路徑來存取檔案選擇器中與所選檔案不同的檔案。這會允許進行唯讀存取本機檔案系統。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5454) - 此機制可透過在網址列的使用者互動和 onblur 事件來偽造網址列。指令碼可使用此事件來影響文字顯示，使載入的網站看起來與網址列內實際載入的網站不同。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5451) - 選取某些文字輸入內容時產生釋放後使用弱點，造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5432) - 觸發惡意指令碼內容與使用者按鍵動作的組合時，框架選取產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5460) - 透過指令碼操控協助工具樹狀目錄的 DOM 時，DOM 樹狀目錄可能與協助工具樹狀目錄不同步，導致記憶體損毀，造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5464) - 因 Flex 中的 CVE-2016-6354 問題而使產生的 Firefox 程式碼可能會中有緩衝區溢位弱點，此弱點已獲得修正。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5469) - 處理 ConvolvePixel 中的 SVG 內容時，發生越界讀取情形。這樣會造成當機，也會讓攻擊者得以將原本應該無法存取的記憶體複製到 SVG 圖形內容中，進而顯示出來。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5465) - 若透過超連結從原始網站載入頁面且該頁面包含重新導向至 data:text/html URL，觸發重新載入將會執行重新載入之 data:text/html 頁面 (來源設定錯誤)。這得以發動跨網站指令碼 (XSS) 攻擊。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5466) - 使用動畫控制器移除陣列中的動畫元素之指標時，若仍在使用中，則 SMIL 動畫功能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5433) - 處理重新導向焦點時產生釋放後使用弱點，造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5434) - 在 XSLT 處理程序期間產生釋放後使用弱點，這是因為在處理時，結果處理常式被已釋放的處理常式占用所致。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5438) - 在 XSLT 處理程序期間因不當處理範本參數而產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5439) - 在編輯器中處理時，設計模式互動中產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5435) - 已通報 Thunderbird 45.7 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5398) - 以 asm.js 為目標的 JIT 噴射加上堆積噴射可繞過 ASLR 和 DEP 保護，造成潛在的記憶體損毀攻擊。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5400) - 可經由網路內容觸發的當機，其中因為邏輯錯誤導致 ErrorResult 參照未指派記憶體。所造成的當機問題可遭惡意利用。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5401) - 在處理字型時若已破壞 FontFace 物件，其後又觸發 FontFace 物件的事件，會發生釋放後使用錯誤。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5402) - 操控選取的範圍時，若一個節點在原生匿名樹狀結構之內，而另一個節點在樹狀結構之外，會發生釋放後使用錯誤。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5404) - FTP 連線中的特定回應程式碼可能會造成在 FTP 作業中使用未初始化的連接埠值。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5405) - 使用的 SVG 篩選器若沒有在目標 iframe 上使用定點數學實作，惡意頁面會從目標使用者擷取像素值。這可以用來跨網域擷取歷程記錄資訊並讀取文字值。如此即違反同源原則，導致資訊洩漏。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5407) - 沒有檢查是否有允許跨來源使用的 CORS 標頭，視訊檔案便直接載入跨來源標題，導致可能洩漏視訊標題資訊。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5408) - 記憶體損毀造成在 JavaScript 的記憶體回收期間發生可能遭惡意利用的當機，這是因為增量式清除記憶體的管理錯誤所致。此弱點會影響 Firefox < 52、Firefox ESR < 45.8、Thunderbird < 52 和 Thunderbird < 45.8。(CVE-2017-5410) - 當 Opus 編碼器正在使用中且音訊串流內的頻道數量變更時，產生越界讀取弱點。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7758) - 若記憶體中的某個 IndexedDB 物件遭到破壞，而該物件的方法仍在執行中，則會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7757) - Graphite 2 程式庫中有一些安全性弱點，包括越界讀取、緩衝區溢位讀取和寫入以及使用未經初始化的記憶體。這些問題已在 Graphite 2 的 1.3.10 版中解決。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7778) - 在 libevent 的 search_make_new 函式中，發現越界讀取弱點。若攻擊者可造成使用 libevent 的應用程式嘗試解析空的主機名稱，則會發生越界讀取，可能導致當機。(CVE-2016-10197) - 在 libevent 中發現因剖析 DNS 要求和回應而產生的弱點。攻擊者可傳送偽造的 DNS 回應給使用 libevent 的應用程式，導致堆積上越界讀取資料，可能會洩漏少量的應用程式記憶體。(CVE-2016-10195) - 在 libevent 中發現因剖析 IPv6 位址而產生的弱點。若攻擊者可造成使用 libevent 的應用程式剖析標記法格式錯誤且其長度超過 2GiB 的 IPv6 位址，則會發生堆疊溢位，進而導致當機。(CVE-2016-10196) - 已通報 graphite2 中的一個宣告錯誤。攻擊者可能會惡意利用此缺陷造成應用程式損毀。(CVE-2017-7775) - 在進行視訊控制作業時，若某個元素保留對之前視窗的參照，而當該視窗在 DOM 中被置換時，會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7750) - 記錄 XML HTTP 要求 (XHR) 標頭的錯誤時，產生釋放後使用和範圍後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7756) - 在重新載入 docshell 期間使用錯誤的 URL，產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7749) - 在特定使用者與某些語種的輸入法編輯器 (IME) 互動時，因處理事件的方式而產生釋放後使用弱點。這樣會造成可能遭惡意利用的當機，但仍需特定使用者互動才能觸發此弱點。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7752) - 內容檢視器接聽程式產生釋放後使用弱點，造成可能遭惡意利用的當機。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7751) - 重建樹狀結構以重新產生 CSS 版面配置時，若嘗試使用樹狀結構中已不存在的節點，框架載入器會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-5472) - 在進行 WebGL 作業時，惡意特製的 ImageInfo 物件會造成 WebGL 越界讀取問題。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7754) - 已通報 Firefox 53 和 Firefox ESR 52.1 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-5470) - 已通報 graphite2 中一個與 graphite2::Silf::readGraphite 相關的越界讀取缺陷。攻擊者可能會惡意利用此缺陷洩漏可能敏感的記憶體，或造成應用程式損毀。(CVE-2017-7774) - 已通報 graphite2 中一個與 lz4::decompress (src/Decompressor) 相關的堆積型緩衝區溢位缺陷。攻擊者可惡意利用此問題造成當機，或可能執行任意程式碼。(CVE-2017-7773) - 已通報 graphite2 中一個與 lz4::decompress 相關的堆積型緩衝區溢位缺陷。攻擊者可惡意利用此問題造成當機，或可能執行任意程式碼。(CVE-2017-7772) - 已通報 graphite2 中一個與 graphite2::Pass::readPass 相關的越界讀取缺陷。攻擊者可能會惡意利用此缺陷洩漏可能敏感的記憶體，或造成應用程式損毀。(CVE-2017-7771) - 已通報 graphite2 中一個與 graphite2::GlyphCache::Loader::read_glyph 相關的未初始化記憶體使用。攻擊者可能會惡意利用此缺陷，以不明的方式對使用 graphite2 之應用程式的執行造成負面影響。(CVE-2017-7777) - 已通報 graphite2 中一個與 graphite2::Silf::getClassGlyph 相關的越界讀取缺陷。攻擊者可能會惡意利用此缺陷洩漏可能敏感的記憶體，或造成應用程式損毀。(CVE-2017-7776) - 加拿大音節文字的 unicode 區塊中的字元可能與網址列中的其他 unicode 區塊字元混用，而非以原本的 punycode 格式呈現，攻擊者因而得以透過混淆字元的方式發動偽造網域名稱的攻擊。最新的 Unicode 標準允許 Aspirational Use Script 字元 (如加拿大音節文字) 與拉丁字元在中度設限的 IDN 設定檔中混用。我們已改變 Firefox 行為，使其符合即將推出的 Unicode 10.0 版，此最新版本已移除此類別並將其視為有限用途指令碼。此弱點會影響 Firefox < 54、Firefox ESR < 52.2 和 Thunderbird < 52.2。(CVE-2017-7764) - 已通報 Firefox 52、Firefox ESR 45.8、Firefox ESR 52 和 Thunderbird 52 中存在的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5429) - 剖析 application/http-index- format 格式內容時產生一個弱點，其中使用未初始化的值來建立陣列。這樣可能會將未經初始化的記憶體讀進受影響的陣列中。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5445) - 在 XSLT 處理程序期間，由於評估內容時無法在比對期間散佈錯誤情形而產生釋放後使用弱點，造成使用已不存在的物件。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5440) - 在以惡意特製之 Graphite 字型觸發的 Graphite 2 程式庫中，存在越界寫入問題。這會造成可能遭惡意利用的當機。此問題已在 Graphite 2 程式庫以及 Mozilla 產品中得以修正。此弱點會影響 Thunderbird < 52.1、Firefox ESR < 45.9、Firefox ESR < 52.1 和 Firefox < 53。(CVE-2017-5436) 請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 macOS 或 Mac OS X 主機上安裝的 Thunderbird 版本比 52.2 版舊。因此會受到 mfsa2017-17 公告中所提及的多個弱點影響。

  - Graphite 2 程式庫中存在數個安全性弱點包括超出邊界讀取、緩衝區溢位讀取和寫入以及使用未初始化記憶體。這些問題已在 Graphite 2 版 1.3.10中解決。 (CVE-2017-7778)

  - 重新產生 CSS 版面配置時嘗試使用樹狀結構中不再存在的節點時框架載入器在樹狀結構重建期間發生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-5472)

  - 在重新載入 docshell 期間使用錯誤的 URL 產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7749)

  - 當 <code><track></code> 元素保留對舊視窗的參照時 (如果該視窗已在 DOM 中取代)會在視訊控製作業期間產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7750)

  - 內容檢視器接聽程式的一個釋放後使用弱點會導致可能遭惡意利用的當機。 (CVE-2017-7751)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Windows 主機上安裝的 Mozilla Thunderbird 版本比 52.2 舊。因此，該應用程式受到多個弱點影響：

  - 存在多個記憶體損毀問題，這讓未經驗證的遠端攻擊者可以誘騙使用者造訪特製的網站，從而觸發任意程式碼執行攻擊。(CVE-2017-5470)

  - nsCSSFrameConstructor.cpp 中的 EndUpdate() 函式存在釋放後使用錯誤，在重新產生 CSS 版面配置期間重新建構樹狀目錄時，即會觸發該錯誤。未經驗證的遠端攻擊者可誘騙使用者造訪特製的網站，利用此錯誤來造成拒絕服務條件或執行任意程式碼。(CVE-2017-5472)

  - nsDocShell.cpp 中的 Reload() 函式存在釋放後使用錯誤，在重新載入 docshell 期間使用錯誤的 URL 即會觸發該錯誤。未經驗證的遠端攻擊者可利用此問題，造成拒絕服務情形或執行任意程式碼。(CVE-2017-7749)

  - nsDocumentViewer.cpp 中的 Hide() 函式存在釋放後使用錯誤，處理追蹤元素時即會觸發該錯誤。未經驗證的遠端攻擊者可利用此問題，造成拒絕服務情形或執行任意程式碼。(CVE-2017-7750)

  - nsDocumentViewer.cpp 中的 nsDocumentViewer 類別存在釋放後使用錯誤，處理內容檢視器接聽程式時即會觸發該錯誤。未經驗證的遠端攻擊者可加以惡意利用，藉此引發拒絕服務情形或執行任意程式碼。
    (CVE-2017-7751)

  - 存在釋放後使用錯誤，在處理事件時，如果發生特定的輸入法編輯器 (IME) 使用者互動，即會觸發該錯誤。未經驗證的遠端攻擊者可加以惡意利用，藉此引發拒絕服務情形或執行任意程式碼。
    (CVE-2017-7752)

  - WebGLTexture.cpp 中的 IsComplete() 函式存在超出邊界讀取錯誤，處理紋理時即會觸發該錯誤。未經驗證的遠端攻擊者可加以惡意利用，洩漏記憶體內容。
    (CVE-2017-7754)

  - XMLHttpRequestMainThread.cpp 中的 SetRequestHead() 函式存在釋放後使用錯誤，記錄 XML HTTP 要求 (XHR) 時即會觸發該錯誤。未經驗證的遠端攻擊者可利用此問題，造成拒絕服務情形或執行任意程式碼。(CVE-2017-7756)

  - ActorsParent.cpp 中存在釋放後使用錯誤，這是不當處理記憶體中的物件所導致。未經驗證的遠端攻擊者可利用此問題，造成拒絕服務情形或執行任意程式碼。(CVE-2017-7757)

  - TrackEncoder.cpp 中的 AppendAudioSegment() 函式存在超出邊界讀取錯誤，如果在使用 Opus 編碼器的同時變更音訊串流內的頻道編號，即會觸發此錯誤。未經驗證的遠端攻擊者可利用此缺陷洩漏敏感資訊。(CVE-2017-7758)

  - gfxMacPlatformFontList.mm 的 ReadCMAP() 函式中存在缺陷，當處理結合 macOS 字型的藏文字元時，會觸發此缺陷。未經驗證的遠端攻擊者可利用此問題，透過特製的 IDN 網域來偽造有效的 URL。(CVE-2017-7763)

  - nsIDNService.cpp 的 isLabelSafe() 函式中存在缺陷，當處理來自不同 unicode 區塊的字元時，會觸發此缺陷。未經驗證的遠端攻擊者可利用此問題，透過特製的 IDN 網域來偽造有效的 URL 並執行釣魚攻擊。(CVE-2017-7764)

  - Graphite 元件中 Pass.cpp 的 readPass() 函式中存在超出邊界讀取錯誤。未經驗證的遠端攻擊者可利用此問題，來造成拒絕服務條件或是洩漏記憶體內容。(CVE-2017-7771)

  - Decompressor.cpp 中 decompress() 函式的 Graphite 元件中存在多個整數溢位條件，這是不當驗證使用者提供的輸入所導致。未經驗證的遠端攻擊者可利用此問題，來造成拒絕服務條件或執行任意程式碼。(CVE-2017-7772、CVE-2017-7773、CVE-2017-7778)

  - Silf.cpp 中 readGraphite() 函式的 Graphite 元件中存在超出邊界讀取錯誤。未經驗證的遠端攻擊者可利用此問題，來造成拒絕服務條件或是洩漏記憶體內容。(CVE-2017-7774)

  - Silf.cpp 中 getClassGlyph() 函式的 Graphite 元件中存在超出邊界讀取錯誤，這是不當驗證使用者提供的輸入所導致。未經驗證的遠端攻擊者可利用此弱點來引發拒絕服務情形。(CVE-2017-7776)

  - GlyphCache.cpp 中 read_glyph() 函式的 Graphite 元件中存在缺陷，此缺陷與未初始化記憶體的使用有關。未經驗證的遠端攻擊者可加以惡意利用來造成不明影響。
    (CVE-2017-7777)

遠端 Windows 主機上安裝的 Mozilla Firefox ESR 版本比 52.2 舊。因此，該應用程式受到多個弱點影響：

  - 存在多個記憶體損毀問題，這讓未經驗證的遠端攻擊者可以誘騙使用者造訪特製的網站，從而觸發任意程式碼執行攻擊。(CVE-2017-5470)

  - nsCSSFrameConstructor.cpp 中的 EndUpdate() 函式存在釋放後使用錯誤，在重新產生 CSS 版面配置期間重新建構樹狀目錄時，即會觸發該錯誤。未經驗證的遠端攻擊者可誘騙使用者造訪特製的網站，利用此錯誤來造成拒絕服務條件或執行任意程式碼。(CVE-2017-5472)

  - nsDocShell.cpp 中的 Reload() 函式存在釋放後使用錯誤，在重新載入 docshell 期間使用錯誤的 URL 即會觸發該錯誤。未經驗證的遠端攻擊者可利用此問題，造成拒絕服務情形或執行任意程式碼。(CVE-2017-7749)

  - nsDocumentViewer.cpp 中的 Hide() 函式存在釋放後使用錯誤，處理追蹤元素時即會觸發該錯誤。未經驗證的遠端攻擊者可利用此問題，造成拒絕服務情形或執行任意程式碼。(CVE-2017-7750)

  - nsDocumentViewer.cpp 中的 nsDocumentViewer 類別存在釋放後使用錯誤，處理內容檢視器接聽程式時即會觸發該錯誤。未經驗證的遠端攻擊者可加以惡意利用，藉此引發拒絕服務情形或執行任意程式碼。
    (CVE-2017-7751)

  - 存在釋放後使用錯誤，在處理事件時，如果發生特定的輸入法編輯器 (IME) 使用者互動，即會觸發該錯誤。未經驗證的遠端攻擊者可加以惡意利用，藉此引發拒絕服務情形或執行任意程式碼。
    (CVE-2017-7752)

  - WebGLTexture.cpp 中的 IsComplete() 函式存在超出邊界讀取錯誤，處理紋理時即會觸發該錯誤。未經驗證的遠端攻擊者可加以惡意利用，洩漏記憶體內容。
    (CVE-2017-7754)

  - 存在權限提升弱點，這是不當載入動態連結程式庫 (DLL) 檔案所導致。本機攻擊者可利用此弱點，透過安裝路徑中的特製 DLL 檔案來插入並執行任意程式碼。(CVE-2017-7755)

  - XMLHttpRequestMainThread.cpp 中的 SetRequestHead() 函式存在釋放後使用錯誤，記錄 XML HTTP 要求 (XHR) 時即會觸發該錯誤。未經驗證的遠端攻擊者可利用此問題，造成拒絕服務情形或執行任意程式碼。(CVE-2017-7756)

  - ActorsParent.cpp 中存在釋放後使用錯誤，這是不當處理記憶體中的物件所導致。未經驗證的遠端攻擊者可利用此問題，造成拒絕服務情形或執行任意程式碼。(CVE-2017-7757)

  - TrackEncoder.cpp 中的 AppendAudioSegment() 函式存在超出邊界讀取錯誤，如果在使用 Opus 編碼器的同時變更音訊串流內的頻道編號，即會觸發此錯誤。未經驗證的遠端攻擊者可利用此缺陷洩漏敏感資訊。(CVE-2017-7758)

  - updater.cpp 中的 NS_main() 函式存在缺陷，這是在處理回呼檔案路徑參數時不當驗證輸入所導致。本機攻擊者可利用此問題來操控安裝目錄中的檔案。(CVE-2017-7760)

  - Maintenance Service helper.exe 應用程式中存在缺陷，當暫存目錄的權限設定為可由非特權使用者寫入時，即會觸發此缺陷。本機攻擊者可利用此問題來刪除系統上的任意檔案。(CVE-2017-7761)

  - nsIDNService.cpp 的 isLabelSafe() 函式中存在缺陷，當處理來自不同 unicode 區塊的字元時，會觸發此缺陷。未經驗證的遠端攻擊者可利用此問題，透過特製的 IDN 網域來偽造有效的 URL 並執行釣魚攻擊。(CVE-2017-7764)

  - 存在一個缺陷，會因處理下載檔案時不當剖析長檔名而觸發。未經驗證的遠端攻擊者可加以惡意利用，造成未套用「mark-of-the-web」即下載檔案，導致未顯示可執行檔的安全警告。
    (CVE-2017-7765)

  - Mozilla 維護服務中存在一個缺陷，會在處理 'patch'、'install' 和 'working' 目錄的路徑時觸發。本機攻擊者可利用此問題，以提升的權限執行任意程式碼。(CVE-2017-7766)

  - Mozilla 維護服務中存在一個缺陷，會在使用 Mozilla Windows 更新程式叫用時觸發。本機攻擊者可利用此問題，以隨機資料覆寫任意檔案。(CVE-2017-7767)

  - workmonitor.cpp 的 IsStatusApplying() 函式中有一個缺陷，會在記錄更新狀態時觸發。本機攻擊者可利用此問題來讀取 32 位元組的任意檔案。(CVE-2017-7768)

  - Decompressor.cpp 中 decompress() 函式的 Graphite 元件中存在多個整數溢位條件，這是不當驗證使用者提供的輸入所導致。未經驗證的遠端攻擊者可利用此問題，來造成拒絕服務條件或執行任意程式碼。(CVE-2017-7772、CVE-2017-7773、CVE-2017-7778)

  - Silf.cpp 中 readGraphite() 函式的 Graphite 元件中存在超出邊界讀取錯誤。未經驗證的遠端攻擊者可利用此問題，來造成拒絕服務條件或是洩漏記憶體內容。(CVE-2017-7774)

  - Silf.cpp 中 getClassGlyph() 函式的 Graphite 元件中存在超出邊界讀取錯誤，這是不當驗證使用者提供的輸入所導致。未經驗證的遠端攻擊者可利用此弱點來引發拒絕服務情形。(CVE-2017-7776)

  - GlyphCache.cpp 中 read_glyph() 函式的 Graphite 元件中存在缺陷，此缺陷與未初始化記憶體的使用有關。未經驗證的遠端攻擊者可加以惡意利用來造成不明影響。
    (CVE-2017-7777)

遠端 Windows 主機上安裝的 Firefox 版本是 54.0 之前版本。因此會受到 mfsa2017-15 公告中所提及的多個弱點影響。

  - Graphite 2 程式庫中存在數個安全性弱點包括超出邊界讀取、緩衝區溢位讀取和寫入以及使用未初始化記憶體。這些問題已在 Graphite 2 版 1.3.10中解決。 (CVE-2017-7778)

  - 重新產生 CSS 版面配置時嘗試使用樹狀結構中不再存在的節點時框架載入器在樹狀結構重建期間發生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-5472)

  - 在重新載入 docshell 期間使用錯誤的 URL 產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7749)

  - 當 <code><track></code> 元素保留對舊視窗的參照時 (如果該視窗已在 DOM 中取代)會在視訊控製作業期間產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7750)

  - 內容檢視器接聽程式的一個釋放後使用弱點會導致可能遭惡意利用的當機。 (CVE-2017-7751)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

來自 Red Hat 安全性公告 2017:1440：

現已提供適用於 Red Hat Enterprise Linux 6 與 Red Hat Enterprise Linux 7 的 firefox 更新。

Red Hat 產品安全性團隊已將此更新評等為具有重大安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

Mozilla Firefox 是開放原始碼的網頁瀏覽器。

此更新將 Firefox 升級至 52.2.0 ESR 版。

安全性修正：

* 在處理格式錯誤的 Web 內容過程中發現多個瑕疵。包含惡意內容的網頁可造成 Firefox 損毀，或可能利用執行 Firefox 之使用者的權限來執行任意程式碼。(CVE-2017-5470、CVE-2017-5472、CVE-2017-7749、CVE-2017-7751、CVE-2017-7756、CVE-2017-7771、CVE-2017-7772、CVE-2017-7773、CVE-2017-7774、CVE-2017-7776、CVE-2017-7777、CVE-2017-7778、CVE-2017-7750、CVE-2017-7752、CVE-2017-7754、CVE-2017-7757、CVE-2017-7758、CVE-2017-7764)

Red Hat 感謝 Mozilla 專案報告這些問題。上游確認 Nils、Zimperium zLabs 的 Nicolas Trippar、Mats Palmgren、Philipp、Masayuki Nakano、Christian Holler、Andrew McCreight、Gary Kwong、Andre Bargull、Carsten Book、Jesse Schwartzentruber、Julian Hector、Marcia Knous、Ronald Crane、Samuel Erb、Holger Fuhrmannek、Tyson Smith、Abhishek Arya 及 F. Alonso (revskills) 為原始報告者。

遠端 Windows 主機上安裝的 Firefox ESR 為 52.2 之前版本。因此會受到 mfsa2017-16 公告中所提及的多個弱點影響。

  - Graphite 2 程式庫中存在數個安全性弱點包括超出邊界讀取、緩衝區溢位讀取和寫入以及使用未初始化記憶體。這些問題已在 Graphite 2 版 1.3.10中解決。 (CVE-2017-7778)

  - 重新產生 CSS 版面配置時嘗試使用樹狀結構中不再存在的節點時框架載入器在樹狀結構重建期間發生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-5472)

  - 在重新載入 docshell 期間使用錯誤的 URL 產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7749)

  - 當 <code><track></code> 元素保留對舊視窗的參照時 (如果該視窗已在 DOM 中取代)會在視訊控製作業期間產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7750)

  - 內容檢視器接聽程式的一個釋放後使用弱點會導致可能遭惡意利用的當機。 (CVE-2017-7751)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox. (CVE-2017-5470, CVE-2017-5472,     CVE-2017-7749, CVE-2017-7751, CVE-2017-7756,     CVE-2017-7771, CVE-2017-7772, CVE-2017-7773,     CVE-2017-7774, CVE-2017-7776,     CVE-2017-7777, CVE-2017-7778, CVE-2017-7750,     CVE-2017-7752, CVE-2017-7754, CVE-2017-7757,     CVE-2017-7758, CVE-2017-7764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, spoof the addressbar contents, or execute arbitrary code. (CVE-2017-5470, CVE-2017-5471, CVE-2017-5472, CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754, CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7762, CVE-2017-7764)

Multiple security issues were discovered in the Graphite 2 library used by Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, or execute arbitrary code. (CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Thunderbird installed on the remote Windows host is prior to 52.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-17 advisory.

  - A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer     overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2     version 1.3.10. (CVE-2017-7778)

  - A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS     layout when attempting to use a node in the tree that no longer exists. This results in a potentially     exploitable crash. (CVE-2017-5472)

  - A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This     results in a potentially exploitable crash. (CVE-2017-7749)

  - A use-after-free vulnerability during video control operations when a <code><track></code> element     holds a reference to an older window if that window has been replaced in the DOM. This results in a     potentially exploitable crash. (CVE-2017-7750)

  - A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable     crash. (CVE-2017-7751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow in WebGL triggerable by web content,     resulting in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5459)

  - An out-of-bounds read during the processing of glyph     widths during text layout. This results in a potentially     exploitable crash and could allow an attacker to read     otherwise inaccessible memory. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5447)

  - An out-of-bounds read when an HTTP/2 connection to a     servers sends DATA frames with incorrect data content.
    This leads to a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5446)

  - A possibly exploitable crash triggered during layout and     manipulation of bidirectional unicode text in concert     with CSS animations. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5449)

  - A use-after-free vulnerability during changes in style     when manipulating DOM elements. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5442)

  - An out-of-bounds write vulnerability while decoding     improperly formed BinHex format archives. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5443)

  - A buffer overflow vulnerability while parsing     application/http-index-format format content when the     header contains improperly formatted data. This allows     for an out-of-bounds read of data from memory. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5444)

  - A use-after-free vulnerability when holding a selection     during scroll events. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5441)

  - A potential memory corruption and crash when using Skia     content when drawing content outside of the bounds of a     clipping region. This vulnerability affects Thunderbird     < 52.1, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5467)

  - A mechanism to bypass file system access protections in     the sandbox to use the file picker to access different     files than those selected in the file picker through the     use of relative paths. This allows for read only access     to the local file system. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5454)

  - A mechanism to spoof the addressbar through the user     interaction on the addressbar and the onblur event.
    The event could be used by script to affect text display     to make the loaded site appear to be different from the     one actually loaded within the addressbar. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5451)

  - A use-after-free vulnerability occurs during certain     text input selection resulting in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5432)

  - A use-after-free vulnerability in frame selection     triggered by a combination of malicious script content     and key presses by a user. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5460)

  - During DOM manipulations of the accessibility tree     through script, the DOM tree can become out of sync with     the accessibility tree, leading to memory corruption and     a potentially exploitable crash. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5464)

  - Fixed potential buffer overflows in generated Firefox     code due to CVE-2016-6354 issue in Flex. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5469)

  - An out-of-bounds read while processing SVG content in     ConvolvePixel. This results in a crash and also allows     for otherwise inaccessible memory being copied into SVG     graphic content, which could then displayed. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5465)

  - If a page is loaded from an original site through a     hyperlink and contains a redirect to a data:text/html     URL, triggering a reload will run the reloaded     data:text/html page with its origin set incorrectly.
    This allows for a cross-site scripting (XSS) attack.
    This vulnerability affects Thunderbird < 52.1, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5466)

  - A use-after-free vulnerability in SMIL animation     functions occurs when pointers to animation elements in     an array are dropped from the animation controller while     still in use. This results in a potentially exploitable     crash. This vulnerability affects Thunderbird < 52.1,     Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5433)

  - A use-after-free vulnerability occurs when redirecting     focus handling which results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5434)

  - A use-after-free vulnerability during XSLT processing     due to the result handler being held by a freed handler     during handling. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5438)

  - A use-after-free vulnerability during XSLT processing     due to poor handling of template parameters. This     results in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5439)

  - A use-after-free vulnerability occurs during transaction     processing in the editor during design mode     interactions. This results in a potentially exploitable     crash. This vulnerability affects Thunderbird < 52.1,     Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5435)

  - Memory safety bugs were reported in Thunderbird 45.7.
    Some of these bugs showed evidence of memory corruption     and we presume that with enough effort that some of     these could be exploited to run arbitrary code. This     vulnerability affects Firefox < 52, Firefox ESR < 45.8,     Thunderbird < 52, and Thunderbird < 45.8.
    (CVE-2017-5398)

  - JIT-spray targeting asm.js combined with a heap spray     allows for a bypass of ASLR and DEP protections leading     to potential memory corruption attacks. This     vulnerability affects Firefox < 52, Firefox ESR < 45.8,     Thunderbird < 52, and Thunderbird < 45.8.
    (CVE-2017-5400)

  - A crash triggerable by web content in which an     ErrorResult references unassigned memory due to a     logic error. The resulting crash may be exploitable.
    This vulnerability affects Firefox < 52, Firefox ESR <     45.8, Thunderbird < 52, and Thunderbird < 45.8.
    (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a     FontFace object after the object has been already been     destroyed while working with fonts. This results in a     potentially exploitable crash. This vulnerability     affects Firefox < 52, Firefox ESR < 45.8, Thunderbird <     52, and Thunderbird < 45.8. (CVE-2017-5402)

  - A use-after-free error can occur when manipulating     ranges in selections with one node inside a native     anonymous tree and one node outside of it. This results     in a potentially exploitable crash. This vulnerability     affects Firefox < 52, Firefox ESR < 45.8, Thunderbird <     52, and Thunderbird < 45.8. (CVE-2017-5404)

  - Certain response codes in FTP connections can result in     the use of uninitialized values for ports in FTP     operations. This vulnerability affects Firefox < 52,     Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird <     45.8. (CVE-2017-5405)

  - Using SVG filters that don't use the fixed point math     implementation on a target iframe, a malicious page can     extract pixel values from a targeted user. This can be     used to extract history information and read text values     across domains. This violates same-origin policy and     leads to information disclosure. This vulnerability     affects Firefox < 52, Firefox ESR < 45.8, Thunderbird <     52, and Thunderbird < 45.8. (CVE-2017-5407)

  - Video files loaded video captions cross-origin without     checking for the presence of CORS headers permitting     such cross-origin use, leading to potential information     disclosure for video captions. This vulnerability     affects Firefox < 52, Firefox ESR < 45.8, Thunderbird <     52, and Thunderbird < 45.8. (CVE-2017-5408)

  - Memory corruption resulting in a potentially exploitable     crash during garbage collection of JavaScript due errors     in how incremental sweeping is managed for memory     cleanup. This vulnerability affects Firefox < 52,     Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird <     45.8. (CVE-2017-5410)

  - An out-of-bounds read vulnerability with the Opus     encoder when the number of channels in an audio stream     changes while the encoder is in use. This vulnerability     affects Firefox < 54, Firefox ESR < 52.2, and     Thunderbird < 52.2. (CVE-2017-7758)

  - A use-after-free vulnerability in IndexedDB when one of     its objects is destroyed in memory while a method on it     is still being executed. This results in a potentially     exploitable crash. This vulnerability affects Firefox <     54, Firefox ESR < 52.2, and Thunderbird < 52.2.
    (CVE-2017-7757)

  - A number of security vulnerabilities in the Graphite 2     library including out-of-bounds reads, buffer overflow     reads and writes, and the use of uninitialized memory.
    These issues were addressed in Graphite 2 version     1.3.10. This vulnerability affects Firefox < 54, Firefox     ESR < 52.2, and Thunderbird < 52.2. (CVE-2017-7778)

  - An out of bounds read vulnerability was found in     libevent in the search_make_new function. If an attacker     could cause an application using libevent to attempt     resolving an empty hostname, an out of bounds read could     occur possibly leading to a crash. (CVE-2016-10197)

  - A vulnerability was found in libevent with the parsing     of DNS requests and replies. An attacker could send a     forged DNS response to an application using libevent     which could lead to reading data out of bounds on the     heap, potentially disclosing a small amount of     application memory. (CVE-2016-10195)

  - A vulnerability was found in libevent with the parsing     of IPv6 addresses. If an attacker could cause an     application using libevent to parse a malformed address     in IPv6 notation of more than 2GiB in length, a stack     overflow would occur leading to a crash.
    (CVE-2016-10196)

  - A use-after-free vulnerability during video control     operations when a  element holds a reference to     an older window if that window has been replaced in the     DOM. This results in a potentially exploitable crash.
    This vulnerability affects Firefox < 54, Firefox ESR <     52.2, and Thunderbird < 52.2. (CVE-2017-7750)

  - A use-after-free and use-after-scope vulnerability when     logging errors from headers for XML HTTP Requests (XHR).
    This could result in a potentially exploitable crash.
    This vulnerability affects Firefox < 54, Firefox ESR <     52.2, and Thunderbird < 52.2. (CVE-2017-7756)

  - A use-after-free vulnerability when using an incorrect     URL during the reloading of a docshell. This results in     a potentially exploitable crash. This vulnerability     affects Firefox < 54, Firefox ESR < 52.2, and     Thunderbird < 52.2. (CVE-2017-7749)

  - A use-after-free vulnerability during specific user     interactions with the input method editor (IME) in some     languages due to how events are handled. This results in     a potentially exploitable crash but would require     specific user interaction to trigger. This vulnerability     affects Firefox < 54, Firefox ESR < 52.2, and     Thunderbird < 52.2. (CVE-2017-7752)

  - A use-after-free vulnerability with content viewer     listeners that results in a potentially exploitable     crash. This vulnerability affects Firefox < 54, Firefox     ESR < 52.2, and Thunderbird < 52.2. (CVE-2017-7751)

  - A use-after-free vulnerability with the frameloader     during tree reconstruction while regenerating CSS layout     when attempting to use a node in the tree that no longer     exists. This results in a potentially exploitable crash.
    This vulnerability affects Firefox < 54, Firefox ESR <     52.2, and Thunderbird < 52.2. (CVE-2017-5472)

  - An out-of-bounds read in WebGL with a maliciously     crafted ImageInfo object during WebGL operations. This     vulnerability affects Firefox < 54, Firefox ESR < 52.2,     and Thunderbird < 52.2. (CVE-2017-7754)

  - Memory safety bugs were reported in Firefox 53 and     Firefox ESR 52.1. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 54, Firefox     ESR < 52.2, and Thunderbird < 52.2. (CVE-2017-5470)

  - An out of bounds read flaw related to     graphite2::Silf::readGraphite has been reported in     graphite2. An attacker could possibly exploit this flaw     to disclose potentially sensitive memory or cause an     application crash. (CVE-2017-7774)

  - A heap-based buffer overflow flaw related to     lz4::decompress (src/Decompressor) has been reported     in graphite2. An attacker could exploit this issue to     cause a crash or, possibly, execute arbitrary code.
    (CVE-2017-7773)

  - A heap-based buffer overflow flaw related to     lz4::decompress has been reported in graphite2. An     attacker could exploit this issue to cause a crash or,     possibly, execute arbitrary code. (CVE-2017-7772)

  - An out of bounds read flaw related to     graphite2::Pass::readPass has been reported in     graphite2. An attacker could possibly exploit this flaw     to disclose potentially sensitive memory or cause an     application crash. (CVE-2017-7771)

  - The use of uninitialized memory related to     graphite2::GlyphCache::Loader::read_glyph has been     reported in graphite2. An attacker could possibly     exploit this flaw to negatively impact the execution of     an application using graphite2 in unknown ways.
    (CVE-2017-7777)

  - An out of bounds read flaw related to     graphite2::Silf::getClassGlyph has been reported in     graphite2. An attacker could possibly exploit this flaw     to disclose potentially sensitive memory or cause an     application crash. (CVE-2017-7776)

  - Characters from the Canadian Syllabics unicode block     can be mixed with characters from other unicode blocks     in the addressbar instead of being rendered as their raw     punycode form, allowing for domain name spoofing     attacks through character confusion. The current Unicode     standard allows characters from Aspirational Use     Scripts such as Canadian Syllabics to be mixed with     Latin characters in the moderately restrictive IDN     profile. We have changed Firefox behavior to match the     upcoming Unicode version 10.0 which removes this     category and treats them as Limited Use Scripts.. This     vulnerability affects Firefox < 54, Firefox ESR < 52.2,     and Thunderbird < 52.2. (CVE-2017-7764)

  - Memory safety bugs were reported in Firefox 52, Firefox     ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of     these bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could     be exploited to run arbitrary code. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5429)

  - A vulnerability while parsing application/http-index-     format format content where uninitialized values are     used to create an array. This could allow the reading of     uninitialized memory into the arrays affected. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5445)

  - A use-after-free vulnerability during XSLT processing     due to a failure to propagate error conditions during     matching while evaluating context, leading to objects     being used when they no longer exist. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5440)

  - An out-of-bounds write in the Graphite 2 library     triggered with a maliciously crafted Graphite font. This     results in a potentially exploitable crash. This issue     was fixed in the Graphite 2 library as well as Mozilla     products. This vulnerability affects Thunderbird < 52.1,     Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5436)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Mozilla Thunderbird installed on the remote Windows host is prior to 52.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code by convincing a user to visit a specially crafted     website. (CVE-2017-5470)

  - A use-after-free error exists in the EndUpdate()     function in nsCSSFrameConstructor.cpp that is triggered     when reconstructing trees during regeneration of CSS     layouts. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-5472)

  - A use-after-free error exists in the Reload() function     in nsDocShell.cpp that is triggered when using an     incorrect URL during the reload of a docshell. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7749)

  - A use-after-free error exists in the Hide() function in     nsDocumentViewer.cpp that is triggered when handling     track elements. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2017-7750)

  - A use-after-free error exists in the nsDocumentViewer     class in nsDocumentViewer.cpp that is triggered when     handling content viewer listeners. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7751)

  - A use-after-free error exists that is triggered when     handling events while specific user interaction occurs     with the input method editor (IME). An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7752)

  - An out-of-bounds read error exists in the IsComplete()     function in WebGLTexture.cpp that is triggered when     handling textures. An unauthenticated, remote attacker     can exploit this to disclose memory contents.
    (CVE-2017-7754)

  - A use-after-free error exists in the SetRequestHead()     function in XMLHttpRequestMainThread.cpp that is     triggered when logging XML HTTP Requests (XHR). An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7756)

  - A use-after-free error exists in ActorsParent.cpp due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7757)

  - An out-of-bounds read error exists in the     AppendAudioSegment() function in TrackEncoder.cpp that     is triggered when the number of channels in an audio     stream changes while the Opus encoder is in use. An     unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-7758)

  - A flaw exists in the ReadCMAP() function in     gfxMacPlatformFontList.mm that is triggered when     handling tibetan characters in combination with macOS     fonts. An unauthenticated, remote attacker can exploit     this, via a specially crafted IDN domain, to spoof a     valid URL. (CVE-2017-7763)

  - A flaw exists in the isLabelSafe() function in     nsIDNService.cpp that is triggered when handling     characters from different unicode blocks. An     unauthenticated, remote attacker can exploit this, via a     specially crafted IDN domain, to spoof a valid URL and     conduct phishing attacks. (CVE-2017-7764)

  - An out-of-bounds read error exists in the Graphite     component in the readPass() function in Pass.cpp. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the disclosure of     memory contents. (CVE-2017-7771)

  - Multiple integer overflow conditions exist in the     Graphite component in the decompress() function in     Decompressor.cpp due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2017-7772,     CVE-2017-7773, CVE-2017-7778)

  - An out-of-bounds read error exists in the Graphite     component in the readGraphite() function in Silf.cpp. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or disclose memory     contents. (CVE-2017-7774)

  - An out-of-bounds read error exists in the Graphite     component in getClassGlyph() function in Silf.cpp due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-7776)

  - A flaw exists in the Graphite component in the     read_glyph() function in GlyphCache.cpp related to use     of uninitialized memory. An unauthenticated, remote     attacker can exploit this to have an unspecified impact.
    (CVE-2017-7777)

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 52.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-17 advisory.

  - A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer     overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2     version 1.3.10. (CVE-2017-7778)

  - A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS     layout when attempting to use a node in the tree that no longer exists. This results in a potentially     exploitable crash. (CVE-2017-5472)

  - A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This     results in a potentially exploitable crash. (CVE-2017-7749)

  - A use-after-free vulnerability during video control operations when a <code><track></code> element     holds a reference to an older window if that window has been replaced in the DOM. This results in a     potentially exploitable crash. (CVE-2017-7750)

  - A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable     crash. (CVE-2017-7751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 52.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code by convincing a user to visit a specially crafted     website. (CVE-2017-5470)

  - A use-after-free error exists in the EndUpdate()     function in nsCSSFrameConstructor.cpp that is triggered     when reconstructing trees during regeneration of CSS     layouts. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-5472)

  - A use-after-free error exists in the Reload() function     in nsDocShell.cpp that is triggered when using an     incorrect URL during the reload of a docshell. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7749)

  - A use-after-free error exists in the Hide() function in     nsDocumentViewer.cpp that is triggered when handling     track elements. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2017-7750)

  - A use-after-free error exists in the nsDocumentViewer     class in nsDocumentViewer.cpp that is triggered when     handling content viewer listeners. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7751)

  - A use-after-free error exists that is triggered when     handling events while specific user interaction occurs     with the input method editor (IME). An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7752)

  - An out-of-bounds read error exists in the IsComplete()     function in WebGLTexture.cpp that is triggered when     handling textures. An unauthenticated, remote attacker     can exploit this to disclose memory contents.
    (CVE-2017-7754)

  - A privilege escalation vulnerability exists due to     improper loading of dynamic-link library (DLL) files. A     local attacker can exploit this, via a specially crafted     DLL file in the installation path, to inject and execute     arbitrary code. (CVE-2017-7755)

  - A use-after-free error exists in the SetRequestHead()     function in XMLHttpRequestMainThread.cpp that is     triggered when logging XML HTTP Requests (XHR). An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7756)

  - A use-after-free error exists in ActorsParent.cpp due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7757)

  - An out-of-bounds read error exists in the     AppendAudioSegment() function in TrackEncoder.cpp that     is triggered when the number of channels in an audio     stream changes while the Opus encoder is in use. An     unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-7758)

  - A flaw exists in the NS_main() function in updater.cpp     due to improper validation of input when handling     callback file path parameters. A local attacker can     exploit this to manipulate files in the installation     directory. (CVE-2017-7760)

  - A flaw exists in the Maintenance Service helper.exe     application that is triggered as permissions for a     temporary directory are set to writable by     non-privileged users. A local attacker can exploit this     to delete arbitrary files on the system. (CVE-2017-7761)

  - A flaw exists in the isLabelSafe() function in     nsIDNService.cpp that is triggered when handling     characters from different unicode blocks. An     unauthenticated, remote attacker can exploit this, via a     specially crafted IDN domain, to spoof a valid URL and     conduct phishing attacks. (CVE-2017-7764)

  - A flaw exists that is triggered due to improper parsing     of long filenames when handling downloaded files. An     unauthenticated, remote attacker can exploit this to     cause a file to be downloaded without the     'mark-of-the-web' applied, resulting in security     warnings for executables not being displayed.
    (CVE-2017-7765)

  - A flaw exists in the Mozilla Maintenance Service that is     triggered when handling paths for the 'patch',     'install', and 'working' directories. A local attacker     can exploit this to execute arbitrary code with elevated     privileges. (CVE-2017-7766)

  - A flaw exists in the Mozilla Maintenance Service that is     triggered when being invoked using the Mozilla Windows     Updater. A local attacker can exploit this to overwrite     arbitrary files with random data. (CVE-2017-7767)

  - A flaw exists in the IsStatusApplying() function in     workmonitor.cpp that is triggered when logging the     update status. A local attacker can exploit this to read     32 bytes of arbitrary files. (CVE-2017-7768)

  - Multiple integer overflow conditions exist in the     Graphite component in the decompress() function in     Decompressor.cpp due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2017-7772,     CVE-2017-7773, CVE-2017-7778)

  - An out-of-bounds read error exists in the Graphite     component in the readGraphite() function in Silf.cpp. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or disclose memory     contents. (CVE-2017-7774)

  - An out-of-bounds read error exists in the Graphite     component in getClassGlyph() function in Silf.cpp due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-7776)

  - A flaw exists in the Graphite component in the     read_glyph() function in GlyphCache.cpp related to use     of uninitialized memory. An unauthenticated, remote     attacker can exploit this to have an unspecified impact.
    (CVE-2017-7777)

The version of Firefox installed on the remote Windows host is prior to 54.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-15 advisory.

  - A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer     overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2     version 1.3.10. (CVE-2017-7778)

  - A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS     layout when attempting to use a node in the tree that no longer exists. This results in a potentially     exploitable crash. (CVE-2017-5472)

  - A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This     results in a potentially exploitable crash. (CVE-2017-7749)

  - A use-after-free vulnerability during video control operations when a <code><track></code> element     holds a reference to an older window if that window has been replaced in the DOM. This results in a     potentially exploitable crash. (CVE-2017-7750)

  - A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable     crash. (CVE-2017-7751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 52.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-16 advisory.

  - A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer     overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2     version 1.3.10. (CVE-2017-7778)

  - A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS     layout when attempting to use a node in the tree that no longer exists. This results in a potentially     exploitable crash. (CVE-2017-5472)

  - A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This     results in a potentially exploitable crash. (CVE-2017-7749)

  - A use-after-free vulnerability during video control operations when a <code><track></code> element     holds a reference to an older window if that window has been replaced in the DOM. This results in a     potentially exploitable crash. (CVE-2017-7750)

  - A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable     crash. (CVE-2017-7751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2017:1440 :

An update for firefox is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 52.2.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5470, CVE-2017-5472, CVE-2017-7749, CVE-2017-7751, CVE-2017-7756, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778, CVE-2017-7750, CVE-2017-7752, CVE-2017-7754, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Nils, Nicolas Trippar of Zimperium zLabs, Mats Palmgren, Philipp, Masayuki Nakano, Christian Holler, Andrew McCreight, Gary Kwong, Andre Bargull, Carsten Book, Jesse Schwartzentruber, Julian Hector, Marcia Knous, Ronald Crane, Samuel Erb, Holger Fuhrmannek, Tyson Smith, Abhishek Arya, and F. Alonso (revskills) as the original reporters.

Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code by convincing a user to visit a specially crafted website. (CVE-2017-5470, CVE-2017-5471)
 - A use-after-free error exists in the 'EndUpdate()' function in 'nsCSSFrameConstructor.cpp' that is triggered when reconstructing trees during regeneration of CSS layouts. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-5472)
 - A use-after-free error exists in the 'Reload()' function in 'nsDocShell.cpp' that is triggered when using an incorrect URL during the reload of a docshell. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7749)
 - A use-after-free error exists in the 'Hide()' function in 'nsDocumentViewer.cpp' that is triggered when handling track elements. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7750)
 - A use-after-free error exists in the nsDocumentViewer class in 'nsDocumentViewer.cpp' that is triggered when handling content viewer listeners. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7751)
 - A use-after-free error exists that is triggered when handling events while specific user interaction occurs with the input method editor (IME). An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7752)
 - An out-of-bounds read error exists in the 'IsComplete()' function in 'WebGLTexture.cpp' that is triggered when handling textures. An unauthenticated, remote attacker can exploit this to disclose memory contents. (CVE-2017-7754)
 - A privilege escalation vulnerability exists due to improper loading of dynamic-link library (DLL) files. A local attacker can exploit this, via a specially crafted DLL file in the installation path, to inject and execute arbitrary code. (CVE-2017-7755)
 - A use-after-free error exists in the 'SetRequestHead()' function in 'XMLHttpRequestMainThread.cpp' that is triggered when logging XML HTTP Requests (XHR). An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7756)
 - A use-after-free error exists in 'ActorsParent.cpp' due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7757)
 - An out-of-bounds read error exists in the 'AppendAudioSegment()' function in 'TrackEncoder.cpp' that is triggered when the number of channels in an audio stream changes while the Opus encoder is in use. An unauthenticated, remote attacker can exploit this to disclose sensitive information. (CVE-2017-7758)
 - A flaw exists in the 'NS_main()' function in 'updater.cpp' due to improper validation of input when handling callback file path parameters. A local attacker can exploit this to manipulate files in the installation directory. (CVE-2017-7760)
 - A flaw exists in the Maintenance Service 'helper.exe' application that is triggered as permissions for a temporary directory are set to writable by non-privileged users. A local attacker can exploit this to delete arbitrary files on the system. (CVE-2017-7761)
 - A flaw exists that is triggered when displaying URLs including authentication sections in reader mode. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to spoof domains in the address bar. (CVE-2017-7762)
 - A flaw exists in the 'ReadCMAP()' function in 'gfxMacPlatformFontList.mm' that is triggered when handling tibetan characters in combination with macOS fonts. An unauthenticated, remote attacker can exploit this, via a specially crafted IDN domain, to spoof a valid URL. (CVE-2017-7763)
 - A flaw exists in the 'isLabelSafe()' function in 'nsIDNService.cpp' that is triggered when handling characters from different unicode blocks. An unauthenticated, remote attacker can exploit this, via a specially crafted IDN domain, to spoof a valid URL and conduct phishing attacks. (CVE-2017-7764)
 - Multiple integer overflow conditions exist in the Graphite component in the 'decompress()' function in 'Decompressor.cpp' due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7772, CVE-2017-7778)
 - An out-of-bounds read error exists in the Graphite component in the 'readGraphite()' function in 'Silf.cpp'. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents. (CVE-2017-7774)
 - An out-of-bounds read error exists in the Graphite component in 'getClassGlyph()' function in 'Silf.cpp' due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2017-7776)
 - An flaw exists in the Graphite component in the 'read_glyph()' function in 'GlyphCache.cpp' related to use of uninitialized memory. An unauthenticated, remote attacker can exploit this to have an unspecified impact. (CVE-2017-7777)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101772	Mozilla Thunderbird < 52.2	Nessus	Windows	2017/7/17	2025/11/18	critical
127347	NewStart CGSL MAIN 4.05：thunderbird 多個弱點 (NS-SA-2019-0110)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	critical
275699	Mozilla Thunderbird < 52.2	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
101771	Mozilla Thunderbird < 52.2 多個弱點 (macOS)	Nessus	MacOS X Local Security Checks	2017/7/17	2025/12/10	critical
100809	Mozilla Firefox ESR < 52.2 多個弱點	Nessus	Windows	2017/6/15	2025/12/16	critical
100810	Mozilla Firefox < 54.0	Nessus	Windows	2017/6/15	2025/11/18	critical
100800	Oracle Linux 6/7：firefox (ELSA-2017-1440)	Nessus	Oracle Linux Local Security Checks	2017/6/15	2025/12/16	critical
275678	Mozilla Firefox ESR < 52.2	Nessus	Windows	2025/11/18	2025/11/18	critical
101855	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1127)	Nessus	Huawei Local Security Checks	2017/7/21	2025/12/9	critical
100835	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3315-1)	Nessus	Ubuntu Local Security Checks	2017/6/16	2024/1/16	critical
101772	Mozilla Thunderbird < 52.2	Nessus	Windows	2017/7/17	2025/11/18	critical
127347	NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0110)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	critical
101771	Mozilla Thunderbird < 52.2 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/7/17	2025/12/10	critical
275699	Mozilla Thunderbird < 52.2	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
100809	Mozilla Firefox ESR < 52.2 Multiple Vulnerabilities	Nessus	Windows	2017/6/15	2025/12/16	critical
100810	Mozilla Firefox < 54.0	Nessus	Windows	2017/6/15	2025/11/18	critical
275678	Mozilla Firefox ESR < 52.2	Nessus	Windows	2025/11/18	2025/11/18	critical
100800	Oracle Linux 6 / 7 : firefox (ELSA-2017-1440)	Nessus	Oracle Linux Local Security Checks	2017/6/15	2025/12/16	critical
700134	Mozilla Firefox < 54 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/6/14	2019/3/6	high

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high