远程 Windows 主机上安装的 Mozilla Thunderbird 版本低于 52.5。因而会受到多个漏洞的影响。

已在 Mozilla Thunderbird 邮件客户端中发现多个安全问题：多个内存安全错误、释放后使用和其他实现错误可能导致崩溃或执行任意代码。对于 Debian 7“Wheezy”，这些问题已在 1:52.5.0-1~deb7u1 版本中修复。我们建议您升级 thunderbird 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

运行版本 MAIN 5.04 的远程 NewStart CGSL 主机安装有受多个漏洞影响的 firefox 程序包：- 在 Firefox. 中发现隐私缺陷。在私人浏览模式下，工作线程可将持久性数据写入 IndexedDB，该数据在退出时不会被清除，并且会在多个会话间持久保存。恶意网站可利用此缺陷绕过隐私浏览保护和唯一指纹访客。(CVE-2017-7843) - 刷新和调整布局大小时出现释放后使用漏洞，原因在于 PressShell 对象在仍然使用时已经释放。这会导致在此类操作中造成潜在可利用的崩溃。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7828) - Firefox 56 和 Firefox ESR 52.4 中已报告内存安全错误。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7826) - Resource Timing API 错误显示了跨源 iframe 中的导航。这是同源策略违规，可能导致用户加载的 URL 数据遭窃。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7830) 请注意，Nessus 并未针对此问题进行测试，而仅依赖应用程序自我报告的版本号。

thunderbird 的更新现可用于 Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。Mozilla Thunderbird 是独立的邮件和新闻组客户端。此更新将 Thunderbird 升级到版本 52.5.0。安全修复：* 在处理畸形 Web 内容时发现多个缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。（CVE-2017-7826、CVE-2017-7828、CVE-2017-7830）Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢原始报告者 Christian Holler、David Keeler、Jon Coppeard、Julien Cristau、Jan de Mooij、Jason Kratzer、Philipp、Nicholas Nethercote、Oriol Brufau、Andre Bargull、Bob Clary、Jet Villegas、Randell Jesup、Tyson Smith、Gary Kwong、Ryan VanderMeulen、Nils 和 Jun Kokatsu。

執行 MAIN 4.05 版的遠端 NewStart CGSL 主機安裝了受多個弱點影響的 firefox 套件：- 即使有釣魚和惡意軟體保護功能及其可疑網站和檔案封鎖清單，以 blob: 和 data: URL 元素編碼的檔案下載仍然繞過了正常的檔案下載檢查。這會讓惡意網站誘騙使用者下載原本會偵測出疑點的可執行檔。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7814) - 在設計模式下，若調整影像物件的大小，而這些影像物件是參照已被釋放的記憶體，則會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7819) - 內容安全性原則 (CSP) 沙箱指示詞未建立文件專用的原點，以致於它造成看似一律指定 allow-same-origin 關鍵字的行為。這樣會讓攻擊者得以利用不安全的內容發動跨網站指令碼 (XSS) 攻擊。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7823) - 若在樹狀遊走仍然繫結文件時過早刪除編輯器的 DOM 節點，會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7809) - 已通報 Firefox 54、Firefox ESR 52.2 和 Thunderbird 52.2 中存在的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7779) - 使用經過快取的樣式資料將樣式規則套用於虛擬元素 (如 ::first-line) 時，會出現越界讀取情形。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7753) - 在 DOM 內操控 Accessible Rich Internet Applications (ARIA) 屬性時會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7785) - 當影像轉譯器嘗試描繪無法顯示的 SVG 元素時，會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7786) - 重新載入頁面時，可能利用內嵌 iframe 在頁面上繞過同源原則保護機制，讓 iframe 得以存取頂層頁面的內容，造成資訊洩漏。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7787) - 若憑證的物件識別元 (OID) 長度極長，則在憑證管理員中檢視憑證時，會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7792) - 在含 iframe 的頁面上，使用 data: protocol 可建立強制回應警示，該警示會在頁面瀏覽之後轉譯為任意網域，偽造 iframe 內容的強制回應警示來源。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7791) - 若保留連線的物件在中斷連線作業完成之前被釋放，WebSockets 可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7800) - 由於網頁原始碼的不當清理，「開發人員工具」功能容易受 XUL 插入弱點的影響。在最嚴重的情況下，可能會在使用樣式編輯器工具開啟惡意頁面時允許任意程式碼執行。此弱點會影響 Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7798) - 操控 DOM 時若調整影像元素的大小，可能會產生釋放後使用弱點。若這些元素因缺乏強參照而已被釋放，當存取被釋放的元素時會發生可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7802) - 若因調整視窗大小而重新計算跑馬燈元素的版面配置時，更新過後的樣式物件在仍然使用中的狀態下被釋放，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7801) - 一種在網域中使用 AppCache 劫持 URL 的機制，該網域從網域的子路徑提供檔案作為 fallback。已藉由要求 fallback 檔案需在 manifest 目錄中，使此弱點得到解決。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7807) - 若頁面的內容安全性原則 (CSP) 標頭內含沙箱指示詞，則會略過其他指示詞。這樣會錯誤地強制執行 CSP。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7803) - 重建框架時，若在 observer 被釋放之後才讀取影像 observer，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7784) - 透過 DOM 在容器內操控 Accessible Rich Internet Applications (ARIA) 元素的陣列時，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7818) - 以用於 WebGL 內容的 ANGLE 圖形程式庫繪製及驗證元素時，會發生緩衝區溢位情形。這是因為在檢查時將錯誤的值傳送到程式庫內，會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7824) - 已通報 Firefox 55 和 Firefox ESR 52.3 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7810) - 背景工作或相關聯視窗在仍然使用中被釋放時，Fetch API 會產生釋放後使用弱點，造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7793) - 在 Firefox 中發現一個隱私缺陷。在「私密瀏覽」模式中，Web 背景工作可將持續資料寫入 IndexedDB，而結束時資料卻未清理，因此可能保留在多個工作階段中。惡意網站可利用缺陷來繞過隱私瀏覽保護以及唯一指紋訪客。(CVE-2017-7843) - 由於 PressShell 物件在仍然使用中遭到釋放，因此可能在清空和調整版面配置大小時發生釋放後使用弱點。這樣會在上述作業期間造成可能遭惡意利用的當機。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7828) - 已通報 Firefox 56 和 Firefox ESR 52.4 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7826) - Resource Timing API 錯誤地洩漏跨來源 iframe 的導覽。這是同源原則違規，可能導致使用者載入的 URL 資料遭竊。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7830) 請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

執行 MAIN 4.05 版的遠端 NewStart CGSL 主機安裝了受多個弱點影響的 thunderbird 套件：- 即使有釣魚和惡意軟體保護功能及其可疑網站和檔案封鎖清單，以 blob: 和 data: URL 元素編碼的檔案下載仍然繞過了正常的檔案下載檢查。這會讓惡意網站誘騙使用者下載原本會偵測出疑點的可執行檔。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7814) - 在設計模式下，若調整影像物件的大小，而這些影像物件是參照已被釋放的記憶體，則會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7819) - 內容安全性原則 (CSP) 沙箱指示詞未建立文件專用的原點，以致於它造成看似一律指定 allow-same-origin 關鍵字的行為。這樣會讓攻擊者得以利用不安全的內容發動跨網站指令碼 (XSS) 攻擊。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7823) - 若在樹狀遊走仍然繫結文件時過早刪除編輯器的 DOM 節點，會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7809) - 已通報 Firefox 54、Firefox ESR 52.2 和 Thunderbird 52.2 中存在的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7779) - 使用經過快取的樣式資料將樣式規則套用於虛擬元素 (如 ::first-line) 時，會出現越界讀取情形。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7753) - 在 DOM 內操控 Accessible Rich Internet Applications (ARIA) 屬性時會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7785) - 當影像轉譯器嘗試描繪無法顯示的 SVG 元素時，會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7786) - 重新載入頁面時，可能利用內嵌 iframe 在頁面上繞過同源原則保護機制，讓 iframe 得以存取頂層頁面的內容，造成資訊洩漏。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7787) - 若憑證的物件識別元 (OID) 長度極長，則在憑證管理員中檢視憑證時，會發生緩衝區溢位情形。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7792) - 在含 iframe 的頁面上，使用 data: protocol 可建立強制回應警示，該警示會在頁面瀏覽之後轉譯為任意網域，偽造 iframe 內容的強制回應警示來源。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7791) - 若保留連線的物件在中斷連線作業完成之前被釋放，WebSockets 可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7800) - 操控 DOM 時若調整影像元素的大小，可能會產生釋放後使用弱點。若這些元素因缺乏強參照而已被釋放，當存取被釋放的元素時會發生可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7802) - 若因調整視窗大小而重新計算跑馬燈元素的版面配置時，更新過後的樣式物件在仍然使用中的狀態下被釋放，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7801) - 一種在網域中使用 AppCache 劫持 URL 的機制，該網域從網域的子路徑提供檔案作為 fallback。已藉由要求 fallback 檔案需在 manifest 目錄中，使此弱點得到解決。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7807) - 若頁面的內容安全性原則 (CSP) 標頭內含沙箱指示詞，則會略過其他指示詞。這樣會錯誤地強制執行 CSP。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7803) - 重建框架時，若在 observer 被釋放之後才讀取影像 observer，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7784) - 透過 DOM 在容器內操控 Accessible Rich Internet Applications (ARIA) 元素的陣列時，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7818) - 以用於 WebGL 內容的 ANGLE 圖形程式庫繪製及驗證元素時，會發生緩衝區溢位情形。這是因為在檢查時將錯誤的值傳送到程式庫內，會造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7824) - 已通報 Firefox 55 和 Firefox ESR 52.3 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7810) - 背景工作或相關聯視窗在仍然使用中被釋放時，Fetch API 會產生釋放後使用弱點，造成可能遭惡意利用的當機。此弱點會影響 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7793) - 由於 PressShell 物件在仍然使用中遭到釋放，因此可能在清空和調整版面配置大小時發生釋放後使用弱點。這樣會在上述作業期間造成可能遭惡意利用的當機。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7828) - 已通報 Firefox 56 和 Firefox ESR 52.4 中的記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7826) - Resource Timing API 錯誤地洩漏跨來源 iframe 的導覽。這是同源原則違規，可能導致使用者載入的 URL 資料遭竊。此弱點會影響 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7830) 請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

在 Mozilla Firefox 網頁瀏覽器中發現數個安全性問題：多個記憶體安全錯誤、釋放後使用和其他實作錯誤可能會導致執行任意程式碼、拒絕服務或繞過同源原則。

遠端 macOS 或 Mac OS X 主機上安裝的 Mozilla Firefox ESR 版本比 52.5 舊。因此受到多個弱點影響，其中有些允許程式碼執行並可能遭惡意利用而當機。

遠端 macOS 或 Mac OS X 主機上安裝的 Mozilla Firefox 版本比 57 版舊。因此受到多個弱點影響，其中有些允許程式碼執行並可能遭惡意利用而使應用程式損毀。

來自 Red Hat 安全公告 2017:3247： 現已提供適用於 Red Hat Enterprise Linux 6 與 Red Hat Enterprise Linux 7 的 firefox 更新。 Red Hat 產品安全性團隊已將此更新評等為具有重大安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。 Mozilla Firefox 是開放原始碼的網頁瀏覽器。 此更新將 Firefox 升級至 52.5.0 ESR 版。 安全性修正： * 在處理格式錯誤的 Web 內容過程中發現多個瑕疵。包含惡意內容的網頁可造成 Firefox 損毀，或可能利用執行 Firefox 之使用者的權限來執行任意程式碼。(CVE-2017-7826, CVE-2017-7828, CVE-2017-7830) Red Hat 感謝 Mozilla 專案報告這些問題。上游確認 Christian Holler、David Keeler、Jon Coppeard、Julien Cristau、Jan de Mooij、Jason Kratzer、Philipp、Nicholas Nethercote、Oriol Brufau、Andre Bargull、Bob Clary、Jet Villegas、Randell Jesup、Tyson Smith、Gary Kwong、Ryan VanderMeulen、Nils 和 Jun Kokatsu 為原始報告者。

現已提供適用於 Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7 的 thunderbird 更新。Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。Mozilla Thunderbird 是獨立式郵件與新聞群組用戶端。此更新會將 Thunderbird 升級至 52.5.0 版。安全性修正：* 在處理格式錯誤的 Web 內容過程中發現多個缺陷。包含惡意內容的網頁可導致 Thunderbird 損毀，或可能利用執行 Thunderbird 之使用者的權限來執行任意程式碼。(CVE-2017-7826、CVE-2017-7828、CVE-2017-7830) Red Hat 感謝 Mozilla 專案報告這些問題。上游確認 Christian Holler、David Keeler、Jon Coppeard、Julien Cristau、Jan de Mooij、Jason Kratzer、Philipp、Nicholas Nethercote、Oriol Brufau、Andre Bargull、Bob Clary、Jet Villegas、Randell Jesup、Tyson Smith、Gary Kwong、Ryan VanderMeulen、Nils 和 Jun Kokatsu 為原始報告者。

遠端主機受到 GLSA-201803-14 中所述的弱點影響 (Mozilla Thunderbird：多個弱點) 在 Mozilla Thunderbird 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 Mozilla 基礎安全性公告和 CVE 識別碼。影響：遠端攻擊者可能能夠執行任意程式碼、造成拒絕服務情形、取得敏感資訊、進行 URL 劫持或發動跨網站指令碼 (XSS) 攻擊。因應措施：目前尚無已知的因應措施。

Versions of Mozilla Firefox ESR earlier than 52.5 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'NewReactionRecord()' function in 'js/src/builtin/Promise.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'VerifyCMSDetachedSignatureIncludingCertificate()' function in 'security/manager/ssl/nsDataSignatureVerifier.cpp' that is triggered when handling PKCS#7 signedData content. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ContainerLayerComposite::mPrepared()' function in 'gfx/layers/composite/ContainerLayerComposite.cpp' that is triggered when handling layers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MArgumentsLength::computeRange()' function in 'js/src/jit/RangeAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'widget/windows/AudioSession.cpp' that is triggered when handling AudioSession objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when handling WebGL texture images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocShell::~nsDocShell()' function in 'docshell/base/nsDocShell.cpp' that is triggered when notifying observers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'CleanupOSFileConstants()' function in 'dom/system/OSFileConstants.cpp' related to use of uninitialized memory. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ApplicationReputationService::~ApplicationReputationService()' function in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered as certain pointers are not properly cleared. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EnumerableOwnProperties()' function in 'js/src/builtin/Object.cpp' that is triggered when rooting objects. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'CompositorBridgeChild::RecvDidComposite()' function in 'gfx/layers/ipc/CompositorBridgeChild.cpp' that is triggered when handling texture pools. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsViewManager::~nsViewManager()' function in 'view/nsViewManager.cpp' that is triggered as the PresShell object is not properly handled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TLSFilterTransaction::Close()' function in 'netwerk/protocol/http/TunnelUtils.cpp' that is triggered as timers are not properly handled when a transaction is canceled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EventStateManager::DispatchCrossProcessEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling drag events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling properties of adopted nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'PropertyReadNeedsTypeBarrier()' function in 'jit/MIR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A logic flaw exists in the 'IsMarkedBlack()' function in 'js/src/gc/Barrier.cpp' that is triggered during gray marking asserts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that triggered when flushing and resizing the layout, which may cause the PressShell object to be freed while still in use. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as navigations in cross-origin iframes are revealed. Using the Resource Timing API, a context-dependent attacker to gain access to cross-origin URL information.

