Thunderbirdで複数のセキュリティの問題が発見されました。ユーザーが誘導され、特別に細工されたWebサイトをブラウジングコンテキストで開くと、攻撃者がこれらを悪用してサービス拒否を引き起こしたり、任意のコードを実行したりする可能性があります。(CVE-2018-5125、CVE-2018-5127、CVE-2018-5129、CVE-2018-5144、CVE-2018-5145、CVE-2018-5146)。

注意: Tenable Network Security は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

thunderbirdの更新プログラムが、Red Hat Enterprise Linux 6で利用可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度高と評価しています。詳細な重要度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。Mozilla Thunderbirdはスタンドアロンのメールおよびニュースグループクライアントです。この更新プログラムで、Thunderbirdがバージョン52.7.0にアップグレードされます。セキュリティ修正プログラム：*Mozilla：Firefox 59およびFirefox ESR 52.7で修正されたメモリ安全性に関するバグ（MFSA 2018-07）（CVE-2018-5125）*Mozilla：Firefox ESR 52.7で修正されたメモリ安全性に関するバグ（MFSA 2018-07）（CVE-2018-5145）*Mozilla：Vorbis音声処理の領域外書き込み（MFSA 2018-08）（CVE-2018-5146）*Mozilla：SVGアニメーションPathSegList（MFSA 2018-07）を操作するバッファオーバーフロー（CVE-2018-5127）*Mozilla：不正な形式のIPCメッセージによる領域外書き込み（MFSA 2018-07）（CVE-2018-5129）*Mozilla：Unicode変換時の整数オーバーフロー（MFSA 2018-07）（CVE-2018-5144）影響、CVSSスコア、およびその他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されているCVEのページを参照してください。Red Hatは、これらの問題を報告してくれたMozillaプロジェクトに感謝の意を表します。アップストリームは、Bob Clary氏、Olli Pettay氏、Christian Holler氏、Nils Ohlmeier氏、Randell Jesup氏、Tyson Smith氏、Ralph Giles氏、Philipp氏、Jet Villegas氏、Richard Zhu氏（Trend MicroのZero Day Initiativeを通じて）、Nils氏、James Grant氏、Root Object氏を最初の報告者として認めています。

libvorbisの更新プログラムが、Red Hat Enterprise Linux 6で利用可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度高と評価しています。詳細な重要度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。libvorbisパッケージには、Ogg Vorbisをサポートするプログラムで使用するためのランタイムライブラリが含まれます。これは、固定および可変ビットレートのオーディオおよび音楽用の完全オープンで非独占的な、特許およびロイヤリティフリーの汎用圧縮形式です。セキュリティ修正プログラム：*Mozilla：Vorbis音声処理の領域外書き込み（MFSA 2018-08）（CVE-2018-5146）影響、CVSSスコア、その他の関連情報を含むセキュリティの問題の詳細については、「参照」セクションに記載されているCVEのページを参照してください。Red Hatは、この問題を報告してくれたMozillaプロジェクトに感謝の意を表します。アップストリームは、トレンドマイクロ社のZero Day InitiativeのRichard Zhu氏を最初の報告者として認識しています。

セキュリティ修正プログラム:

  - Mozilla: Vorbis音声処理の領域外書き込み（MFSA 2018-08）（CVE-2018-5146）

Firefoxの更新プログラムが、Red Hat Enterprise Linux 6とRed Hat Enterprise Linux 7で利用可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響を深刻として評価しています。詳細な重要度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。Mozilla Firefoxは、標準コンプライアンス、パフォーマンス、移植性を特徴とするオープンソースのWebブラウザーです。この更新プログラムで、Firefoxがバージョン52.7.2 ESRにアップグレードされます。セキュリティ修正プログラム：* Mozilla：Vorbis音声処理の領域外書き込み（MFSA 2018-08）（CVE-2018-5146）影響、CVSSスコア、謝辞、その他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されているCVEのページを参照してください。

出典: Red Hatセキュリティアドバイザリ2018:0549:firefoxの更新がRed Hat Enterprise Linux 6およびRed Hat Enterprise Linux 7用に入手可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度重大として評価しています。詳細な重要度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。Mozilla Firefoxは、標準コンプライアンス、パフォーマンス、移植性を特徴とするオープンソースのWebブラウザーです。この更新プログラムで、Firefoxがバージョン52.7.2 ESRにアップグレードされます。セキュリティ修正プログラム：* Mozilla：Vorbis音声処理の領域外書き込み（MFSA 2018-08）（CVE-2018-5146）影響、CVSSスコア、謝辞、その他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されているCVEのページを参照してください。

libvorbis 1.3.6。CVE-2018-5146 の修正。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Versions of Mozilla Firefox ESR earlier than 52.7.2 are unpatched for an out-of-bounds write flaw exists in the 'vorbis_book_decodevs_add()', 'vorbis_book_decodev_add()', and 'vorbis_book_decodevv_add()' functions in 'codebook.c' that is triggered when decoding codebooks from Vorbis audio data. This may allow a context-dependent attacker to corrupt memory and execute arbitrary code.

Versions of Mozilla Firefox ESR earlier than 52.7 are unpatched for the following vulnerabilities :

 - An overflow condition exists that is triggered when handling SVG animatedPathSegList attributes. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as local copies of resources that were sent with a no-store or no-cache header may be returned by the 'fetch()' API. This allows a local attacker to gain access to potentially sensitive information.
 - An out-of-bounds write flaw exists that is triggered when handling plane widths and stride constraints in IPC messages. This may allow a context-dependent attacker to bypass sandbox restrictions.
 - A flaw exists in the 'JsepTrack::NegotiateCodecs()' function in 'media/webrtc/signaling/src/jsep/JsepTrack.cpp' that is triggered when handling RTP payload types in WebRTC connections. With specially crafted packets, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An integer overflow condition exists that is triggered as certain length parameters are not properly validated during conversion of text to unicode character sets. This may allow a context-dependent attacker to have an unspecified impact.
 - A use-after-free condition exists in 'layout/base/nsDocumentViewer.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when handling HTTP/2 streams. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'EventStateManager::NotifyMouseOver()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouseover events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readHeader()' function in 'vm/StructuredClone.cpp' that is triggered when handling structured clone data. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::MakeMRegExpHoistable()' function in 'jit/IonAnalysis.cpp' that is triggered when optimization for regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'JSObject::setFlags()' function in 'vm/Shape.cpp' that is triggered when checking for dictionary mode. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'vpx_codec_enc_init_multi_ver()' function in 'vpx_encoder.c' that is triggered when handling memory during early exits. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is related to document renderer handling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An arithmetic flaw exists in the 'nsTextFrame::GetRenderedText()' function in 'layout/generic/nsTextFrame.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the EditorBase destructor in 'editor/libeditor/EditorBase.cpp' that is triggered when unlinking cycle collectors. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in 'vp9/encoder/x86/vp9_quantize_ssse3_x86_64.asm' that is triggered when handling memory 'pointers.This' may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocumentEncoder::SerializeToStringRecursive()' function in 'dom/base/nsDocumentEncoder.cpp' that is triggered when serializing DOM nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in the 'vorbis_book_decodevs_add()', 'vorbis_book_decodev_add()', and 'vorbis_book_decodevv_add()' functions in 'codebook.c' that is triggered when decoding codebooks from Vorbis audio data. This may allow a context-dependent attacker to corrupt memory and execute arbitrary code.

The version of Mozilla Firefox installed on the remote Windows host is prior to 59.0.1. It is, therefore, affected by multiple code execution vulnerabilities. A out-of-bounds write flaw exists in multiple functions of the codebook.c script when decoding Vorbis audio data. A context-dependent attacker could corrupt memory and potentially execute arbitrary code. (CVE-2018-5146, CVE-2018-5147)

Versions of Mozilla Firefox earlier than 59 are unpatched for the following vulnerabilities :

 - An overflow condition exists that is triggered when handling SVG animatedPathSegList attributes. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in 'dom/html/nsTextEditorState.cpp' that is triggered when handling elements, events, and selection ranges during editor operations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as local copies of resources that were sent with a no-store or no-cache header may be returned by the 'fetch()' API. This allows a local attacker to gain access to potentially sensitive information.
 - An out-of-bounds write flaw exists that is triggered when handling plane widths and stride constraints in IPC messages. This may allow a context-dependent attacker to bypass sandbox restrictions.
 - A flaw exists in the 'JsepTrack::NegotiateCodecs()' function in 'media/webrtc/signaling/src/jsep/JsepTrack.cpp' that is triggered when handling RTP payload types in WebRTC connections. With specially crafted packets, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'runFindOperation()' function in 'browser/components/extensions/ext-find.js' that that is triggered as it permits using the Find API for WebExtensions to access privileged pages in open tabs. By tricking a user into installing a malicious web extension, a context-dependent attacker can gain access to potentially sensitive information.
 - A flaw exists that is triggered as input to the ''app.support'.baseURL' preference is not properly sanitized. This may allow a local attacker to create specially crafted script code that is executed in user's browser session within the context of the preferences tab.
 - A flaw exists in 'netwerk/protocol/viewsource/nsViewSourceHandler.cpp' that is triggered when handling view-source: URLs. By tricking a user into installing a malicious web extension, a context-dependent attacker can bypass content restrictions and view local 'file:' URL content or content stored in 'about:cache'.
 - A flaw exists that is triggered when handling access restrictions for web extensions. By tricking a user into installing a malicious web extension, a context-dependent attacker can inject script code into pages from other web extensions or unprivileged 'about:' pages.
 - A flaw exists in 'dom/workers/RuntimeService.cpp' that is triggered as a shared worker created from a data: URL can be shared by another tab with a different origin. This may allow a context-dependent attacker to bypass the same-origin policy.
 - A flaw exists in the 'nsChromeRegistry::Canonify()' function in 'chrome/nsChromeRegistry.cpp' that is triggered as access to a legacy extension's 'non-contentaccessible' resource is not properly restricted. With a specially crafted web page, a context-dependent attacker to gain unauthorized access.
 - A flaw exists in the 'ActionBarPresenter::updateCustomView()' function in 'customtabs/ActionBarPresenter.java' that is triggered when handling overly long domain names in an Android Custom Tab. This allows a context-dependent attacker to spoof the address bar.
 - A flaw exists in the 'nsMozIconURI::SetSpec()' function in 'image/decoders/icon/nsIconURI.cpp' that is triggered as access to moz-images is not properly restricted when using the 'moz-icon:' protocol. With a specially crafted web page, a context-dependent attacker can gain information about application associations for certain MIME types.
 - A flaw exists in the 'SendNotificationEventRunnable::WorkerRun()' function in 'dom/workers/ServiceWorkerPrivate.cpp' related to the Notifications Push API. This may allow a context-dependent attacker to open new tabs and display unwanted content from arbitrary URLs.
 - A flaw exists that is due to the in the Media Capture and Streams API not properly displaying the originating domain when requested via 'data:' or 'blob:' URLs. This may result in user confusion about which site is asking for this permission.
 - A flaw exists in the 'stripUnsafeProtocolOnPaste()' function in 'content/browser.js' that allows a cross-site scripting (Self-XSS) attack. This flaw exists exists because the application does not properly sanitize input to the address bar. This may allow a context-dependent attacker to create a specially crafted 'javascript:' URL containing an embedded tab character that executes arbitrary script code in their own browser.
 - An unspecified flaw exists that is triggered as certain input is not properly validated when handling typed arrays. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the AccessiblCaret (Copy & Paste) feature that is triggered when handling flushing of pending notifications. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'jit/CacheIR.cpp' that is triggered when attaching argument stubs. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSCompartment::getOrCreateIterResultTemplateObject()' function in 'jsiter.cpp' that is triggered when updating type information of iter result object templates. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A signednes flaw exists in the StoreBuffer class that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MediaPipelineTransmit::SetDescription()' function in 'mediapipeline/MediaPipeline.cpp' that is triggered when handling media descriptions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHTMLDocument::Open()' function in 'dom/html/nsHTMLDocument.cpp' that is triggered when handling unload events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCSSFrameConstructor::ContentRemoved()' function in 'layout/base/nsCSSFrameConstructor.cpp' that is triggered when handling frames for content nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'internal_ClearHistogramById()' function in 'toolkit/components/telemetry/TelemetryHistogram.cpp' that is triggered when handling expired histograms. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CanAttachAddElement()' function in 'jit/CacheIR.cpp' that is triggered when handling shadowing indexed properties. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'mozglue/android/NSSBridge.cpp' that is triggered as certain input is not properly validated when decoding base64 data. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when handling HTTP/2 streams. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'EventStateManager::NotifyMouseOver()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouseover events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readHeader()' function in 'vm/StructuredClone.cpp' that is triggered when handling structured clone data. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::MakeMRegExpHoistable()' function in 'jit/IonAnalysis.cpp' that is triggered when optimization for regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'JSObject::setFlags()' function in 'vm/Shape.cpp' that is triggered when checking for dictionary mode. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'vpx_codec_enc_init_multi_ver()' function in 'vpx_encoder.c' that is triggered when handling memory during early exits. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is related to document renderer handling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An arithmetic flaw exists in the 'nsTextFrame::GetRenderedText()' function in 'layout/generic/nsTextFrame.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the EditorBase destructor in 'editor/libeditor/EditorBase.cpp' that is triggered when unlinking cycle collectors. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in 'vp9/encoder/x86/vp9_quantize_ssse3_x86_64.asm' that is triggered when handling memory 'pointers.This' may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocumentEncoder::SerializeToStringRecursive()' function in 'dom/base/nsDocumentEncoder.cpp' that is triggered when serializing DOM nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in the 'vorbis_book_decodevs_add()', 'vorbis_book_decodev_add()', and 'vorbis_book_decodevv_add()' functions in 'codebook.c' that is triggered when decoding codebooks from Vorbis audio data. This may allow a context-dependent attacker to corrupt memory and execute arbitrary code.

ID	名稱	產品	系列	已發布	已更新	嚴重性
108751	Ubuntu 14.04LTS / 16.04LTS: Thunderbird の脆弱性 (USN-3545-1)	Nessus	Ubuntu Local Security Checks	2018/3/30	2024/8/27	critical
108867	RHEL 6：thunderbird（RHSA-2018:0647）	Nessus	Red Hat Local Security Checks	2018/4/6	2024/11/14	critical
108900	CentOS 6：libvorbis（CESA-2018:0649）	Nessus	CentOS Local Security Checks	2018/4/10	2024/11/12	high
109452	Scientific Linux セキュリティ更新: SL7.x x86_64のlibvorbis（20180410）	Nessus	Scientific Linux Local Security Checks	2018/5/1	2024/10/16	high
108448	RHEL 6/7：Firefox（RHSA-2018:0549）	Nessus	Red Hat Local Security Checks	2018/3/19	2025/1/29	high
108479	Oracle Linux 6/7：firefox（ELSA-2018-0549）	Nessus	Oracle Linux Local Security Checks	2018/3/20	2025/1/28	high
108489	CentOS 6/7：Firefox（CESA-2018:0549）	Nessus	CentOS Local Security Checks	2018/3/21	2025/1/28	high
108491	Fedora 27：1：libvorbis（2018-061bafe369）	Nessus	Fedora Local Security Checks	2018/3/21	2025/1/28	high
700336	Mozilla Firefox ESR < 52.7.2 RCE	Nessus Network Monitor	Web Clients	2018/8/21	2019/11/6	high
700335	Mozilla Firefox ESR < 52.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/11/6	high
700329	Mozilla Firefox < 59.0.1 Multiple RCE	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	high
700328	Mozilla Firefox < 59 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	high

偵測

搜尋 Plugin

critical

critical

high

high

high

high

high

high

high

high

high

high