Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, same-origin policy bypass issues, integer overflows, buffer overflows and use-after-frees may lead to the execution of arbitrary code or denial of service.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 50.0. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

This update to Mozilla Firefox 50.0.2, Thunderbird 45.5.1 and NSS 3.16.2 fixes a number of security issues.

The following vulnerabilities were fixed in Mozilla Firefox (MFSA 2016-89) :

  - CVE-2016-5296: Heap-buffer-overflow WRITE in     rasterize_edges_1 (bmo#1292443)

  - CVE-2016-5292: URL parsing causes crash (bmo#1288482)

  - CVE-2016-5297: Incorrect argument length checking in     JavaScript (bmo#1303678)

  - CVE-2016-9064: Addons update must verify IDs match     between current and new versions (bmo#1303418)

  - CVE-2016-9066: Integer overflow leading to a buffer     overflow in nsScriptLoadHandler (bmo#1299686)

  - CVE-2016-9067: heap-use-after-free in     nsINode::ReplaceOrInsertBefore (bmo#1301777, bmo#1308922     (CVE-2016-9069))

  - CVE-2016-9068: heap-use-after-free in nsRefreshDriver     (bmo#1302973)

  - CVE-2016-9075: WebExtensions can access the     mozAddonManager API and use it to gain elevated     privileges (bmo#1295324)

  - CVE-2016-9077: Canvas filters allow feDisplacementMaps     to be applied to cross-origin images, allowing timing     attacks on them (bmo#1298552)

  - CVE-2016-5291: Same-origin policy violation using local     HTML file and saved shortcut file (bmo#1292159)

  - CVE-2016-9070: Sidebar bookmark can have reference to     chrome window (bmo#1281071)

  - CVE-2016-9073: windows.create schema doesn't specify     'format': 'relativeUrl' (bmo#1289273)

  - CVE-2016-9076: select dropdown menu can be used for URL     bar spoofing on e10s (bmo#1276976)

  - CVE-2016-9063: Possible integer overflow to fix inside     XML_Parse in expat (bmo#1274777)

  - CVE-2016-9071: Probe browser history via HSTS/301     redirect + CSP (bmo#1285003)

  - CVE-2016-5289: Memory safety bugs fixed in Firefox 50

  - CVE-2016-5290: Memory safety bugs fixed in Firefox 50     and Firefox ESR 45.5

    The following vulnerabilities were fixed in Mozilla NSS     3.26.1 :

  - CVE-2016-9074: Insufficient timing side-channel     resistance in divSpoiler (bmo#1293334)

    Mozilla Firefox now requires mozilla-nss 3.26.2.

    New features in Mozilla Firefox :

  - Updates to keyboard shortcuts Set a preference to have     Ctrl+Tab cycle through tabs in recently used order View     a page in Reader Mode by using Ctrl+Alt+R

  - Added option to Find in page that allows users to limit     search to whole words only

  - Added download protection for a large number of     executable file types on Windows, Mac and Linux

  - Fixed rendering of dashed and dotted borders with     rounded corners (border-radius)

  - Added a built-in Emoji set for operating systems without     native Emoji fonts

  - Blocked versions of libavcodec older than 54.35.1

  - additional locale

    mozilla-nss was updated to 3.26.2, incorporating the     following changes :

  - the selfserv test utility has been enhanced to support     ALPN (HTTP/1.1) and 0-RTT

  - The following CA certificate was added: CN = ISRG Root     X1

  - NPN is disabled and ALPN is enabled by default

  - MD5 signature algorithms sent by the server in     CertificateRequest messages are now properly ignored

This update for MozillaFirefox, mozilla-nss fixes security issues and bugs. The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026) :

  - CVE-2016-9079: Use-after-free in SVG Animation     (bsc#1012964 MFSA 2016-92)

  - CVE-2016-5297: Incorrect argument length checking in     JavaScript (bsc#1010401)

  - CVE-2016-9066: Integer overflow leading to a buffer     overflow in nsScriptLoadHandler (bsc#1010404)

  - CVE-2016-5296: Heap-buffer-overflow WRITE in     rasterize_edges_1 (bsc#1010395)

  - CVE-2016-9064: Addons update must verify IDs match     between current and new versions (bsc#1010402)

  - CVE-2016-5290: Memory safety bugs fixed in Firefox 50     and Firefox ESR 45.5 (bsc#1010427)

  - CVE-2016-5291: Same-origin policy violation using local     HTML file and saved shortcut file (bsc#1010410) The     following vulnerabilities were fixed in mozilla-nss     3.21.3 :

  - CVE-2016-9074: Insufficient timing side-channel     resistance in divSpoiler (bsc#1010422)

  - CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey     / ssl3_ComputeRecordMACConstantTime causes server crash     (bsc#1010517) The following bugs were fixed :

  - Firefox would fail to go into fullscreen mode with some     window managers (bsc#992549)

  - font warning messages would flood console, now using     fontconfig configuration from firefox-fontconfig instead     of the system one (bsc#1000751)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Franziskus Kiefer reported that the existing mitigations for some timing side-channel attacks were insufficient:
https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/#CVE-201 6-9074

For Debian 7 'Wheezy', these problems have been fixed in version 2:3.26-1+debu7u2.

We recommend that you upgrade your nss packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3163-1 advisory.

    It was discovered that NSS incorrectly handled certain invalid Diffie-Hellman keys. A remote attacker     could possibly use this flaw to cause NSS to crash, resulting in a denial of service. This issue only     applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5285)

    Hubert Kario discovered that NSS incorrectly handled Diffie Hellman client key exchanges. A remote     attacker could possibly use this flaw to perform a small subgroup confinement attack and recover private     keys. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8635)

    Franziskus Kiefer discovered that NSS incorrectly mitigated certain timing side-channel attacks. A remote     attacker could possibly use this flaw to recover private keys. (CVE-2016-9074)

    This update refreshes the NSS package to version 3.26.2 which includes the latest CA certificate bundle.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox ESR installed on the remote Windows host is 45.x prior to 45.5. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, same-origin policy bypass issues, integer overflows, buffer overflows and use-after-frees may lead to the execution of arbitrary code or denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 45.5.1-1~deb7u1.

We recommend that you upgrade your icedove packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Foundation reports :

Please reference CVE/URL list for details

The version of Mozilla Firefox installed on the remote Windows host is prior to 50.0. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

This update to Mozilla Firefox 50.0 fixes a number of security issues.

The following vulnerabilities were fixed in Mozilla Firefox (MFSA 2016-89) :

  - CVE-2016-5296: Heap-buffer-overflow WRITE in     rasterize_edges_1 (bmo#1292443)

  - CVE-2016-5292: URL parsing causes crash (bmo#1288482)

  - CVE-2016-5297: Incorrect argument length checking in     JavaScript (bmo#1303678)

  - CVE-2016-9064: Addons update must verify IDs match     between current and new versions (bmo#1303418)

  - CVE-2016-9066: Integer overflow leading to a buffer     overflow in nsScriptLoadHandler (bmo#1299686)

  - CVE-2016-9067: heap-use-after-free in     nsINode::ReplaceOrInsertBefore (bmo#1301777, bmo#1308922     (CVE-2016-9069))

  - CVE-2016-9068: heap-use-after-free in nsRefreshDriver     (bmo#1302973)

  - CVE-2016-9075: WebExtensions can access the     mozAddonManager API and use it to gain elevated     privileges (bmo#1295324)

  - CVE-2016-9077: Canvas filters allow feDisplacementMaps     to be applied to cross-origin images, allowing timing     attacks on them (bmo#1298552)

  - CVE-2016-5291: Same-origin policy violation using local     HTML file and saved shortcut file (bmo#1292159)

  - CVE-2016-9070: Sidebar bookmark can have reference to     chrome window (bmo#1281071)

  - CVE-2016-9073: windows.create schema doesn't specify     'format': 'relativeUrl' (bmo#1289273)

  - CVE-2016-9076: select dropdown menu can be used for URL     bar spoofing on e10s (bmo#1276976)

  - CVE-2016-9063: Possible integer overflow to fix inside     XML_Parse in expat (bmo#1274777)

  - CVE-2016-9071: Probe browser history via HSTS/301     redirect + CSP (bmo#1285003)

  - CVE-2016-5289: Memory safety bugs fixed in Firefox 50

  - CVE-2016-5290: Memory safety bugs fixed in Firefox 50     and Firefox ESR 45.5

The following vulnerabilities were fixed in Mozilla NSS 3.26.1 :

  - CVE-2016-9074: Insufficient timing side-channel     resistance in divSpoiler (bmo#1293334) Mozilla Firefox     now requires mozilla-nss 3.26.2.

New features in Mozilla Firefox :

  - Updates to keyboard shortcuts Set a preference to have     Ctrl+Tab cycle through tabs in recently used order View     a page in Reader Mode by using Ctrl+Alt+R

  - Added option to Find in page that allows users to limit     search to whole words only

  - Added download protection for a large number of     executable file types on Windows, Mac and Linux

  - Fixed rendering of dashed and dotted borders with     rounded corners (border-radius)

  - Added a built-in Emoji set for operating systems without     native Emoji fonts

  - Blocked versions of libavcodec older than 54.35.1

  - additional locale

mozilla-nss was updated to 3.26.2, incorporating the following changes :

  - the selfserv test utility has been enhanced to support     ALPN (HTTP/1.1) and 0-RTT

  - The following CA certificate was added: CN = ISRG Root     X1

  - NPN is disabled and ALPN is enabled by default

  - MD5 signature algorithms sent by the server in     CertificateRequest messages are now properly ignored

This update for MozillaFirefox, mozilla-nss fixes security issues and bugs. The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026 bsc#1012964) :

  - CVE-2016-9079: Use-after-free in SVG Animation (MFSA     2016-92 bsc#1012964)

  - CVE-2016-5297: Incorrect argument length checking in     JavaScript (bsc#1010401)

  - CVE-2016-9066: Integer overflow leading to a buffer     overflow in nsScriptLoadHandler (bsc#1010404)

  - CVE-2016-5296: Heap-buffer-overflow WRITE in     rasterize_edges_1 (bsc#1010395)

  - CVE-2016-9064: Addons update must verify IDs match     between current and new versions (bsc#1010402)

  - CVE-2016-5290: Memory safety bugs fixed in Firefox 50     and Firefox ESR 45.5 (bsc#1010427)

  - CVE-2016-5291: Same-origin policy violation using local     HTML file and saved shortcut file (bsc#1010410) The     following vulnerabilities were fixed in mozilla-nss     3.21.3 :

  - CVE-2016-9074: Insufficient timing side-channel     resistance in divSpoiler (bsc#1010422)

  - CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey     / ssl3_ComputeRecordMACConstantTime causes server crash     (bsc#1010517) The following bugs were fixed :

  - Firefox would fail to go into fullscreen mode with some     window managers (bsc#992549)

  - font warning messages would flood console, now using     fontconfig configuration from firefox-fontconfig instead     of the system one (bsc#1000751)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
95666	Debian DSA-3730-1 : icedove - security update	Nessus	Debian Local Security Checks	2016/12/12	2026/1/14	critical
94958	Mozilla Firefox < 50.0 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2016/11/18	2026/3/3	critical
95590	openSUSE Security Update : Mozilla Firefox / Thunderbird and NSS (openSUSE-2016-1407)	Nessus	SuSE Local Security Checks	2016/12/7	2026/1/15	critical
95797	SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2016:3105-1)	Nessus	SuSE Local Security Checks	2016/12/14	2026/1/14	critical
96094	Debian DLA-759-1 : nss security update	Nessus	Debian Local Security Checks	2016/12/27	2026/1/7	medium
96304	Ubuntu 14.04 LTS / 16.04 LTS : NSS vulnerabilities (USN-3163-1)	Nessus	Ubuntu Local Security Checks	2017/1/5	2026/1/6	medium
94959	Mozilla Firefox ESR 45.x < 45.5 Multiple Vulnerabilities	Nessus	Windows	2016/11/18	2026/6/23	critical
96013	Debian DLA-752-1 : icedove security update	Nessus	Debian Local Security Checks	2016/12/20	2026/1/8	critical
94904	FreeBSD : mozilla -- multiple vulnerabilities (d1853110-07f4-4645-895b-6fd462ad0589)	Nessus	FreeBSD Local Security Checks	2016/11/16	2026/1/16	critical
94960	Mozilla Firefox < 50.0 Multiple Vulnerabilities	Nessus	Windows	2016/11/18	2026/6/23	critical
95022	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-1334)	Nessus	SuSE Local Security Checks	2016/11/21	2026/1/16	critical
95712	SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2016:3080-1)	Nessus	SuSE Local Security Checks	2016/12/12	2026/1/14	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

medium

medium

critical

critical

critical

critical

critical

critical