This update upgrades Firefox to version 52.6.0 ESR.

Security Fix(es) :

  - Multiple flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Firefox to crash or, potentially, execute     arbitrary code with the privileges of the user running     Firefox. (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095,     CVE-2018-5096, CVE-2018-5097, CVE-2018-5098,     CVE-2018-5099, CVE-2018-5102, CVE-2018-5103,     CVE-2018-5104, CVE-2018-5117)

  - To mitigate timing-based side-channel attacks similar to     'Spectre' and 'Meltdown', the resolution of     performance.now() has been reduced from 5s to 20s.

This update for MozillaFirefox to version ESR 52.6 fixes several issues. These security issues were fixed :

  - CVE-2018-5091: Use-after-free with DTMF timers     (bsc#1077291).

  - CVE-2018-5095: Integer overflow in Skia library during     edge builder allocation (bsc#1077291).

  - CVE-2018-5096: Use-after-free while editing form     elements (bsc#1077291).

  - CVE-2018-5097: Use-after-free when source document is     manipulated during XSLT (bsc#1077291).

  - CVE-2018-5098: Use-after-free while manipulating form     input elements (bsc#1077291).

  - CVE-2018-5099: Use-after-free with widget listener     (bsc#1077291).

  - CVE-2018-5102: Use-after-free in HTML media elements     (bsc#1077291).

  - CVE-2018-5103: Use-after-free during mouse event     handling (bsc#1077291).

  - CVE-2018-5104: Use-after-free during font face     manipulation (bsc#1077291).

  - CVE-2018-5117: URL spoofing with right-to-left text     aligned left-to-right (bsc#1077291).

  - CVE-2018-5089: Various memory safety bugs (bsc#1077291).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox to version 52.6 several issues. These security issues were fixed :

  - CVE-2018-5091: Use-after-free with DTMF timers     (bsc#1077291).

  - CVE-2018-5095: Integer overflow in Skia library during     edge builder allocation (bsc#1077291).

  - CVE-2018-5096: Use-after-free while editing form     elements (bsc#1077291).

  - CVE-2018-5097: Use-after-free when source document is     manipulated during XSLT (bsc#1077291).

  - CVE-2018-5098: Use-after-free while manipulating form     input elements (bsc#1077291).

  - CVE-2018-5099: Use-after-free with widget listener     (bsc#1077291).

  - CVE-2018-5104: Use-after-free during font face     manipulation (bsc#1077291).

  - CVE-2018-5089: Fixed several memory safety bugs     (bsc#1077291).

  - CVE-2018-5117: URL spoofing with right-to-left text     aligned left-to-right (bsc#1077291).

  - CVE-2018-5102: Use-after-free in HTML media elements     (bsc#1077291).

  - CVE-2018-5103: Use-after-free during mouse event     handling (bsc#1077291).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201802-03 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page, possibly resulting in the execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to perform Man-in-the-Middle attacks,       obtain sensitive information, spoof the address bar, conduct clickjacking       attacks, bypass security restrictions and protection mechanisms, or have       other unspecified impact.
  Workaround :

    There is no known workaround at this time.

远程 OSX 主机上安装的 Mozilla Thunderbird 版本低于 52.6。因而会受到多个漏洞的影响。

远程 Windows 主机上安装的 Mozilla Thunderbird 版本低于 52.6。因而会受到多个漏洞的影响。

thunderbird 的更新现可用于 Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。Mozilla Thunderbird 是独立的邮件和新闻组客户端。此更新将 Thunderbird 升级到版本 52.6.0。安全修复：* 在处理畸形 Web 内容时发现多个缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。(CVE-2018-5089, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117) Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢原始报告者 Christian Holler、Jason Kratzer、Marcia Knous、Nathan Froyd、Oriol Brufau、Ronald Crane、Randell Jesup、Tyson Smith、Cobos Alvarez、Ryan VanderMeulen、Sebastian Hengst、Karl Tomlinson、Xidorn Quan、Ludovic Hirlimann、Jason Orendorff、匿名人士、Nils 和 Xisigr。

