The version of Firefox installed on the remote macOS or Mac OS X host is prior to 55.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-18 advisory.

  - Mozilla developers and community members Masayuki Nakano, Gary Kwong, Ronald Crane, Andrew McCreight,     Tyson Smith, Bevis Tseng, Christian Holler, Bryce Van Dyk, Dragana Damjanovic, Kartikaya Gupta, Philipp,     Tristan Bourvon, and Andi-Bogdan Postelnicu reported memory safety bugs present in Firefox 54 and Firefox     ESR 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary code. (CVE-2017-7779)

  - A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree     traversal while still bound to the document. This results in a potentially exploitable crash.
    (CVE-2017-7809)

  - The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the     web page source code. In the worst case, this could allow arbitrary code execution when opening a     malicious page with the style editor tool. (CVE-2017-7798)

  - A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed     before the disconnection operation is finished. This results in an exploitable crash. (CVE-2017-7800)

  - A use-after-free vulnerability can occur while re-computing layout for a <code>marquee</code> element     during window resizing where the updated style object is freed while still in use. This results in a     potentially exploitable crash. (CVE-2017-7801)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端 macOS 或 Mac OS X 主機上安裝的 Firefox 版本低於 55.0。因此會受到 mfsa2017-18 公告中所提及的多個弱點影響。

  - Mozilla 開發人員和社群成員 Masayuki Nakano、Gary Kwong、Ronald Crane、Andrew McCreight、Tyson Smith、Bevis Tseng、Christian Holler、Bryce Van Dyk、Dragana Damjanovic、Kartikaya Gupta、Philipp、Tristan Bourvon 和 Andi-Bogdan Postelnicu 報告記憶體安全性Firefox 54 和 Firefox ESR 中存在錯誤 52.2。某些錯誤顯示記憶體會遭到損毀我們推測若有心人士有意操控可惡意利用其中部分錯誤執行任意程式碼。 (CVE-2017-7779)

  - 若在樹狀遊走期間過早刪除編輯器 DOM 節點但仍系結至文件則會發生釋放後使用弱點。這會造成可能遭惡意利用的當機問題。
    (CVE-2017-7809)

  - 由於網頁原始碼的不當清理「開發人員工具」功能容易受到 XUL 插入弱點的影響。在最嚴重的情況下這可在使用樣式編輯器工具開啟惡意頁面時允許任意程式碼執行。 (CVE-2017-7798)

  - 若保留連線的物件在中斷連線作業完成之前被釋放WebSockets 可能會產生釋放後使用弱點。這會導致可遭惡意利用的當機。 (CVE-2017-7800)

  - 在視窗調整大小期間重新計算 <code>marquee</code> 元素的配置時更新的樣式物件在仍然使用中的狀態下被釋放可能會產生釋放後使用弱點。這會導致可能遭惡意利用的當機。 (CVE-2017-7801)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートの macOS または Mac OS X ホストにインストールされている Firefox のバージョンは、55.0 より前のものです。したがって、mfsa2017-18アドバイザリに記載されているように、複数の脆弱性の影響を受けます。

  - Mozilla 開発者とコミュニティメンバーである Masayuki Endo、Gary Kwong、Ronald Crane、Andrew McCreight、Tyson Smith、Bevis Tseng、Christian Holler、Bryce Van Dyk、Dragana Damjano、Kartikaya Gupta、Philipp、Tristan Bourvon、Andi-Bogdan Postelnicu は、メモリの安全性を報告しました。 Firefox 54 および Firefox ESR に存在するバグ 52.2。このバグの一部からは、メモリ破損の証拠を示しており、十分な手間をかければ、これらの一部を悪用して任意のコードを実行できると考えられます。CVE-2017-7779

  - ドキュメントにバインドされている間に、ツリートラバーサル中にエディターDOMノードが時期尚早に削除されると、メモリ解放後使用Use After Freeの脆弱性が発生する可能性があります。これにより、悪用可能なクラッシュが引き起こされる可能性があります。
    (CVE-2017-7809)

