MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues :

  - MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES

  - MFSA 2016-95/CVE-2016-9901: Data from Pocket server     improperly sanitized before execution

  - MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor     while manipulating DOM subtrees

  - MFSA 2016-95/CVE-2016-9899: Use-after-free while     manipulating DOM events and audio elements

  - MFSA 2016-95/CVE-2016-9904: Cross-origin information     leak in shared atoms

  - MFSA 2016-95/CVE-2016-9905: Crash in     EnumerateSubDocuments

  - MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag

  - MFSA 2016-95/CVE-2016-9900: Restricted external     resources can be loaded by SVG images through data URLs

  - MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in     Firefox 50.1 and Firefox ESR 45.6

  - MFSA 2016-95/CVE-2016-9902: Pocket extension does not     validate the origin of events Please see     https://www.mozilla.org/en-US/security/advisories/mfsa20     16-95/ for more information.

  - Fix fontconfig issue (bsc#1000751) on 32bit systems as     well.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox.
    (CVE-2016-9079,CVE-2016-9893,CVE-2016-9895,CVE-2016-989     7,CVE-2016-9898,CVE-2016-9899,CVE-2016-9900,CVE-2016-99     01,CVE-2016-9902,CVE-2016-9904,CVE-2016-9905,CVE-2017-5     373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378,     CVE-2017-5380, CVE-2017-5383, CVE-2017-5386,     CVE-2017-5390, CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Mozilla Firefox ESR earlier than 45.6 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'GetNPObjectWrapper()' function in 'dom/plugins/base/nsJSNPRuntime.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ObjectGroup::defaultNewGroup()' function in 'js/src/vm/ObjectGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling HTML5 content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsDocShell::RestoreFromHistory()' function in 'docshell/base/nsDocShell.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'Factory::CreateDrawTargetForData()' function in 'gfx/2d/Factory.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaRecorder.cpp' that is triggered when handling a document's activity state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHttpChunkedDecoder::ParseChunkRemaining()' function in 'netwerk/protocol/http/nsHttpChunkedDecoder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling media content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocument::EnumerateSubDocuments()' function in 'dom/base/nsDocument.cpp' that is triggered when adding and removing sub-documents. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/BindingUtils.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling DOM subtrees. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'VaryingPacking::packVarying()' function in 'libANGLE/renderer/d3d/hlsl/VaryingPacking.cpp'. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling failing node adoption. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as event handlers for marquee elements are executed despite restrictions against inline JavaScript. This may allow a context-dependent attacker to bypass the Content Security Policy (CSP).
 - A flaw exists in the 'nsDataDocumentContentPolicy::ShouldLoad()' function in 'dom/base/nsDataDocumentContentPolicy.cpp', as external resources may be inappropriately loaded by SVG images by utilizing 'data: URLs'. This may allow a context-dependent attacker to disclose potentially sensitive cross-domain information.
 - A flaw exists that is triggered as HTML tags from the Pocket server are not properly sanitized before use. This may allow a context-dependent attacker to inject content and gain access to the Pocket Messaging API.
 - A flaw exists in 'browser/extensions/pocket/content/main.js' related to the Pocket toolbar button, as it fails to properly verify the origin of events. This may potentially allow a context-dependent attacker to execute commands from other contexts.
 - A flaw exists that is triggered as atom information may be exposed. This may allow a context-dependent attacker to use a JavaScript Map/Set timing attack to determine if atoms are used by other compartments or zones, potentially disclosing cross-domain information.

Versions of Mozilla Firefox prior to 50.1 are unpatched for the following vulnerabilities :

 - A flaw exists in 'layout/style/nsRuleNode.cpp' that is triggered when handling style contexts. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'GrResourceProvider::createBuffer()' function in 'gfx/skia/skia/src/gpu/GrResourceProvider.cpp'. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling clamped gradients. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A flaw exists in the 'GetNPObjectWrapper()' function in 'dom/plugins/base/nsJSNPRuntime.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ObjectGroup::defaultNewGroup()' function in 'js/src/vm/ObjectGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling HTML5 content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsDocShell::RestoreFromHistory()' function in 'docshell/base/nsDocShell.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'Factory::CreateDrawTargetForData()' function in 'gfx/2d/Factory.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaRecorder.cpp' that is triggered when handling a document's activity state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHttpChunkedDecoder::ParseChunkRemaining()' function in 'network/protocol/http/nsHttpChunkedDecoder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling media content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/BindingUtils.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists because 'addon-sdk/source/lib/sdk/ui/frame/view.html' and 'addon-sdk/source/lib/sdk/ui/frame/view.js' within the Add-ons SDK do not properly validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and an add-on.
 - A use-after-free error exists in the handling of navigator objects within WebVR. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling DOM subtrees. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'VaryingPacking::packVarying()' function in 'libANGLE/renderer/d3d/hlsl/VaryingPacking.cpp'. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling failing node adoption. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as event handlers for marquee elements are executed despite restrictions against inline JavaScript. This may allow a context-dependent attacker to bypass the Content Security Policy (CSP).
 - A flaw exists in the 'nsDataDocumentContentPolicy::ShouldLoad()' function in 'dom/base/nsDataDocumentContentPolicy.cpp', as external resources may be inappropriately loaded by SVG images by utilizing 'data: URLs'. This may allow a context-dependent to disclose potentially sensitive cross-domain information.
 - A flaw exists that is triggered as HTML tags from the Pocket server are not properly sanitized before use. This may allow a context-dependent attacker to inject content and gain access to the Pocket Messaging API.
 - A flaw exists in 'browser/extensions/pocket/content/main.js' related to the Pocket toolbar button, as it fails to properly verify the origin of events. This may potentially allow a context-dependent attacker to execute commands from other contexts.
 - A flaw exists that is triggered as atom information may be exposed. This may allow a context-dependent attacker to use a JavaScript Map/Set timing attack to determine if atoms are used by other compartments or zones, potentially disclosing cross-domain information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
96083	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2016:3223-1)	Nessus	SuSE Local Security Checks	2016/12/22	2021/1/19	critical
99857	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1011)	Nessus	Huawei Local Security Checks	2017/5/1	2023/6/22	critical
9853	Mozilla Firefox ESR < 45.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/1/5	2019/11/6	high
9851	Mozilla Firefox < 50.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/1/5	2019/3/6	high

偵測

搜尋 Plugin

critical

critical

high

high