Versions of Mozilla Firefox earlier than 57 are unpatched for the following vulnerabilities :

 - A race condition exists in 'dom/media/systemservices/MediaParent.cpp' that is triggered when getting deviceId keys. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/proxy/DeadObjectProxy.cpp' that is triggered when handling object proxies. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'xpcom/threads/SystemGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'nr_transport_addr_fmt_ifname_addr_string()' function in 'media/mtransport/third_party/nICEr/src/net/transport_addr.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a stack-based buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GPUProcessHost::OnChannelClosed()' function in 'gfx/ipc/GPUProcessHost.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'gfx/layers/AtomicRefCountedWithFinalize.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NewReactionRecord()' function in 'js/src/builtin/Promise.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'VerifyCMSDetachedSignatureIncludingCertificate()' function in 'security/manager/ssl/nsDataSignatureVerifier.cpp' that is triggered when handling PKCS#7 signedData content. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ContainerLayerComposite::mPrepared()' function in 'gfx/layers/composite/ContainerLayerComposite.cpp' that is triggered when handling layers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MArgumentsLength::computeRange()' function in 'js/src/jit/RangeAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'widget/windows/AudioSession.cpp' that is triggered when handling AudioSession objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when handling WebGL texture images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocShell::~nsDocShell()' function in 'docshell/base/nsDocShell.cpp' that is triggered when notifying observers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'CleanupOSFileConstants()' function in 'dom/system/OSFileConstants.cpp' related to use of uninitialized memory. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ApplicationReputationService::~ApplicationReputationService()' function in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered as certain pointers are not properly cleared. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EnumerableOwnProperties()' function in 'js/src/builtin/Object.cpp' that is triggered when rooting objects. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'CompositorBridgeChild::RecvDidComposite()' function in 'gfx/layers/ipc/CompositorBridgeChild.cpp' that is triggered when handling texture pools. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsViewManager::~nsViewManager()' function in 'view/nsViewManager.cpp' that is triggered as the PresShell object is not properly handled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TLSFilterTransaction::Close()' function in 'netwerk/protocol/http/TunnelUtils.cpp' that is triggered as timers are not properly handled when a transaction is canceled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EventStateManager::DispatchCrossProcessEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling drag events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling properties of adopted nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'PropertyReadNeedsTypeBarrier()' function in 'jit/MIR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A logic flaw exists in the 'IsMarkedBlack()' function in 'js/src/gc/Barrier.cpp' that is triggered during gray marking asserts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that triggered when flushing and resizing the layout, which may cause the PressShell object to be freed while still in use. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as navigations in cross-origin iframes are revealed. Using the Resource Timing API, a context-dependent attacker to gain access to cross-origin URL information.
 - A flaw exists that is triggered as the security wrapper fails to deny access to certain exposed properties using the deprecated exposedProps mechanism on proxy objects. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of the combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave. This combinations do not display properly in punycode. With a specially crafted domain including a dotless version of  'i', a context-dependent attacker can spoof a domain.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of Arabic and Indic vowel marker characters that are combined with Latin characters in a domain name, which can cause the non-latin characters to be eclipsed in the address bar. This may allow a context-dependent attacker to spoof a domain.
 - A flaw exists that is triggered as data: URLs loaded into new tabs do not properly inherit the Content Security Policy (CSP) of the original page. This may allow a context-dependent attacker to bypass protection mechanisms.
 - A flaw exists in the 'nsMixedContentBlocker::AsyncOnChannelRedirect()' function in 'dom/security/nsMixedContentBlocker.cpp' that is triggered as mixed content blocking was not properly applied to resources when being redirected from an HTTPS environment to an HTTP environment. This may allow a context-dependent attacker to bypass restricts and load blocked content on pages.
 - A flaw exists in the 'CurlWrapper::Init()' function in 'toolkit/components/telemetry/pingsender/pingsender_unix_common.cpp' that is triggered as it fails to validate the libcurl library before loading it. This may allow a local attacker to replace libcurl files and gain elevated privileges.
 - A flaw exists in the 'nsContentSink::ProcessMETATag()' function in 'dom/base/nsContentSink.cpp' that is triggered during the handling of <meta> tags in SVG passed via <img> tags. This may allow a context-dependent attacker to set cookies for a page.
 - A flaw exists in 'netwerk/dns/nsIDNService.cpp' that is triggered as Punycode format text is not properly displayed in international domain names when triggered by a sub-domain. This may allow a context-dependent attacker to conduct a limited spoofing attack.
 - A flaw exists in the 'stripUnsafeProtocolOnPaste()' function in 'base/content/browser.js' that is triggered during the handling of control characters before javascript: URLs. This may allow a context-dependent attacker to bypass self-XSS protection mechanisms.
 - A flaw exists in the '_writeItem()' function in 'toolkit/components/places/BookmarkHTMLUtils.jsm' that allows a cross-site scripting (self-XSS) attack. This flaw exists exists because the program does not validate input to exported bookmarks before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in their own browser.
 - A flaw exists that is triggered as the referrer policy is not always honored when handling <link> elements. This may allow a context-dependent attacker to bypass the referrer policy.
 - A flaw exists in the 'PerDocumentStyleDataImpl::visited_styles_enabled()' function in 'servo/components/style/gecko/data.rs'. The issue is triggered when handling the CSS ':visited' selector for a document being used as an SVG image. With a specially crafted web page, a context-dependent attacker disclose visited history information.
 - A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode.
 - An overflow condition exists that is triggered as certain input is not properly validated when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during conditional branches handling out-of-bounds checks. Using a vulnerable code pattern, or a JIT engine or interpreter to generate such a pattern, an attacker can perform a Flush+Reload or Evict+Reload side-channel attack on the cache and disclose parts of the privileged kernel memory.
 - A flaw exists in the fundamental design related to out-of-order process execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached before exceptions are raised for restricted memory access. Using transient instructions in combination with a Flush+Reload side-channel attack a local attacker can disclose parts of the privileged kernel memory.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.