已在 Thunderbird 中发现多个安全问题，可导致任意代码执行、拒绝服务或 URL 伪造。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 58。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可遭利用的崩溃。

远程 Windows 主机上安装的 Mozilla Firefox 版本低于 58。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可利用的崩溃。

firefox 更新现可用于 Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7。Red Hat 产品安全团队已将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。Mozilla Firefox 是一款开源网页浏览器。此更新将 Firefox 升级到版本 52.6.0 ESR。安全修复：* 在处理畸形 Web 内容时发现多个缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。(CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117) * 为缓和类似 ‘Spectre’ 和 ‘Meltdown’ 的基于计时的边信道攻击，performance.now() 的分辨率从 5ms 降至 20ms。Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢原始报告者 Christian Holler、Jason Kratzer、Marcia Knous、Nathan Froyd、Oriol Brufau、Ronald Crane、Randell Jesup、Tyson Smith、Cobos Alvarez、Ryan VanderMeulen、Sebastian Hengst、Karl Tomlinson、Xidorn Quan、Ludovic Hirlimann、Jason Orendorff、Looben Yang、Anonymous、Nils、Xisigr。

已在 Mozilla Firefox Web 浏览器中发现数个安全问题：多个内存安全错误、释放后使用和其他实现错误可导致执行任意代码或拒绝服务。针对 Debian 7“Wheezy”，这些问题已在版本 52.6.0esr-1~deb7u1 中修复。建议您升级 firefox-esr 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

Versions of Mozilla Firefox ESR earlier than 52.6 are unpatched for the following vulnerabilities :

 - An integer overflow that is triggered when allocating memory for edge builders. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when the source document for XSL transformation is manipulated by script content during the transformation. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'layout/forms/nsNumberControlFrame.cpp' that is triggered when handling form input elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the widget listener. The issue is triggered when holding strong references to browser objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'dom/html/HTMLMediaElement.cpp' that is triggered when handling specially crafted HTML media elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'EventStateManager::DispatchMouseOrPointerEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouse events. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling font faces. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'browser/base/content/browser.js' that is triggered when right-to-left text is used in the address bar with left-to-right alignment. This may allow a context-dependent attacker to spoof the URL bar.
 - A use-after-free error exists that is triggered when WebRTC connections interact with DTMF timers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when editing events in form elements on a page. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readV1ArrayBuffer()' function in 'js/src/vm/StructuredClone.cpp' that is triggered when deserializing invalid typed arrays. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'MediaEngineDefaultVideoSource::Allocate()' function in 'dom/media/webrtc/MediaEngineDefault.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'toolkit/components/places/History.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCookieService::RemoveCookiesWithOriginAttributes()' function in 'netwerk/cookie/nsCookieService.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the Skia component that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'startupcache/StartupCache.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/media/GraphDriver.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebrtcGmpVideoDecoder::ReleaseGmp()' function in 'media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/base/DirectionalityUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCookieService::PurgeCookies()' function in 'netwerk/cookie/nsCookieService.cpp' that is triggered when handling cookie expiry. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified race condition exists in 'modules/libjar/nsJAR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified race condition exists in 'netwerk/base/AutoClose.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'js/src/vm/StructuredClone.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.

Versions of Mozilla Firefox earlier than 58 are unpatched for the following vulnerabilities :

