The remote NewStart CGSL host, running version MAIN 4.05, has firefox packages installed that are affected by multiple vulnerabilities:

  - File downloads encoded with blob: and data: URL     elements bypassed normal file download checks though the     Phishing and Malware Protection feature and its block     lists of suspicious sites and files. This would allow     malicious sites to lure users into downloading     executables that would otherwise be detected as     suspicious. This vulnerability affects Firefox < 56,     Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7814)

  - A use-after-free vulnerability can occur in design mode     when image objects are resized if objects referenced     during the resizing have been freed from memory. This     results in a potentially exploitable crash. This     vulnerability affects Firefox < 56, Firefox ESR < 52.4,     and Thunderbird < 52.4. (CVE-2017-7819)

  - The content security policy (CSP) sandbox directive     did not create a unique origin for the document, causing     it to behave as if the allow-same-origin keyword were     always specified. This could allow a Cross-Site     Scripting (XSS) attack to be launched from unsafe     content. This vulnerability affects Firefox < 56,     Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7823)

  - A use-after-free vulnerability can occur when an editor     DOM node is deleted prematurely during tree traversal     while still bound to the document. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.3, Firefox ESR < 52.3, and     Firefox < 55. (CVE-2017-7809)

  - Memory safety bugs were reported in Firefox 54, Firefox     ESR 52.2, and Thunderbird 52.2. Some of these bugs     showed evidence of memory corruption and we presume that     with enough effort that some of these could be exploited     to run arbitrary code. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7779)

  - An out-of-bounds read occurs when applying style rules     to pseudo-elements, such as ::first-line, using cached     style data. This vulnerability affects Thunderbird <     52.3, Firefox ESR < 52.3, and Firefox < 55.
    (CVE-2017-7753)

  - A buffer overflow can occur when manipulating Accessible     Rich Internet Applications (ARIA) attributes within the     DOM. This results in a potentially exploitable crash.
    This vulnerability affects Thunderbird < 52.3, Firefox     ESR < 52.3, and Firefox < 55. (CVE-2017-7785)

  - A buffer overflow can occur when the image renderer     attempts to paint non-displayable SVG elements. This     results in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7786)

  - Same-origin policy protections can be bypassed on pages     with embedded iframes during page reloads, allowing the     iframes to access content on the top level page, leading     to information disclosure. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7787)

  - A buffer overflow will occur when viewing a certificate     in the certificate manager if the certificate has an     extremely long object identifier (OID). This results in     a potentially exploitable crash. This vulnerability     affects Thunderbird < 52.3, Firefox ESR < 52.3, and     Firefox < 55. (CVE-2017-7792)

  - On pages containing an iframe, the data: protocol can     be used to create a modal alert that will render over     arbitrary domains following page navigation, spoofing of     the origin of the modal alert from the iframe content.
    This vulnerability affects Thunderbird < 52.3, Firefox     ESR < 52.3, and Firefox < 55. (CVE-2017-7791)

  - A use-after-free vulnerability can occur in WebSockets     when the object holding the connection is freed before     the disconnection operation is finished. This results in     an exploitable crash. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7800)

  - The Developer Tools feature suffers from a XUL injection     vulnerability due to improper sanitization of the web     page source code. In the worst case, this could allow     arbitrary code execution when opening a malicious page     with the style editor tool. This vulnerability affects     Firefox ESR < 52.3 and Firefox < 55. (CVE-2017-7798)

  - A use-after-free vulnerability can occur when     manipulating the DOM during the resize event of an image     element. If these elements have been freed due to a lack     of strong references, a potentially exploitable crash     may occur when the freed elements are accessed. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7802)

  - A use-after-free vulnerability can occur while re-     computing layout for a marquee element during window     resizing where the updated style object is freed while     still in use. This results in a potentially exploitable     crash. This vulnerability affects Thunderbird < 52.3,     Firefox ESR < 52.3, and Firefox < 55. (CVE-2017-7801)

  - A mechanism that uses AppCache to hijack a URL in a     domain using fallback by serving the files from a sub-     path on the domain. This has been addressed by requiring     fallback files be inside the manifest directory. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7807)

  - When a page's content security policy (CSP) header     contains a sandbox directive, other directives are     ignored. This results in the incorrect enforcement of     CSP. This vulnerability affects Thunderbird < 52.3,     Firefox ESR < 52.3, and Firefox < 55. (CVE-2017-7803)

  - A use-after-free vulnerability can occur when reading an     image observer during frame reconstruction after the     observer has been freed. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7784)

  - A use-after-free vulnerability can occur when     manipulating arrays of Accessible Rich Internet     Applications (ARIA) elements within containers through     the DOM. This results in a potentially exploitable     crash. This vulnerability affects Firefox < 56, Firefox     ESR < 52.4, and Thunderbird < 52.4. (CVE-2017-7818)

  - A buffer overflow occurs when drawing and validating     elements with the ANGLE graphics library, used for WebGL     content. This is due to an incorrect value being passed     within the library during checks and results in a     potentially exploitable crash. This vulnerability     affects Firefox < 56, Firefox ESR < 52.4, and     Thunderbird < 52.4. (CVE-2017-7824)

  - Memory safety bugs were reported in Firefox 55 and     Firefox ESR 52.3. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 56, Firefox     ESR < 52.4, and Thunderbird < 52.4. (CVE-2017-7810)

  - A use-after-free vulnerability can occur in the Fetch     API when the worker or the associated window are freed     when still in use, resulting in a potentially     exploitable crash. This vulnerability affects Firefox <     56, Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7793)

  - A privacy flaw was discovered in Firefox. In Private     Browsing mode, a web worker could write persistent data     to IndexedDB, which was not cleared when exiting and     would persist across multiple sessions. A malicious     website could exploit the flaw to bypass private-     browsing protections and uniquely fingerprint visitors.
    (CVE-2017-7843)

  - A use-after-free vulnerability can occur when flushing     and resizing layout because the PressShell object has     been freed while still in use. This results in a     potentially exploitable crash during these operations.
    This vulnerability affects Firefox < 57, Firefox ESR <     52.5, and Thunderbird < 52.5. (CVE-2017-7828)

  - Memory safety bugs were reported in Firefox 56 and     Firefox ESR 52.4. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 57, Firefox     ESR < 52.5, and Thunderbird < 52.5. (CVE-2017-7826)

  - The Resource Timing API incorrectly revealed navigations     in cross-origin iframes. This is a same-origin policy     violation and could allow for data theft of URLs loaded     by users. This vulnerability affects Firefox < 57,     Firefox ESR < 52.5, and Thunderbird < 52.5.
    (CVE-2017-7830)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - File downloads encoded with blob: and data: URL     elements bypassed normal file download checks though the     Phishing and Malware Protection feature and its block     lists of suspicious sites and files. This would allow     malicious sites to lure users into downloading     executables that would otherwise be detected as     suspicious. This vulnerability affects Firefox < 56,     Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7814)

  - A use-after-free vulnerability can occur in design mode     when image objects are resized if objects referenced     during the resizing have been freed from memory. This     results in a potentially exploitable crash. This     vulnerability affects Firefox < 56, Firefox ESR < 52.4,     and Thunderbird < 52.4. (CVE-2017-7819)

  - The content security policy (CSP) sandbox directive     did not create a unique origin for the document, causing     it to behave as if the allow-same-origin keyword were     always specified. This could allow a Cross-Site     Scripting (XSS) attack to be launched from unsafe     content. This vulnerability affects Firefox < 56,     Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7823)

  - A use-after-free vulnerability can occur when an editor     DOM node is deleted prematurely during tree traversal     while still bound to the document. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.3, Firefox ESR < 52.3, and     Firefox < 55. (CVE-2017-7809)

  - Memory safety bugs were reported in Firefox 54, Firefox     ESR 52.2, and Thunderbird 52.2. Some of these bugs     showed evidence of memory corruption and we presume that     with enough effort that some of these could be exploited     to run arbitrary code. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7779)

  - An out-of-bounds read occurs when applying style rules     to pseudo-elements, such as ::first-line, using cached     style data. This vulnerability affects Thunderbird <     52.3, Firefox ESR < 52.3, and Firefox < 55.
    (CVE-2017-7753)

  - A buffer overflow can occur when manipulating Accessible     Rich Internet Applications (ARIA) attributes within the     DOM. This results in a potentially exploitable crash.
    This vulnerability affects Thunderbird < 52.3, Firefox     ESR < 52.3, and Firefox < 55. (CVE-2017-7785)

  - A buffer overflow can occur when the image renderer     attempts to paint non-displayable SVG elements. This     results in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7786)

  - Same-origin policy protections can be bypassed on pages     with embedded iframes during page reloads, allowing the     iframes to access content on the top level page, leading     to information disclosure. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7787)

  - A buffer overflow will occur when viewing a certificate     in the certificate manager if the certificate has an     extremely long object identifier (OID). This results in     a potentially exploitable crash. This vulnerability     affects Thunderbird < 52.3, Firefox ESR < 52.3, and     Firefox < 55. (CVE-2017-7792)

  - On pages containing an iframe, the data: protocol can     be used to create a modal alert that will render over     arbitrary domains following page navigation, spoofing of     the origin of the modal alert from the iframe content.
    This vulnerability affects Thunderbird < 52.3, Firefox     ESR < 52.3, and Firefox < 55. (CVE-2017-7791)

  - A use-after-free vulnerability can occur in WebSockets     when the object holding the connection is freed before     the disconnection operation is finished. This results in     an exploitable crash. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7800)

  - A use-after-free vulnerability can occur when     manipulating the DOM during the resize event of an image     element. If these elements have been freed due to a lack     of strong references, a potentially exploitable crash     may occur when the freed elements are accessed. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7802)

  - A use-after-free vulnerability can occur while re-     computing layout for a marquee element during window     resizing where the updated style object is freed while     still in use. This results in a potentially exploitable     crash. This vulnerability affects Thunderbird < 52.3,     Firefox ESR < 52.3, and Firefox < 55. (CVE-2017-7801)

  - A mechanism that uses AppCache to hijack a URL in a     domain using fallback by serving the files from a sub-     path on the domain. This has been addressed by requiring     fallback files be inside the manifest directory. This     vulnerability affects Thunderbird < 52.3, Firefox ESR <     52.3, and Firefox < 55. (CVE-2017-7807)

  - When a page's content security policy (CSP) header     contains a sandbox directive, other directives are     ignored. This results in the incorrect enforcement of     CSP. This vulnerability affects Thunderbird < 52.3,     Firefox ESR < 52.3, and Firefox < 55. (CVE-2017-7803)

  - A use-after-free vulnerability can occur when reading an     image observer during frame reconstruction after the     observer has been freed. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox <     55. (CVE-2017-7784)

  - A use-after-free vulnerability can occur when     manipulating arrays of Accessible Rich Internet     Applications (ARIA) elements within containers through     the DOM. This results in a potentially exploitable     crash. This vulnerability affects Firefox < 56, Firefox     ESR < 52.4, and Thunderbird < 52.4. (CVE-2017-7818)

  - A buffer overflow occurs when drawing and validating     elements with the ANGLE graphics library, used for WebGL     content. This is due to an incorrect value being passed     within the library during checks and results in a     potentially exploitable crash. This vulnerability     affects Firefox < 56, Firefox ESR < 52.4, and     Thunderbird < 52.4. (CVE-2017-7824)

  - Memory safety bugs were reported in Firefox 55 and     Firefox ESR 52.3. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 56, Firefox     ESR < 52.4, and Thunderbird < 52.4. (CVE-2017-7810)

  - A use-after-free vulnerability can occur in the Fetch     API when the worker or the associated window are freed     when still in use, resulting in a potentially     exploitable crash. This vulnerability affects Firefox <     56, Firefox ESR < 52.4, and Thunderbird < 52.4.
    (CVE-2017-7793)

  - A use-after-free vulnerability can occur when flushing     and resizing layout because the PressShell object has     been freed while still in use. This results in a     potentially exploitable crash during these operations.
    This vulnerability affects Firefox < 57, Firefox ESR <     52.5, and Thunderbird < 52.5. (CVE-2017-7828)

  - Memory safety bugs were reported in Firefox 56 and     Firefox ESR 52.4. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 57, Firefox     ESR < 52.5, and Thunderbird < 52.5. (CVE-2017-7826)

  - The Resource Timing API incorrectly revealed navigations     in cross-origin iframes. This is a same-origin policy     violation and could allow for data theft of URLs loaded     by users. This vulnerability affects Firefox < 57,     Firefox ESR < 52.5, and Thunderbird < 52.5.
    (CVE-2017-7830)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Versions of Mozilla Firefox prior to 55 are unpatched for the following vulnerabilities :

 - A flaw exists that is triggered as the HTTP Strict-Transport-Security (HSTS) header is ignored when processing a response containing multiple HSTS headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) to bypass HSTS protection and downgrade the HTTP communication.
 - A flaw exists in the 'Key::EncodeAsString()' function in 'dom/indexedDB/Key.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'SelectionManager::SetControlSelectionListener()' and 'SelectionManager::ClearControlSelectionListener()' functions in 'accessible/base/SelectionManager.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'DocAccessible::MoveChild()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'xpcom/threads/MozPromise.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling edit transactions. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists related to the Android UI thread. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CanonicalizeLanguageTag()' function in 'js/src/builtin/Intl.js' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling freezing of dense elements. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Module::instantiate()' function in 'js/src/wasm/WasmModule.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Accessible::RemoveChild()' function in 'accessible/generic/Accessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::build()' and 'IonBuilder::buildInline()' functions in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsContentUtils::ConvertStringFromEncoding()' function in 'dom/base/nsContentUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::JitActivation::getRematerializedFrame()' function in 'js/src/vm/Stack.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsMIMEHeaderParamImpl::DecodeRFC5987Param()' function in 'netwerk/mime/nsMIMEHeaderParamImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsWindow::SetParent()' function in 'widget/windows/nsWindow.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_mac.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to missing thread safety that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NotifyTrackRemoved()' function in 'dom/media/MediaRecorder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'InitGlobalLexicalOperation()' function in 'js/src/vm/Interpreter-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::FinishCompilation()' function in 'js/src/vm/TypeInference.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TypedArrayObjectTemplate::makeTemplateObject()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsFTPDirListingConv::DigestBufferLines()' function in 'netwerk/streamconv/converters/nsFTPDirListingConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TraceSelf()' function in 'dom/bindings/TypedArray.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebSocket::Send()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ExpressionDecompiler::decompilePC()' function in 'js/src/jsopcode.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::addOsrValueTypeBarrier()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists related to response header name interning not having same-origin protections. This may allow a context-dependent attacker to disclose stored header names.
 - A flaw exists in the Developer Tools feature that is triggered as web page source code is not properly validated. This may allow a context-dependent attacker to inject and execute arbitrary XUL code.
 - A use-after-free error exists in the 'WebSocketImpl::Disconnect()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when re-computing the layout for marquee elements during window resizing. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when deleting attached editor DOM nodes. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsImageLoadingContent::Notify()' function in 'dom/base/nsImageLoadingContent.cpp' that is triggered when reading image observers during frame reconstruction. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when resizing image elements. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when manipulation Accessible Rich Internet Applications (ARIA) attributes. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when painting non-displayable SVG elements. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling the layer manager while rendering SVG content. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling cached style data and pseudo-elements. This may allow a context-dependent attacker to potentially disclose sensitive memory contents.
 - A flaw exists in the 'nsDocShell::OnNewURI()' function in 'docshell/base/nsDocShell.cpp' that is triggered when handling pages with embedded iframes during page reloads. With a specially crafted web page, a context-dependent attacker can bypass the same-origin policy.
 - A flaw exists in the AppCache feature related to handling of websites under a subdirectory adding fallback pages. With a specially crafted website, a context-dependent attacker can hijack a domain.
 - A flaw exists in the 'openTabPrompt()' and 'openRemotePrompt()' functions in 'toolkit/components/prompts/src/nsPrompter.js' that is triggered when handling page navigations with data: protocols and modal alerts. This may allow a context-dependent attacker to conduct spoofing attacks.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as WindowsDllDetourPatcher may allocate memory with RWX permissions. This may allow a context-dependent attacker to bypass intended DEP protection and more easily exploit another vulnerability that allows code execution.
 - A flaw exists in the 'AllowOpen()' function in 'security/sandbox/linux/broker/SandboxBroker.cpp'. This may allow a context-dependent attacker to bypass the sandbox restrictions and truncate files on the system.
 - A flaw exists in the elliptic curve point addition algorithm that is triggered when using mixed Jacobian-affine coordinates. This may allow an attacker with the ability to intercept network traffic '(e.g'. MitM, DNS cache poisoning) to interfere with a connection and cause the calculation of an incorrect shared secret.
 - A flaw exists that is triggered when handling frame-ancestors directives containing origins with paths. This may allow a context-dependent attacker to bypass the content security policy (CSP).
 - A sandbox directive. This may result in other directives being ignored and incorrect enforcement of the content security policy (CSP).
 - A flaw exists in the 'ExecuteServiceCommand()' function in 'toolkit/components/maintenanceservice/workmonitor.cpp' that is triggered when handling patch directory paths. Combined with another local vulnerability this may allow an attacker to have the Windows updater delete any file named 'update.log'.
 - A flaw exists in 'toolkit/content/aboutwebrtc/aboutWebrtc.js' that is triggered as certain input to about:webrtc is not properly validated. This may allow an attacker to create a specially crafted request that executes arbitrary script code in a user's browser session within the trust relationship between their browser and the server or inject XUL code.
 - A flaw exists in the 'nsHttpChannelAuthProvider::ConfirmAuth()' function in 'netwerk/protocol/http/nsHttpChannelAuthProvider.cpp' that is triggered when handling long usernames in URLs. This may allow a context-dependent attacker to cause a denial of service.
 - A flaw exists in 'toolkit/crashreporter/client/crashreporter_win.cpp' that is triggered as the Windows crash reporter may read extra memory for certain non-null-terminated registry values. This may allow an attacker to disclose potentially sensitive memory contents.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as the WindowsDllDetourPatcher class destructor may be re-purposed by malicious code. This may allow a context-dependent attacker to bypass memory protections.
 - A flaw exists that is triggered as sandboxed about:srcdoc iframes do not inherit content security policy (CSP) directives. This may allow a context-dependent attacker to bypass the content security policy (CSP).
 - An overflow condition exists in 'security/manager/ssl/nsNSSCertHelper.cpp' that is triggered when viewing certificates with overly long OIDs. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.

Versions of Mozilla Firefox ESR earlier than 52.3 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'Accessible::RemoveChild()' function in 'accessible/generic/Accessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsMIMEHeaderParamImpl::DecodeRFC5987Param()' function in 'netwerk/mime/nsMIMEHeaderParamImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsWindow::SetParent()' function in 'widget/windows/nsWindow.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_mac.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to missing thread safety that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NotifyTrackRemoved()' function in 'dom/media/MediaRecorder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'InitGlobalLexicalOperation()' function in 'js/src/vm/Interpreter-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::FinishCompilation()' function in 'js/src/vm/TypeInference.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TypedArrayObjectTemplate::makeTemplateObject()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsFTPDirListingConv::DigestBufferLines()' function in 'netwerk/streamconv/converters/nsFTPDirListingConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'TraceSelf()' function in 'dom/bindings/TypedArray.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebSocket::Send()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ExpressionDecompiler::decompilePC()' function in 'js/src/jsopcode.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::addOsrValueTypeBarrier()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the Developer Tools feature that is triggered as web page source code is not properly validated. This may allow a context-dependent attacker to inject and execute arbitrary XUL code.
 - A use-after-free error exists in the 'WebSocketImpl::Disconnect()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when re-computing the layout for marquee elements during window resizing. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when deleting attached editor DOM nodes. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsImageLoadingContent::Notify()' function in 'dom/base/nsImageLoadingContent.cpp' that is triggered when reading image observers during frame reconstruction. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when resizing image elements. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when manipulation Accessible Rich Internet Applications (ARIA) attributes. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when painting non-displayable SVG elements. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling cached style data and pseudo-elements. This may allow a context-dependent attacker to potentially disclose sensitive memory contents.
 - A flaw exists in the 'nsDocShell::OnNewURI()' function in 'docshell/base/nsDocShell.cpp' that is triggered when handling pages with embedded iframes during page reloads. With a specially crafted web page, a context-dependent attacker can bypass the same-origin policy.
 - A flaw exists in the AppCache feature related to handling of websites under a subdirectory adding fallback pages. With a specially crafted website, a context-dependent attacker can hijack a domain.
 - A flaw exists in the 'openTabPrompt()' and 'openRemotePrompt()' functions in 'toolkit/components/prompts/src/nsPrompter.js' that is triggered when handling page navigations with data: protocols and modal alerts. This may allow a context-dependent attacker to conduct spoofing attacks.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as WindowsDllDetourPatcher may allocate memory with RWX permissions. This may allow a context-dependent attacker to bypass intended DEP protection and more easily exploit another vulnerability that allows code execution.
 - A sandbox directive. This may result in other directives being ignored and incorrect enforcement of the content security policy (CSP).
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as the WindowsDllDetourPatcher class destructor may be re-purposed by malicious code. This may allow a context-dependent attacker to bypass memory protections.
 - An overflow condition exists in 'security/manager/ssl/nsNSSCertHelper.cpp' that is triggered when viewing certificates with overly long OIDs. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.

ID	名稱	產品	系列	已發布	已更新	嚴重性
127356	NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0116)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	critical
127363	NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0119)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	critical
700182	Mozilla Firefox < 55 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/8/21	2019/3/6	high
700183	Mozilla Firefox ESR < 52.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/8/21	2019/11/6	high

偵測

搜尋 Plugin

critical

critical

high

high