ID	名稱	產品	系列	已發布	已更新	嚴重性
105044	Mozilla Thunderbird < 52.5 多个漏洞	Nessus	Windows	2017/12/6	2019/11/12	critical
105115	Debian DLA-1199-1：thunderbird 安全更新	Nessus	Debian Local Security Checks	2017/12/11	2021/1/11	critical
127141	NewStart CGSL MAIN 5.04：firefox 多个漏洞 (NS-SA-2019-0001)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/8	critical
105058	CentOS 6 / 7 : thunderbird (CESA-2017:3372)	Nessus	CentOS Local Security Checks	2017/12/7	2021/1/4	critical
127356	NewStart CGSL MAIN 4.05：firefox 多個弱點 (NS-SA-2019-0116)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	critical
127363	NewStart CGSL MAIN 4.05：thunderbird 多個弱點 (NS-SA-2019-0119)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	critical
104587	Debian DSA-4035-1：firefox-esr - 安全性更新	Nessus	Debian Local Security Checks	2017/11/16	2021/1/4	critical
104635	Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2019/11/12	critical
104636	Mozilla Firefox < 57 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2019/11/12	critical
104698	Oracle Linux 6 / 7 : firefox (ELSA-2017-3247)	Nessus	Oracle Linux Local Security Checks	2017/11/20	2024/10/23	critical
104988	RHEL 6/7：thunderbird (RHSA-2017:3372)	Nessus	Red Hat Local Security Checks	2017/12/4	2024/11/5	critical
108820	GLSA-201803-14：Mozilla Thunderbird：多個弱點	Nessus	Gentoo Local Security Checks	2018/4/4	2024/11/21	critical
700332	Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/11/6	high
700322	Mozilla Firefox < 57 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical