此更新包含 Mozilla Thunderbird 45.2。(boo#983549)

它修复了多个安全问题，这些问题大多影响在浏览器上下文中使用的电子邮件程序，例如查看网页或 HTMl 格式的电子邮件。

修复了以下漏洞：

- CVE-2016-2818、CVE-2016-2815：内存安全缺陷（boo#983549、MFSA2016-49）

包含来自 45.1 版本的以下安全补丁：
(boo#977333)

- CVE-2016-2806、CVE-2016-2807：其他内存安全危害（boo#977375、boo#977376、MFSA 2016-39）

包含来自 45.0 版本的以下安全补丁：
(boo#969894)

- CVE-2016-1952、CVE-2016-1953：其他内存安全危害 (MFSA 2016-16)

- CVE-2016-1954：通过 CSP 报告发生的本地文件覆盖和潜在的权限升级 (MFSA 2016-17)

- CVE-2016-1955：CSP 报告无法剥离嵌入 iframe 页面的位置信息 (MFSA 2016-18)

- CVE-2016-1956：Linux 视频内存因 Intel 驱动程序而发生 DOS (MFSA 2016-19)

- CVE-2016-1957：在处理 MP4 期间删除数组时，libstagefright 中发生内存泄漏 (MFSA 2016-20)

- CVE-2016-1960：HTML5 字符串解析器中的释放后使用 (MFSA 2016-23)

- CVE-2016-1961：SetBody 中的释放后使用 (MFSA 2016-24)

- CVE-2016-1964：XML 转换期间存在释放后使用 (MFSA 2016-27)

- CVE-2016-1974：分配失败后的 HTML 解析器中存在越界读取 (MFSA 2016-34)

graphite 字型库已停用，解决了以下字体漏洞：

- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

包括以下跟踪程序包变更：

- 修复 Leap 42.2 中使用的 gcc/binutils 组合的版本问题 (boo#984637)

- gcc6 补丁 (boo#986162)

- 在 48 位 va aarch64 上运行 (boo#984126)

已在 Icedove（Debian 版本的 Mozilla Thunderbird 邮件客户端）中发现多种安全问题：多种内存安全错误可能导致任意代码执行或拒绝服务。

Christian Holler、Gary Kwong、Jesse Ruderman、Tyson Smith、Timothy Nikkel、Sylvestre Ledru、Julian Seward、Olli Pettay、Karl Tomlinson、Christoph Diehl、Julian Hector、Jan de Mooij、Mats Palmgren 和 Tooru Fujisawa 在 Firefox 中发现多个内存安全问题。如果用户受到诱骗打开特制的网站，攻击者可能利用这些漏洞，通过应用程序崩溃造成拒绝服务或执行任意代码。（CVE-2016-2815、CVE-2016-2818）

在某些情况下解析 HTML5 拆分时，发现一个缓冲区溢出问题。如果用户受到诱骗打开特制的网站，攻击者可能利用此漏洞，通过应用程序崩溃造成拒绝服务或是执行任意代码。
(CVE-2016-2819)

在某些情况下使用可编辑内容模式时，发现一个释放后使用问题。如果用户受到诱骗打开特制的网站，攻击者可能利用此漏洞，通过应用程序崩溃造成拒绝服务或是执行任意代码。
(CVE-2016-2821)

Jordi Chancel 发现一种可在 <select> 元素中使用永久菜单并置于任意位置的方法。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此问题伪造地址栏内容。
(CVE-2016-2822)

Armin Razmdjou 发现，创建无效的 data: URI 后，location.host 属性可设置为任意字符串。如果用户受到诱骗打开特别构建的的网站，攻击者可能利用此问题绕过某些同源保护。
(CVE-2016-2825)

在某些情况下处理 WebGL 内容时，发现一个释放后使用问题。如果用户受到诱骗打开特制的网站，攻击者可能利用此漏洞，通过应用程序崩溃造成拒绝服务或是执行任意代码。
(CVE-2016-2828)

Tim McCormack 发现，页面快速连续请求多个权限时，权限通知可显示错误的图标。攻击者可能利用此问题，诱骗用户同意访问错误的资源。
(CVE-2016-2829)

已发现在某些情况下，无须用户同意即可在全屏窗口中创建指针锁定，而且必须退出 Firefox 才能取消此指针锁定。如果用户受到诱骗打开特别构建的网站，攻击者可能利用此问题，造成拒绝服务或发动点击劫持攻击。(CVE-2016-2831)

John Schoenick 发现，CSS 伪类可泄漏关于已安装但已禁用的插件的信息。攻击者可能利用此问题来识别用户。(CVE-2016-2832)

Matt Wobensmith 发现，在策略指定的情况下，内容安全策略 (CSP) 未阻断跨域 Java 小程序的加载。攻击者可能利用此问题，绕过 CSP 保护并发动跨站脚本 (XSS) 攻击。
(CVE-2016-2833)

此外，在 NSS 中发现多个不明安全问题。(CVE-2016-2834)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

Versions of Mozilla Firefox earlier than 45.2 are unpatched for the following vulnerabilities :

 - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-2815, CVE-2016-2818)
 - An overflow condition exists that is triggered when handling HTML5 fragments in foreign contexts (e.g., under <svg> nodes).  An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-2819)
 - A use-after-free error exists that is triggered when deleting DOM table elements in 'contenteditable' mode.  An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2821)
 - A spoofing vulnerability exists due to improper handling of SELECT elements.  An unauthenticated, remote attacker can exploit this to spoof the contents of the address bar. (CVE-2016-2822)
 - An out-of-bounds write flaw in 'TSymbolTableLevel' is triggered when size values for array writes are not properly checked during WebGL shader operations. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-2824)
 - A flaw exists in the Windows updater utility's 'toolkit/mozapps/update/updater/updater.cpp' extraction of files from MAR archives.  These files are not properly locked for writing, which may allow a local attacker to replace these files and potentially leverage them to gain elevated privileges. (CVE-2016-2826)
 - A use-after-free error exists that is triggered when destroying the recycle pool of a texture used during the processing of WebGL content.  An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2828)
 - A flaw exists that is triggered when handling paired fullscreen and pointerlock requests in combination with closing windows.  An unauthenticated, remote attacker can exploit this to create an unauthorized pointerlock, resulting in a denial of service condition.  Additionally, an attacker can exploit this to conduct spoofing and clickjacking attacks. (CVE-2016-2831)

Versions of Mozilla Firefox earlier than 47.0 are unpatched for the following vulnerabilities :

 - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-2815, CVE-2016-2818)
 - An overflow condition exists that is triggered when handling HTML5 fragments in foreign contexts (e.g., under <svg> nodes).  An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-2819)
 - A use-after-free error exists that is triggered when deleting DOM table elements in 'contenteditable' mode.  An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2821)
 - A spoofing vulnerability exists due to improper handling of SELECT elements.  An unauthenticated, remote attacker can exploit this to spoof the contents of the address bar. (CVE-2016-2822)
 - A same-origin bypass vulnerability exists that is triggered when handling 'location.host' property values set after the creation of invalid 'data:' URIs.  An unauthenticated, remote attacker can exploit this to partially bypass same-origin policy protections. (CVE-2016-2825)
 - A use-after-free error exists that is triggered when destroying the recycle pool of a texture used during the processing of WebGL content.  An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-2828)
 - A flaw exists in 'browser/modules/webrtcUI.jsm' that is triggered when handling a large number of permission requests over a small period of time.  An unauthenticated, remote attacker can exploit this to cause the incorrect icon to be displayed in a given permission request, potentially resulting in a user approving unintended permission requests. (CVE-2016-2829)
 - A flaw exists that is triggered when handling paired fullscreen and pointerlock requests in combination with closing windows.  An unauthenticated, remote attacker can exploit this to create an unauthorized pointerlock, resulting in a denial of service condition.  Additionally, an attacker can exploit this to conduct spoofing and clickjacking attacks. (CVE-2016-2831)
 - An information disclosure vulnerability exists that is triggered when handling CSS pseudo-classes.  An unauthenticated, remote attacker can exploit this disclose a list of installed plugins. (CVE-2016-2832)
 - A Content Security Policy (CSP) bypass exists that is triggered when handling specially crafted cross-domain Java applets.  An unauthenticated, remote attacker can exploit this to bypass the CSP and conduct cross-site scripting attacks. (CVE-2016-2833)
 - Multiple unspecified flaws exist in the Mozilla Network Security Services (NSS) component that allow an attacker to have an unspecified impact. (CVE-2016-2834)

ID	名稱	產品	系列	已發布	已更新	嚴重性
91985	openSUSE 安全更新：Mozilla Thunderbird (openSUSE-2016-848)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	high
91986	openSUSE 安全更新：Mozilla Thunderbird (openSUSE-2016-851)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	high
92957	Debian DSA-3647-1：icedove - 安全更新	Nessus	Debian Local Security Checks	2016/8/15	2021/1/11	high
91557	Ubuntu 14.04 LTS / 16.04 LTS：Firefox 漏洞 (USN-2993-1)	Nessus	Ubuntu Local Security Checks	2016/6/10	2024/8/27	high
9382	Mozilla Firefox ESR < 45.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/6/24	2019/11/6	high
9383	Mozilla Firefox < 47.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/6/24	2019/3/6	high

偵測

搜尋 Plugin

high

high

high

high

high

high