遠端 Windows 主機上安裝的 Mozilla Firefox ESR 版本比 52.8 舊。因此受到多個關鍵弱點和高嚴重性弱點的影響。

遠端 Windows 主機上安裝的 Mozilla Firefox 版本比 60 舊。因此受到多個關鍵弱點和高嚴重性弱點的影響。

現已提供適用於 Red Hat Enterprise Linux 6 的 firefox 更新。Red Hat 產品安全性團隊已將此更新評等為具有重大安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。Mozilla Firefox 是一個開放原始碼網頁瀏覽器，專為標準合規性、效能和可攜性而設計。此更新將 Firefox 升級至 52.8.0 ESR 版。安全性修正：* Mozilla：在 Firefox 60 和 Firefox ESR 52.8 已修正記憶體安全性錯誤 (CVE-2018-5150) * Mozilla：Skia 中的反向移植重要安全性修正 (CVE-2018-5183) * Mozilla：SVG 動畫和影片路徑發生釋放後使用 (CVE-2018-5154) * Mozilla：SVG 動畫和文字路徑發生釋放後使用 (CVE-2018-5155) * Mozilla：PDF 檢視器的同源繞過，可檢視受保護的 PDF 檔案 (CVE-2018-5157) * Mozilla：惡意 PDF 可將 JavaScript 注入 PDF 檢視器 (CVE-2018-5158) * Mozilla：Skia 中發生整數溢位和超出邊界寫入 (CVE-2018-5159) * Mozilla：不經使用者互動即可安裝輕量型佈景主題 (CVE-2018-5168) * Mozilla：在透過傳統延伸模組將 UTF-8 轉換為 Unicode 字串期間，發生緩衝區溢位 (CVE-2018-5178) 如需安全性問題的詳細資料，包括影響、CVSS 分數及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。Red Hat 感謝 Mozilla 專案報告這些問題。上游確認原始報告者 Christoph Diehl、Randell Jesup、Tyson Smith、Alex Gaynor、Ronald Crane、Julian Hector、Kannan Vijayan、Jason Kratzer、Mozilla Developers、Nils、Wladimir Palant、Ivan Fratric 和 Root 專案。

Versions of Mozilla Firefox ESR earlier than 52.8 are unpatched for the following vulnerabilities :

 - A use-after-free error exists that is triggered when enumerating attributes for SVG animations with clip paths. With a specially crafted SVG file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'layout/svg/SVGTextFrame.cpp' that is triggered when adjusting layouts for SVG animations with text paths. With a specially crafted SVG file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the PDF viewer that may allow a context-dependent attacker to bypass the same-origin policy and view restricted PDF files on a third-party website.
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists exists because the PDF viewer does not properly sanitize input to PostScript calculator functions before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that executes arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - An integer overflow condition exists in 'include/private/SkTDArray.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the installation of themes. This may allow a context-dependent attacker to manipulate the baseURI property  of a theme element to bypass intended user interaction checks, allowing for the installation of unintended themes. This may be used to 'e.g'. deface a page with content from unintended themes.
 - A flaw exists that is triggered as the program sets the SEE_MASK_FLAG_NO_UI flag for Windows Defender SmartScreen when handling certain downloads. This may result in the download file prompt not displaying to the user, potentially causing files to be opened without the user's intent.
 - An assertion flaw exists in the 'FilterNodeArithmeticCombineSoftware::SetAttribute()' function in 'gfx/2d/FilterNodeSoftware.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause an out-of-bounds read and potentially disclose memory contents.
 - A flaw exists that is triggered when asynchronously calling methods from the CamerasChild class in 'dom/media/systemservices/CamerasChild.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when performing UTF8 to Unicode string conversion. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - Multiple unspecified flaws exist exist related to the use of insecure versions of Skia that may allow an attacker to perform memory corruption attacks, or potentially have other impacts. No further details have been provided.

ID	名稱	產品	系列	已發布	已更新	嚴重性
109868	Mozilla Firefox ESR < 52.8 多個關鍵弱點	Nessus	Windows	2018/5/17	2019/11/4	critical
109869	Mozilla Firefox < 60 多個關鍵弱點	Nessus	Windows	2018/5/17	2024/10/7	critical
109923	CentOS 6：firefox (CESA-2018:1414)	Nessus	CentOS Local Security Checks	2018/5/21	2024/10/4	critical
700337	Mozilla Firefox ESR < 52.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/11/6	high

偵測

搜尋 Plugin

critical

critical

critical

high