  - Developer Tools 機能は、Web ページのソースコードの不適切なサニタイズにより、XUL インジェクションの脆弱性の影響を受けます。最悪の場合、これにより、スタイルエディターツールで悪意のあるページが開かれる際に、任意のコードが実行される可能性があります。CVE-2017-7798

  - 切断操作が終了する前に、接続を保持しているオブジェクトが解放されると、WebSocket に use-after-free の脆弱性が発生する可能性があります。これにより、悪用可能なクラッシュが発生します。CVE-2017-7800

  - 使用中に更新されたスタイルオブジェクトが解放されるウィンドウのサイズ変更中に、 <code>marquee</code> 要素のレイアウトを再計算する際に、 use-after-free の脆弱性が発生する可能性があります。これにより、悪用可能なクラッシュが発生する可能性があります。CVE-2017-7801

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 55.0。因此如公告 mfsa2017-18 所述受到多个漏洞的影响。

  - Mozilla 开发人员和社区成员 Masayuki Nakano、Gary Kwong、Ronald Crane、Andrew McCreight、Tyson Smith、Bevis Tseng、Christian Holler、Bryce Van Dyk、Dragana Damjanovic、Kartikaya Gupta、Philipp、Tristan Bourvon 和 Andi-Bogdan Postelnicu 报告了内存安全Firefox 54 和 Firefox ESR 中存在的缺陷 52.2。有迹象表明其中某些缺陷可导致内存损坏我们推测若攻击者有意操控就能利用其中部分缺陷来运行任意代码。 (CVE-2017-7779)

  - 若在树遍历期间过早删除编辑器 DOM 节点同时仍然绑定到文档就会出现释放后使用漏洞。这会导致潜在可利用的崩溃。
    (CVE-2017-7809)

  - 开发人员工具功能受到 XUL 注入漏洞影响原因在于不当清理 Web 页面源代码。在最坏的情况下这可能允许在使用样式编辑器工具打开恶意页面时执行任意代码。 (CVE-2017-7798)

  - 当保持连接的对象在断开连接操作完成前释放在 WebSockets 中可能出现释放后使用漏洞。这会导致可利用的崩溃。 (CVE-2017-7800)

  - 当更新的样式对象在仍使用时遭到释放在窗口调整大小期间重新计算 <code>marquee</code> 元素的布局时会出现释放后使用漏洞。这会导致潜在可利用的崩溃。 (CVE-2017-7801)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Windows 主机上安装的 Firefox 版本低于 55.0。因此，该应用程序受到 mfsa2017-18 公告中提及的多个漏洞影响。

  - Mozilla 开发人员和社区成员 Masayuki Nakano、Gary Kwong、Ronald Crane、Andrew McCreight、Tyson Smith、Bevis Tseng、Christian Holler、Bryce Van Dyk、Dragana Damjanovic、Kartikaya Gupta、Philipp、Tristan Bourvon 和 Andi-Bogdan Postelnicu 报告 Firefox 54 和 Firefox ESR 52.2 中存在内存安全缺陷。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。(CVE-2017-7779)

  - 当在树遍历期间过早删除编辑器 DOM 节点，并且仍然与文件绑定时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。
    (CVE-2017-7809)

  - 开发人员工具功能受到 XUL 注入漏洞影响，原因在于不当清理 Web 页面源代码。在最糟糕的情况下，当打开带有样式编辑器工具的恶意页面时，可允许任意代码执行。(CVE-2017-7798)

  - 当保持连接的对象在断开连接操作完成前释放，在 WebSockets 中可能出现释放后使用漏洞。这会导致可利用的崩溃。(CVE-2017-7800)

  - 当更新的样式对象在仍使用时遭到释放，在窗口调整大小期间，重新计算 <code>marquee</code> 元素的布局时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。(CVE-2017-7801)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Windows 主機上安裝的 Firefox 版本是 55.0 之前版本。因此，該應用程式受到 mfsa2017-18 公告中提及的多個弱點影響。

  - Mozilla 開發人員和社群成員 Masayuki Nakano、Gary Kwong、Ronald Crane、Andrew McCreight、Tyson Smith、Bevis Tseng、Christian Holler、Bryce Van Dyk、Dragana Damjanovic、Kartikaya Gupta、Philipp、Tristan Bourvon 和 Andi-Bogdan Postelnicu 報告記憶體安全性Firefox 54 和 Firefox ESR 中存在錯誤 52.2。某些錯誤顯示記憶體會遭到損毀，我們推測若有心人士有意操控，可惡意利用其中部分錯誤執行任意程式碼。(CVE-2017-7779)

  - 若在樹狀遊走仍然繫結文件時過早刪除編輯器的 DOM 節點，會產生釋放後使用弱點。這會造成可能遭惡意利用的當機問題。
    (CVE-2017-7809)

  - 由於網頁原始碼的不當清理，「開發人員工具」功能容易受 XUL 插入弱點的影響。在最嚴重的情況下，可能會在使用樣式編輯器工具開啟惡意頁面時允許任意程式碼執行。(CVE-2017-7798)

  - 若保留連線的物件在中斷連線作業完成之前被釋放，WebSockets 可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機。(CVE-2017-7800)

  - 若因調整視窗大小而重新計算<code>跑馬燈</code>元素的版面配置時，更新過後的樣式物件在仍然使用中的狀態下被釋放，可能會產生釋放後使用弱點。這會造成可能遭惡意利用的當機問題。(CVE-2017-7801)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Mozilla Foundation reports :

Please reference CVE/URL list for details

The version of Firefox installed on the remote Windows host is prior to 55.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-18 advisory.

  - Mozilla developers and community members Masayuki Nakano, Gary Kwong, Ronald Crane, Andrew McCreight,     Tyson Smith, Bevis Tseng, Christian Holler, Bryce Van Dyk, Dragana Damjanovic, Kartikaya Gupta, Philipp,     Tristan Bourvon, and Andi-Bogdan Postelnicu reported memory safety bugs present in Firefox 54 and Firefox     ESR 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary code. (CVE-2017-7779)

  - A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree     traversal while still bound to the document. This results in a potentially exploitable crash.
    (CVE-2017-7809)

  - The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the     web page source code. In the worst case, this could allow arbitrary code execution when opening a     malicious page with the style editor tool. (CVE-2017-7798)

  - A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed     before the disconnection operation is finished. This results in an exploitable crash. (CVE-2017-7800)

  - A use-after-free vulnerability can occur while re-computing layout for a <code>marquee</code> element     during window resizing where the updated style object is freed while still in use. This results in a     potentially exploitable crash. (CVE-2017-7801)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Foundation による報告：

詳細については、CVE/URLリストを参照してください。

リモートの Windows ホストにインストールされている Firefox のバージョンは、55.0 より前です。したがって、mfsa2017-18 アドバイザリに記載されている複数の脆弱性の影響を受けます。

  - Mozilla 開発者およびコミュニティメンバーの Masayuki Endo 氏、Gary Kwong 氏、Ronald Crane 氏、Andrew McCreight 氏、Tyson Smith 氏、Bevis Tseng 氏、Christian Holler 氏、Bryce Van Dyk 氏、Dragana Damjano 氏、Kartikaya Gupta 氏、Philipp 氏、Tristan Bourvon 氏、Andi-Bogdan Postelnicu 氏は、Firefox 54 および Firefox ESR に存在するメモリ安全性のバグを報告しました。(52.2)。これらのバグの一部にはメモリ破損の証拠が示されており、当社では、十分な労力をもってすればこれらの一部を悪用し、任意のコードを実行することが可能であると推測しています。(CVE-2017-7779)

  - エディターの DOM ノードがドキュメントにバインドされたままツリートラバーサル中に早期に削除されると、メモリ解放後使用 (Use-After-Free) の脆弱性が発生する可能性があります。これにより、悪用可能なクラッシュが引き起こされる可能性があります。
    (CVE-2017-7809)

  - Developer Tools 機能は、ウェブページのソースコードの不適切なサニタイズにより、XUL インジェクションの脆弱性の影響を受けます。最悪の場合、スタイルエディターツールを使用して悪意のあるページを開いたときに、任意のコードが実行される可能性があります。(CVE-2017-7798)

  - 切断操作が完了する前に接続を保持しているオブジェクトが解放されると、WebSocket でメモリ解放後使用 (Use-After-Free) の脆弱性が発生する可能性があります。これにより、悪用可能なクラッシュが引き起こされる可能性があります。(CVE-2017-7800)

  - ウィンドウのサイズ変更中に <code>marquee</code> 要素のレイアウトを再計算しているときに、更新されたスタイルオブジェクトが使用中に解放されると、メモリ解放後使用 (Use-After-Free) の脆弱性が発生する可能性があります。これにより、悪用可能なクラッシュが引き起こされる可能性があります。(CVE-2017-7801)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Versions of Mozilla Firefox prior to 55 are unpatched for the following vulnerabilities :

 - A flaw exists that is triggered as the HTTP Strict-Transport-Security (HSTS) header is ignored when processing a response containing multiple HSTS headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) to bypass HSTS protection and downgrade the HTTP communication.
 - A flaw exists in the 'Key::EncodeAsString()' function in 'dom/indexedDB/Key.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'SelectionManager::SetControlSelectionListener()' and 'SelectionManager::ClearControlSelectionListener()' functions in 'accessible/base/SelectionManager.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'DocAccessible::MoveChild()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'xpcom/threads/MozPromise.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling edit transactions. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists related to the Android UI thread. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CanonicalizeLanguageTag()' function in 'js/src/builtin/Intl.js' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling freezing of dense elements. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Module::instantiate()' function in 'js/src/wasm/WasmModule.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Accessible::RemoveChild()' function in 'accessible/generic/Accessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::build()' and 'IonBuilder::buildInline()' functions in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsContentUtils::ConvertStringFromEncoding()' function in 'dom/base/nsContentUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::JitActivation::getRematerializedFrame()' function in 'js/src/vm/Stack.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsMIMEHeaderParamImpl::DecodeRFC5987Param()' function in 'netwerk/mime/nsMIMEHeaderParamImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsWindow::SetParent()' function in 'widget/windows/nsWindow.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_mac.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to missing thread safety that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NotifyTrackRemoved()' function in 'dom/media/MediaRecorder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'InitGlobalLexicalOperation()' function in 'js/src/vm/Interpreter-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::FinishCompilation()' function in 'js/src/vm/TypeInference.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TypedArrayObjectTemplate::makeTemplateObject()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsFTPDirListingConv::DigestBufferLines()' function in 'netwerk/streamconv/converters/nsFTPDirListingConv.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TraceSelf()' function in 'dom/bindings/TypedArray.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebSocket::Send()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ExpressionDecompiler::decompilePC()' function in 'js/src/jsopcode.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::addOsrValueTypeBarrier()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists related to response header name interning not having same-origin protections. This may allow a context-dependent attacker to disclose stored header names.
 - A flaw exists in the Developer Tools feature that is triggered as web page source code is not properly validated. This may allow a context-dependent attacker to inject and execute arbitrary XUL code.
 - A use-after-free error exists in the 'WebSocketImpl::Disconnect()' function in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when re-computing the layout for marquee elements during window resizing. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when deleting attached editor DOM nodes. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsImageLoadingContent::Notify()' function in 'dom/base/nsImageLoadingContent.cpp' that is triggered when reading image observers during frame reconstruction. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when resizing image elements. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when manipulation Accessible Rich Internet Applications (ARIA) attributes. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as certain input is not properly validated when painting non-displayable SVG elements. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling the layer manager while rendering SVG content. This may allow a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling cached style data and pseudo-elements. This may allow a context-dependent attacker to potentially disclose sensitive memory contents.