 - An out-of-bounds read flaw exists in the 'js::WasmTableObject::getImpl()' function. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
 - An overflow condition exists in the 'ShiftFromList()' function in 'js/src/vm/List-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow and potentially execute arbitrary code.
 - A flaw exists in 'gfx/2d/Filters.h' related to missing thread safety. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the JavaScript just-in-time (JIT) compiler that is triggered when handling call stacks. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated when handling TypeScripts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AppendToList()' function in 'js/src/vm/List-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CalcTableChecksum()' function in 'gfx/2d/ScaledFontMac.cpp' that is triggered when handling checksums that are not 4-byte aligned. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'HttpChannelChild::Release()' function in 'netwerk/protocol/http/HttpChannelChild.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebrtcVideoConduit::VideoStreamFactory::CreateEncoderStreams()' function in 'media/webrtc/signaling/src/media-conduit/VideoConduit.cpp' that is triggered as certain input is not properly validated when handling temporal layers for screencasts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaDecoderStateMachine.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ParseFTPList()' function in 'netwerk/streamconv/converters/ParseFTPList.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the accessibility component related to use of uninitialized memory. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists related to use of uninitialized memory when handling cocoa widgets. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the security manager component related to use of uninitialized memory. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An integer overflow that is triggered when allocating memory for edge builders. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when the source document for XSL transformation is manipulated by script content during the transformation. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'layout/forms/nsNumberControlFrame.cpp' that is triggered when handling form input elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the widget listener. The issue is triggered when holding strong references to browser objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsIDocument::IsPotentiallyScrollable()' function in 'dom/base/nsDocument.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsCSSFrameConstructor::CreateLetterFrame()' function in 'layout/base/nsCSSFrameConstructor.cpp' that is triggered when manipulating floating first-letter style elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'dom/html/HTMLMediaElement.cpp' that is triggered when handling specially crafted HTML media elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'EventStateManager::DispatchMouseOrPointerEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouse events. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling font faces. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in WebExtensions that may allow a context-dependent attacker to bypass user prompts and save and execute downloaded files without user confirmation.
 - A flaw exists that is triggered when a user selects error exists links when tools are open. This may allow a context-dependent attacker to cause style editor traffic in the Developer Tools to be routed through a service worker hosted on a third party website, potentially disclosing sensitive cross-origin information.
 - A flaw exists as the printing process creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against a file to cause the program to unexpectedly disclose arbitrary files.
 - A flaw exists in 'dom/file/nsHostObjectProtocolHandler.cpp' that is triggered during the handling of certain manually entered blob URLs. This may allow a context-dependent attacker to gain access to potentially sensitive information from private browsing.
 - A flaw exists in the 'MediaManager::GetUserMedia()' function in 'dom/media/MediaManager.cpp'. This may allow a context-dependent attacker to spoof the origin of audio prompts.
 - A flaw exists that is triggered when cursor visibility is toggled back and forth from 'none' to an image via a script. This may allow a context-dependent attacker to cause the cursor to be rendered invisibly.
 - A flaw exists that is triggered during the handling of a specially formatted URL that is dragged to the address bar from page content. This may allow a context-dependent attacker to spoof the URL bar.
 - A flaw exists in the developement tool panels of an extension that may allow a context-dependent attacker to bypass restrictions and load non-relative URLS, which may potentially include privileged pages.
 - A flaw exists in the 'browser.identity'.'launchWebAuthFlow()' function in WebExtensions that is triggered as HTTPS content loading restrictions are not properly honored. This may allow a context-dependent attacker to load content over an HTTP connection.
 - A flaw exists that is triggered when changing a cookie to HttpOnly when a document is open. This can cause the cookie to remain accessible until the document is closed.
 - A flaw exists that is due to program displaying HTTP authentication prompts from background pages over the currently loaded foreground page. This may allow a context-dependent attacker to potentially spoof the originating page of an authentication prompt.
 - A flaw exists in WebExtensions with the ActiveTab permission that may allow a context-dependent attacker to inject frames from arbitrary origins into the loaded page and gain access to arbitrary frame content.
 - A flaw exists in 'browser/base/content/browser.js' that is triggered when right-to-left text is used in the address bar with left-to-right alignment. This may allow a context-dependent attacker to spoof the URL bar.
 - A flaw exists in the Activity Stream page that is triggered as it may improperly create images via the file: URL. This may allow a context-dependent attacker to gain access to potentially sensitive local information.
 - A flaw exists in the reader view that can allow a context-dependent attacker to bypass CORS header restrictions and view cross-origin content that should be prohibited from loading.
 - A flaw exists in 'browser/themes/osx/browser.css' that is triggered when rendering Tibetan characters in several unspecified fonts. This may allow a context-dependent attacker to spoof a valid domain name.
 - An integer overflow in the 'DoCrypt()' function in 'dom/crypto/WebCryptoTask.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when WebRTC connections interact with DTMF timers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling threads for web workers. This may allowa context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when editing events in form elements on a page. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readV1ArrayBuffer()' function in 'js/src/vm/StructuredClone.cpp' that is triggered when deserializing invalid typed arrays. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCookieService::RemoveCookiesWithOriginAttributes()' function in 'netwerk/cookie/nsCookieService.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebrtcGmpVideoDecoder::ReleaseGmp()' function in 'media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCookieService::PurgeCookies()' function in 'netwerk/cookie/nsCookieService.cpp' that is triggered when handling cookie expiry. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified race condition exists in 'modules/libjar/nsJAR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified race condition exists in 'netwerk/base/AutoClose.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the browser UI that is triggered when handling specially crafted HTML fragments. This may allow a context-dependent attacker to potentially execute arbitrary code.

 - Mutliple vulnerabilities in the following may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code:
 - 'media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp'
 - 'gfx/thebes/gfxPlatformFontList.cpp'
 - 'dom/media/systemservices/CamerasChild.cpp'
 - 'dom/media/MediaDecoder.cpp'
 - 'js/src/gc/Zone.h'
 - 'js/src/jsfun.h'
 - 'dom/plugins/ipc/PluginMessageUtils.cpp'
 - 'ipc/glue/IPCMessageUtils.h'
 - 'dom/media/webrtc/MediaEngineDefault.cpp'
 - 'toolkit/components/places/History.cpp'
 - 'startupcache/StartupCache.cpp'
 - 'dom/media/GraphDriver.cpp'
 - 'media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.h'
 - 'dom/base/DirectionalityUtils.cpp'
 - 'media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp'
 - 'js/src/vm/StructuredClone.cpp'

ID	名稱	產品	系列	已發布	已更新	嚴重性
106337	Scientific Linux Security Update : firefox on SL6.x, SL7.x i386/x86_64 (20180124)	Nessus	Scientific Linux Local Security Checks	2018/1/25	2025/10/31	critical
106617	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2018:0361-1)	Nessus	SuSE Local Security Checks	2018/2/6	2025/10/30	critical
106654	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:0374-1)	Nessus	SuSE Local Security Checks	2018/2/7	2025/10/30	critical
106884	GLSA-201802-03 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/2/20	2025/10/29	critical
108518	Mozilla Thunderbird < 52.6 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2018/3/21	2019/11/8	critical
108519	Mozilla Thunderbird < 52.6 多个漏洞	Nessus	Windows	2018/3/21	2019/11/8	critical
106567	CentOS 6 / 7 : thunderbird (CESA-2018:0262)	Nessus	CentOS Local Security Checks	2018/2/2	2025/10/30	critical
106509	Debian DSA-4102-1：thunderbird - 安全更新	Nessus	Debian Local Security Checks	2018/1/31	2025/10/30	critical
106301	Mozilla Firefox < 58 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2018/1/24	2025/10/31	critical
106303	Mozilla Firefox < 58 多个漏洞	Nessus	Windows	2018/1/24	2025/10/31	critical
106317	CentOS 6 / 7 : firefox (CESA-2018:0122)	Nessus	CentOS Local Security Checks	2018/1/25	2025/10/31	critical
106318	Debian DLA-1256-1：firefox-esr 安全更新	Nessus	Debian Local Security Checks	2018/1/25	2025/10/31	critical
700334	Mozilla Firefox ESR < 52.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/11/6	high
700326	Mozilla Firefox < 58 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical