The version of Mozilla Firefox installed on the remote Windows host is prior to 56. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

Mozilla Foundation reports :

CVE-2017-7793: Use-after-free with Fetch API

CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode

CVE-2017-7818: Use-after-free during ARIA array manipulation

CVE-2017-7819: Use-after-free while resizing images in design mode

CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE

CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes

CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files

CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

CVE-2017-7813: Integer truncation in the JavaScript parser

CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces

CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations

CVE-2017-7816: WebExtensions can load about: URLs in extension UI

CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction

CVE-2017-7823: CSP sandbox directive did not create a unique origin

CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV

CVE-2017-7820: Xray wrapper bypass with new tab and web console

CVE-2017-7811: Memory safety bugs fixed in Firefox 56

CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

リモートのWindowsホストにインストールされているMozilla Firefoxのバージョンは56より前のバージョンです。したがって、コードの実行を許す脆弱性や悪用可能なクラッシュを引き起こす脆弱性など、複数の脆弱性の影響を受けます。

Mozilla Foundation による報告：

CVE-2017-7793:Fetch APIを使用したメモリ解放後使用（Use After Free）

CVE-2017-7817:フルスクリーンモードを介したFirefox for Androidアドレスバースプーフィング

CVE-2017-7818:ARIA配列操作中のメモリ解放後使用（Use After Free）

CVE-2017-7819:デザインモードでの画像のサイズ変更中のメモリ解放後使用（Use After Free）

CVE-2017-7824:ANGLEを使用した要素の描画および検証時のバッファオーバーフロー

CVE-2017-7805:ハンドシェイクハッシュを生成するTLS 1.2でのメモリ解放後使用（Use After Free）

CVE-2017-7812:悪意のあるページコンテンツをタブバーにドラッグアンドドロップすると、ローカルに保存されたファイルが開かれる可能性がある

CVE-2017-7814:BlobとデータURLがフィッシング保護警告とマルウェア保護警告をバイパスする

CVE-2017-7813:JavaScriptパーサーにおける整数切り捨て

CVE-2017-7825:OS Xフォントが、一部のチベット語とアラビア語のunicode文字をスペースとしてレンダリングする

CVE-2017-7815:e10以外のインストールでのモーダルダイアログを使用したスプーフィング攻撃

CVE-2017-7816:WebExtensionsが、以下をロードができる拡張UI内のURL

CVE-2017-7821:WebExtensionsが、ユーザーの操作なしで非実行可能ファイルをダウンロードして開くことができる

CVE-2017-7823:CSPサンドボックスディレクティブが一意のオリジンを作成しない

CVE-2017-7822:WebCryptoが、長さゼロのIVを使用したAES-GCMを許可する

CVE-2017-7820:Xrayラッパーが、新しいタブとWebコンソールでバイパスする

CVE-2017-7811:Firefox 56で修正されたメモリ安全性に関するバグ

CVE-2017-7810:Firefox 56とFirefox ESR 52.4で修正されたメモリ安全性に関するバグ

远程 Windows 主机上安装的 Mozilla Firefox 版本低于 56。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可利用的崩溃。

遠端 Windows 主機上安裝的 Mozilla Firefox 版本比 56 舊。因此受到多個弱點影響，其中有些允許程式碼執行並可能遭惡意利用而當機。

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3435-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain     sensitive information, bypass phishing and malware protection, spoof the origin in modal dialogs, conduct     cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary     code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814,     CVE-2017-7815, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824)

    Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-7805)

    Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a     specially crafted extension, an attacker could potentially exploit these to download and open non-     executable files without interaction, or obtain elevated privileges. (CVE-2017-7816, CVE-2017-7821)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 56. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable application crashes.

Firefoxで複数のセキュリティの問題が発見されました。ユーザーが誘導されて特別に細工された Web サイトを開くと、攻撃者はこれらを悪用して、初期化されていないメモリの読み取り、秘密情報の取得、フィッシングやマルウェア保護のバイパス、モーダルダイアログでのオリジンの偽装、クロスサイトスクリプティング (XSS) 攻撃、アプリケーションクラッシュを介したサービス拒否、任意のコードの実行などを行う可能性があります。(CVE-2017-7793、CVE-2017-7810、CVE-2017-7811、CVE-2017-7812、CVE-2017-7813、CVE-2017-7814、CVE-2017-7815、CVE-2017-7818、CVE-2017-7819、CVE-2017-7820、CVE-2017-7822、CVE-2017-7823、CVE-2017-7824)

Martin Thomson氏は、NSSがハンドシェイクハッシュを不適切に生成することを発見しました。リモートの攻撃者がこれを悪用して、アプリケーションのクラッシュによりサービス拒否を引き起こしたり、任意のコードを実行したりする可能性があります。
(CVE-2017-7805)

WebExtensionsで、複数のセキュリティの問題が発見されました。ユーザーが誘導されて特別に細工された拡張機能をインストールすると、攻撃者がこれらを悪用して、相互作用せずに実行不可能なファイルをダウンロードして開いたり、昇格した権限を取得したりする可能性があります。(CVE-2017-7816、CVE-2017-7821)。

注意: Tenable Network Security は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートのmacOSまたはMac OS XホストにインストールされているMozilla Firefoxのバージョンは56より前です。したがって、コードの実行や悪用可能なアプリケーションのクラッシュを引き起こすなど、複数の脆弱性の影響を受けます。

在 Firefox 中發現多個安全性問題。如果使用者遭誘騙而開啟特製網站，攻擊者可能會利用這些弱點讀取未初始化記憶體、取得敏感資訊、繞過釣魚和惡意軟體保護、偽造模型對話方塊中的來源、發動跨網站指令碼 (XSS) 攻擊、透過應用程式損毀造成拒絕服務或是執行任意程式碼。(CVE-2017-7793、CVE-2017-7810、CVE-2017-7811、CVE-2017-7812、CVE-2017-7813、CVE-2017-7814、CVE-2017-7815、CVE-2017-7818、CVE-2017-7819、CVE-2017-7820、CVE-2017-7822、CVE-2017-7823、CVE-2017-7824)

Martin Thomson 發現 NSS 未正確產生交握雜湊。遠端攻擊者可能惡意利用此錯誤，透過應用程式損毀造成拒絕服務或執行任意程式碼。
(CVE-2017-7805)

在 WebExtensions 中發現多個安全性問題。如果使用者遭誘騙而安裝特製延伸模組，攻擊者可能會利用這些弱點在沒有互動的情況下，下載並開啟非執行檔，或取得提升權限。(CVE-2017-7816、CVE-2017-7821)

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端 macOS 或 Mac OS X 主機上安裝的 Mozilla Firefox 版本比 56 版舊。因此受到多個弱點影響，其中有些允許程式碼執行並可能遭惡意利用而使應用程式損毀。

在 Firefox 中发现多个安全问题。如果用户受到诱骗打开特制的网站，攻击者可能利用这些漏洞读取未初始化内存、获取敏感信息、绕过钓鱼和恶意软件保护、伪造模态对话起源、执行跨站脚本 (XSS) 攻击、通过应用程序崩溃造成拒绝服务，或者执行任意代码。（CVE-2017-7793、CVE-2017-7810、CVE-2017-7811、CVE-2017-7812、CVE-2017-7813、CVE-2017-7814、CVE-2017-7815、CVE-2017-7818、CVE-2017-7819、CVE-2017-7820、CVE-2017-7822、CVE-2017-7823、CVE-2017-7824）

Martin Thomson 发现 NSS 未能正确生成握手哈希。远程攻击者可能利用此缺陷，通过应用程序崩溃造成拒绝服务或是执行任意代码。
(CVE-2017-7805)

在 WebExtensions 中发现多个安全问题。如果用户受到诱骗安装特制扩展，攻击者可能利用这些问题在不需要互动时下载和打开非可执行文件，或获取权限提升。（CVE-2017-7816、CVE-2017-7821）

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 56。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可遭利用的应用程序崩溃。

Versions of Mozilla Firefox earlier than 56 are unpatched for the following vulnerabilities :

 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'js::AddPropertyTypesAfterProtoChange()' function in 'js/src/vm/NativeObject.cpp' that is triggered when handling the 'unknown-properties' flag. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'layout/style/nsCSSPseudoElements.cpp' that is triggered when handling pseudo-element atoms. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'dom/base/nsDocument.cpp' that is triggered when handling intersection observers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'LayerTransactionParent::Destroy()' function in 'gfx/layers/ipc/LayerTransactionParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'FPSCounter::PrintHistogram()' function in 'gfx/layers/composite/FPSCounter.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'FlagAllOperandsAsHavingRemovedUses()' function in 'js/src/jit/IonAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'memory/mozjemalloc/mozjemalloc.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ReadCompressedIndexDataValuesFromBlob()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'js/src/vm/StructuredClone.cpp' that is triggered when handling structured clone reads. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling root elements in the editor. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/GraphDriver.cpp' that is triggered when handling errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'hnj_hyphen_hyphword()' function in 'hyphen.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code within a process linked against the library.
 - A flaw exists in the 'EditorBase::FinalizeSelection()' function in 'editor/libeditor/EditorBase.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A use-after-free condition exists in the Fetch API related to missing thread safety. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when pages enter fullscreen mode without user notification. This allows a context-dependent attacker to spoof the address bar.
 - A use-after-free error exists in 'accessible/generic/DocAccessible.cpp' that is triggered when manipulating Accessible Rich Internet Applications (ARIA) elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in design mode that is triggered when objects are resized. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'ssl3_HandleCertificateVerify()' function in 'lib/ssl/ssl3con.c' that is triggered when handling handshake hashes during TLS '1.2' exchanges. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as the content principal is not properly checked when handling drag and drop actions onto the browser UI. With specially crafted web content including file: URLs, a context-dependent attacker can open local files.
 - A flaw exists in the PendingLookup class in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered when handling downloads encoded with data: and blob: URL elements. This may allow a context-dependent attacker to bypass the phishing and malware protection feature.
 - An integer truncation flaw exists in the JavaScript parser that may allow a context-dependent attacker to potentially disclose memory contents.
 - A flaw exists in the 'MacOSFontEntry::ReadCMAP()' function in 'gfx/thebes/gfxMacPlatformFontList.mm' that is triggered as certain tibetan and arabic unicode characters are displayed as whitespace in combination with macOS fonts. With a specially crafted IDN domain, a context-dependent attacker can spoof a valid URL and conduct phishing attacks.
 - A flaw exists that is triggered when creating a modal dialog using the data: protocol via JavaScript. With a specially crafted web page, a context-dependent attacker can spoof the origin of the modal dialog.
 - A flaw exists in the WebExtensions component that is triggered when handling popups and panels in the extension UI. This may allow a context-dependent attacker to load an 'about:' URL.
 - A flaw exists in the WebExtensions component that is triggered when handling file downloads. This may allow a context-dependent attacker to download and open files without user interaction.
 - A flaw exists in the 'nsDocument::InitCSP()' function in 'dom/base/nsDocument.cpp' that is triggered as the sandbox directive does not create unique origin. This may result in incorrect enforcement of the content security policy (CSP).
 - A flaw exists in the WebCrypto API that is triggered as the AES-GCM implementation allows a zero-length IV. This may allow a context-dependent attacker to determine the authentication key.
 - A flaw exists that is is triggered as results of the 'instanceof' operator can be manipulated. With specially crafted web content, a context-dependent attacker can bypass the Xray wrapper mechanism.
 - An unspecified flaw exists that is triggered when drawing and validating elements with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.

ID	名稱	產品	系列	已發布	已更新	嚴重性
103680	Mozilla Firefox < 56 Multiple Vulnerabilities	Nessus	Windows	2017/10/6	2019/11/12	critical
103556	FreeBSD : mozilla -- multiple vulnerabilities (1098a15b-b0f6-42b7-b5c7-8a8646e8be07)	Nessus	FreeBSD Local Security Checks	2017/9/29	2021/1/4	critical
103680	Mozilla Firefox < 56の複数の脆弱性	Nessus	Windows	2017/10/6	2019/11/12	critical
103556	FreeBSD: mozilla -- 複数の脆弱性（1098a15b-b0f6-42b7-b5c7-8a8646e8be07）	Nessus	FreeBSD Local Security Checks	2017/9/29	2021/1/4	critical
103680	Mozilla Firefox < 56 多个漏洞	Nessus	Windows	2017/10/6	2019/11/12	critical
103680	Mozilla Firefox < 56 Multiple Vulnerabilities	Nessus	Windows	2017/10/6	2019/11/12	critical
103646	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3435-1)	Nessus	Ubuntu Local Security Checks	2017/10/3	2024/8/27	critical
103678	Mozilla Firefox < 56 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/10/6	2019/11/12	critical
103646	Ubuntu 14.04LTS / 16.04LTS : Firefox の脆弱性 (USN-3435-1)	Nessus	Ubuntu Local Security Checks	2017/10/3	2024/8/27	critical
103678	Mozilla Firefox < 56の複数の脆弱性（macOS）	Nessus	MacOS X Local Security Checks	2017/10/6	2019/11/12	critical
103646	Ubuntu 14.04 LTS / 16.04 LTS：Firefox 弱點 (USN-3435-1)	Nessus	Ubuntu Local Security Checks	2017/10/3	2024/8/27	critical
103678	Mozilla Firefox < 56 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/10/6	2019/11/12	critical
103646	Ubuntu 14.04 LTS / 16.04 LTS：Firefox 漏洞 (USN-3435-1)	Nessus	Ubuntu Local Security Checks	2017/10/3	2024/8/27	critical
103678	Mozilla Firefox < 56 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/10/6	2019/11/12	critical
700321	Mozilla Firefox < 56 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	high

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high