 - A flaw exists in the 'nsDocShell::OnNewURI()' function in 'docshell/base/nsDocShell.cpp' that is triggered when handling pages with embedded iframes during page reloads. With a specially crafted web page, a context-dependent attacker can bypass the same-origin policy.
 - A flaw exists in the AppCache feature related to handling of websites under a subdirectory adding fallback pages. With a specially crafted website, a context-dependent attacker can hijack a domain.
 - A flaw exists in the 'openTabPrompt()' and 'openRemotePrompt()' functions in 'toolkit/components/prompts/src/nsPrompter.js' that is triggered when handling page navigations with data: protocols and modal alerts. This may allow a context-dependent attacker to conduct spoofing attacks.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as WindowsDllDetourPatcher may allocate memory with RWX permissions. This may allow a context-dependent attacker to bypass intended DEP protection and more easily exploit another vulnerability that allows code execution.
 - A flaw exists in the 'AllowOpen()' function in 'security/sandbox/linux/broker/SandboxBroker.cpp'. This may allow a context-dependent attacker to bypass the sandbox restrictions and truncate files on the system.
 - A flaw exists in the elliptic curve point addition algorithm that is triggered when using mixed Jacobian-affine coordinates. This may allow an attacker with the ability to intercept network traffic '(e.g'. MitM, DNS cache poisoning) to interfere with a connection and cause the calculation of an incorrect shared secret.
 - A flaw exists that is triggered when handling frame-ancestors directives containing origins with paths. This may allow a context-dependent attacker to bypass the content security policy (CSP).
 - A sandbox directive. This may result in other directives being ignored and incorrect enforcement of the content security policy (CSP).
 - A flaw exists in the 'ExecuteServiceCommand()' function in 'toolkit/components/maintenanceservice/workmonitor.cpp' that is triggered when handling patch directory paths. Combined with another local vulnerability this may allow an attacker to have the Windows updater delete any file named 'update.log'.
 - A flaw exists in 'toolkit/content/aboutwebrtc/aboutWebrtc.js' that is triggered as certain input to about:webrtc is not properly validated. This may allow an attacker to create a specially crafted request that executes arbitrary script code in a user's browser session within the trust relationship between their browser and the server or inject XUL code.
 - A flaw exists in the 'nsHttpChannelAuthProvider::ConfirmAuth()' function in 'netwerk/protocol/http/nsHttpChannelAuthProvider.cpp' that is triggered when handling long usernames in URLs. This may allow a context-dependent attacker to cause a denial of service.
 - A flaw exists in 'toolkit/crashreporter/client/crashreporter_win.cpp' that is triggered as the Windows crash reporter may read extra memory for certain non-null-terminated registry values. This may allow an attacker to disclose potentially sensitive memory contents.
 - A flaw exists in 'xpcom/build/nsWindowsDllInterceptor.h' that is triggered as the WindowsDllDetourPatcher class destructor may be re-purposed by malicious code. This may allow a context-dependent attacker to bypass memory protections.
 - A flaw exists that is triggered as sandboxed about:srcdoc iframes do not inherit content security policy (CSP) directives. This may allow a context-dependent attacker to bypass the content security policy (CSP).
 - An overflow condition exists in 'security/manager/ssl/nsNSSCertHelper.cpp' that is triggered when viewing certificates with overly long OIDs. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.

ID	名稱	產品	系列	已發布	已更新	嚴重性
275616	Mozilla Firefox < 55.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
275616	Mozilla Firefox < 55.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
275616	Mozilla Firefox < 55.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
275616	Mozilla Firefox < 55.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
102359	Mozilla Firefox < 55.0	Nessus	Windows	2017/8/10	2025/11/18	critical
102359	Mozilla Firefox < 55.0	Nessus	Windows	2017/8/10	2025/11/18	critical
102278	FreeBSD : mozilla -- multiple vulnerabilities (555b244e-6b20-4546-851f-d8eb7d6c1ffa)	Nessus	FreeBSD Local Security Checks	2017/8/9	2021/1/4	critical
102359	Mozilla Firefox < 55.0	Nessus	Windows	2017/8/10	2025/11/18	critical
102278	FreeBSD: mozilla -- 複数の脆弱性（555b244e-6b20-4546-851f-d8eb7d6c1ffa）	Nessus	FreeBSD Local Security Checks	2017/8/9	2021/1/4	critical
102359	Mozilla Firefox < 55.0	Nessus	Windows	2017/8/10	2025/11/18	critical
700182	Mozilla Firefox < 55 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/8/21	2019/3/6	high

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high