Mozilla Foundation reports :

Please reference CVE/URL list for details

This update for MozillaFirefox to version 51.0.1 fixes security issues and bugs.

These security issues were fixed :

  - CVE-2017-5375: Excessive JIT code allocation allows     bypass of ASLR and DEP (bmo#1325200, boo#1021814)

  - CVE-2017-5376: Use-after-free in XSL (bmo#1311687,     boo#1021817) CVE-2017-5377: Memory corruption with     transforms to create gradients in Skia (bmo#1306883,     boo#1021826)

  - CVE-2017-5378: Pointer and frame data leakage of     JavaScript objects (bmo#1312001, bmo#1330769,     boo#1021818)

  - CVE-2017-5379: Use-after-free in Web Animations     (bmo#1309198,boo#1021827)

  - CVE-2017-5380: Potential use-after-free during DOM     manipulations (bmo#1322107, boo#1021819)

  - CVE-2017-5390: Insecure communication methods in     Developer Tools JSON viewer (bmo#1297361, boo#1021820)

  - CVE-2017-5389: WebExtensions can install additional     add-ons via modified host requests (bmo#1308688,     boo#1021828)

  - CVE-2017-5396: Use-after-free with Media Decoder     (bmo#1329403, boo#1021821)

  - CVE-2017-5381: Certificate Viewer exporting can be used     to navigate and save to arbitrary filesystem locations     (bmo#1017616, boo#1021830)

  - CVE-2017-5382: Feed preview can expose privileged     content errors and exceptions (bmo#1295322, boo#1021831)

  - CVE-2017-5383: Location bar spoofing with unicode     characters (bmo#1323338, bmo#1324716, boo#1021822)

  - CVE-2017-5384: Information disclosure via Proxy     Auto-Config (PAC) (bmo#1255474, boo#1021832)

  - CVE-2017-5385: Data sent in multipart channels ignores     referrer-policy response headers (bmo#1295945,     boo#1021833)

  - CVE-2017-5386: WebExtensions can use data: protocol to     affect other extensions (bmo#1319070, boo#1021823)

  - CVE-2017-5391: Content about: pages can load privileged     about: pages (bmo#1309310, boo#1021835)

  - CVE-2017-5393: Remove addons.mozilla.org CDN from     whitelist for mozAddonManager (bmo#1309282, boo#1021837)

  - CVE-2017-5387: Disclosure of local file existence     through TRACK tag error messages (bmo#1295023,     boo#1021839)

  - CVE-2017-5388: WebRTC can be used to generate a large     amount of UDP traffic for DDOS attacks (bmo#1281482,     boo#1021840)

  - CVE-2017-5374: Memory safety bugs (boo#1021841)

  - CVE-2017-5373: Memory safety bugs (boo#1021824)

These non-security issues in MozillaFirefox were fixed :

  - Added support for FLAC (Free Lossless Audio Codec)     playback

  - Added support for WebGL 2

  - Added Georgian (ka) and Kabyle (kab) locales

  - Support saving passwords for forms without 'submit'     events

  - Improved video performance for users without GPU     acceleration

  - Zoom indicator is shown in the URL bar if the zoom level     is not at default level

  - View passwords from the prompt before saving them

  - Remove Belarusian (be) locale

  - Use Skia for content rendering (Linux)

  - Improve recognition of LANGUAGE env variable     (boo#1017174)

  - Multiprocess incompatibility did not correctly register     with some add-ons (bmo#1333423)

Mozilla Foundation による報告：

詳細については、CVE/URLリストを参照してください。

このMozillaFirefoxのバージョン51.0.1への更新では、セキュリティの問題とバグが修正されます。

これらのセキュリティの問題が修正されました：

  - CVE-2017-5375：過剰なJITコード割り当てにより、ASLRとDEPのバイパスが可能になります（bmo#1325200、boo#1021814）

  - CVE-2017-5376：XSLにおけるメモリ解放後使用（Use After Free）（bmo#1311687、boo#1021817）CVE-2017-5377：Skiaでグラデーションを作成するための変換によるメモリ破損（bmo#1306883、boo#1021826）

  - CVE-2017-5378：JavaScriptオブジェクトのポインターとフレームのデータ漏洩（bmo#1312001、bmo#1330769、boo#1021818）

  - CVE-2017-5379：Webアニメーションでのメモリ解放後使用（Use After Free）（bmo#1309198、boo#1021827）

  - CVE-2017-5380：DOM操作中のメモリ解放後使用（Use After Free）の可能性（bmo#1322107、boo#1021819）

  - CVE-2017-5390：Developer Tools JSONビューアーでの安全でない通信方法（bmo#1297361、boo#1021820）

  - CVE-2017-5389：WebExtensionが、変更されたホストリクエストを介して追加のアドオンをインストールできます（bmo#1308688、boo#1021828）

  - CVE-2017-5396：Media Decoderでのメモリ解放後使用（Use After Free）（bmo#1329403、boo#1021821）

  - CVE-2017-5381：Certificate Viewerのエクスポートは、任意のファイルシステムの場所への移動および保存に使用できます（bmo#1017616、boo#1021830）

  - CVE-2017-5382：フィードプレビューにより、権限のあるコンテンツのエラーや例外が公開される可能性があります（bmo#1295322、boo#1021831）

  - CVE-2017-5383：Unicode文字によるロケーションバースプーフィング（bmo#1323338、bmo#1324716、boo#1021822）

  - CVE-2017-5384：Proxy Auto-Config（PAC）を介した情報漏洩（bmo#1255474、boo#1021832）

  - CVE-2017-5385：マルチパートチャネルで送信されたデータが、referrer-policy応答ヘッダーを無視します（bmo#1295945、boo#1021833）

  - CVE-2017-5386：WebExtensionはdata: protocolを使用して他の拡張機能に影響を与える可能性があります（bmo#1319070、boo#1021823）

  - CVE-2017-5391：コンテンツのabout: ページは権限のあるabout: ページをロードできます（bmo#1309310、boo#1021835）

  - CVE-2017-5393：mozAddonManagerのホワイトリストからaddons.mozilla.org CDNを削除します（bmo#1309282、boo#1021837）

  - CVE-2017-5387：TRACKタグエラーメッセージによるローカルファイルの存在の漏洩（bmo#1295023、boo#1021839）

  - CVE-2017-5388：WebRTCを使用して、DDOS攻撃のために大量のUDPトラフィックを生成できます（bmo#1281482、boo#1021840）

  - CVE-2017-5374：メモリの安全性に関するバグ（boo#1021841）

  - CVE-2017-5373：メモリの安全性に関するバグ（boo#1021824）

MozillaFirefoxの次のセキュリティ以外の問題が修正されました：

  - FLAC（Free Lossless Audio Codec）再生のサポートを追加しました

  - WebGL 2のサポートを追加しました

  - ジョージア語（ka）およびカビール語（kab）ロケールを追加しました

  -「submit」イベントのないフォームのパスワード保存をサポートします

  - GPUアクセラレーションなしでのユーザーのビデオパフォーマンスを改善しました

  - ズームレベルがデフォルトレベルでない場合に、ズームインジケーターがURLバーに表示されます

  - パスワードを保存する前にプロンプトからパスワードを表示します

  - ベラルーシ語（be）ロケールを削除します

  - コンテンツのレンダリングにSkiaを使用します（Linux）

  - LANGUAGE環境変数の認識を改善します（boo#1017174）

  - 一部のアドオンではマルチプロセスの非互換性が正しく登録されませんでした（bmo#1333423）

Versions of Mozilla Firefox prior to 51 are unpatched for the following vulnerabilities :

 - A flaw exists in JIT code allocation that may allow a context-dependent attacker to bypass the Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) protection mechanisms.
 - A use-after-free error exists in the 'txExecutionState::getVariable()' function in 'dom/xslt/xslt/txExecutionState.cpp' that is triggered when handling XSL in XSLT documents. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the program sharing hashed codes of JavaScript objects between pages. This may allow a context-dependent to gain access to potentially sensitive data by discovering the object's address through a pointer leak.
 - A use-after-free error exists in the 'nsDocument::GetAnimations()' function in 'dom/base/nsDocument.cpp' that is triggered when handling web animations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'PresShell::FlushPendingNotifications()' function in 'layout/base/PresShell.cpp' that is triggered during DOM manipulation of SVG content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is due to the JSON viewer in the Developer Tools insecurely creating communication channels for copying and viewing JSON or HTTP headers. This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data.
 - A flaw exists in the 'mozAddonManager' API that may allow a WebExtension attacker to modify CSP headers. This may allow a context-dependent attacker to use a host request to redirect script load to a malicious site, where it will install additional extensions without the user's consent.
 - A flaw exists in the 'RangeAnalysis::addBetaNodes()' function in 'js/src/jit/RangeAnalysis.cpp' related to improper comparisons being performed when adding beta nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/DOMMediaStream.cpp' that is triggered when handling media stream tracks. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Library::Create()' function in 'js/src/ctypes/Library.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Library::Create()' function in 'js/src/ctypes/Library.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/workers/ServiceWorkerRegistration.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsAttrAndChildArray::GrowBy()' function in 'dom/base/nsAttrAndChildArray.cpp' related to a missing return value check. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AppendUTF16toUTF8()' function in 'xpcom/string/nsReadableUtils.cpp' that is triggered when handling certain size calculations. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'xpcom/string/nsTSubstringTuple.cpp' that is triggered when handling substring tuble lengths. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An integer overflow condition exists in the 'RTCPPacketInformation::AddApplicationData()' function in 'webrtc/modules/rtp_rtcp/source/rtcp_receiver_help.cc' that is triggered when handling RTCP APP packets. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/base/WebSocket.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GetDatabaseFileURL()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered when handling file: URIs. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'gfx/2d/PathRecording.h' that is triggered when handling event recorders. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ICCallStubCompiler::guardFunApply()' function in 'js/src/jit/BaselineIC.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::createThisScriptedSingleton()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AddLazyFunctionsForCompartment()' function in 'js/src/jscompartment.cpp' that is triggered when handling references to a compartment's lazy functions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::DefineTypedArrayElement()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DataViewObject::create()' function in 'js/src/vm/TypedArrayObject.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'IonBuilder::initEnvironmentChain()' function in 'js/src/jit/IonBuilder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the JavaScript JIT compiler that is triggered when handling windows. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDOMConstructor::HasInstance()' function in 'dom/base/nsDOMClassInfo.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocument::SetScriptGlobalObject()' function in 'dom/base/nsDocument.cpp' that is triggered when handling specially crafted media files. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'security/manager/pki/resources/content/pippki.js' that allows traversing outside of a restricted path. The issue is due to the export functions in the certificate viewer not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). This may allow a context-dependent attacker to make changes to the save destination for certificate content.
 - A flaw exists that may allow a remote attacker to use the preview feature for RSS feeds to view potentially sensitive privileged content errors and exceptions.
 - A flaw exists that is triggered during the handling of a specially crafted URL that contains certain unicode glyphs for alternative hyphens and quotes. This may allow a context-dependent attacker to spoof the location bar.
 - A flaw exists that is triggered during the handling of a specially crafted Proxy Auto-Config (PAC) file. This file may potentially specify which JavaScript function is called for URL requests, allowing a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw exists in 'dom/base/nsDocument.cpp' that is triggered as data sent with multipart channels, such as the multipart/x-mixed-replace MIME type, ignores the bypass referrer-policy response header. This may allow a context-dependent attacker to and gain access to sensitive information related to sites using the header.
 - A flaw exists that may allow WebExtension scripts to use the 'data: protocol' to affect pages loaded by other extensions. This may allow a context-dependent attacker to potentially disclose sensitive information or gain elevated privileges related to other extensions.
 - A flaw exists in 'mobile/android/chrome/content/browser.js' that is triggered when handling a series of JavaScript events in fullscreen mode. This may allow a context-dependent attacker to spoof the location bar.
 - A flaw exists that is triggered as certain 'about: pages' used by web content may load other privileged 'about: pages' within an iframe. This may potentially allow a context-dependent attacker to gain elevated privileges.
 - A flaw exists that is triggered as weak proxy objects may have weak references on multiple threads, instead of only one. This may potentially allow a context-dependent attacker to corrupt memory and execute arbitrary code.
 - A flaw exists in 'toolkit/mozapps/extensions/AddonManager.jsm' that is triggered as mozAddonManager allows for extension installation from the CDN for addons.mozilla.org. This may potentially allow a malicious extension to install additional extensions.
 - A flaw exists that is triggered when the location bar of a new page has been scrolled out of view. This may potentially allow a context-dependent attacker to spoof the location bar.
 - A flaw exists in the 'HTMLTrackElement::SetReadyState()' function in 'dom/html/HTMLTrackElement.cpp' that is triggered when handling TRACK tag error messages. This may allow a context-dependent attacker to enumerate the existence of local files.
 - A flaw exists in 'media/mtransport/nr_socket_prsock.cpp' that is triggered when a STUN server is used in conjunction with a saturation of webkitRTCPeerConnection objects, which may in turn produce a high volume of STUN packets. This may allow a remote attacker to generate significant UDP traffic, resulting in an amplification denial-of-service attack. When performed by multiple machines, a distributed denial-of-service (DDoS) attack can be carried out very effectively.

ID	名稱	產品	系列	已發布	已更新	嚴重性
96743	FreeBSD : mozilla -- multiple vulnerabilities (e60169c4-aa86-46b0-8ae2-0d81f683df09)	Nessus	FreeBSD Local Security Checks	2017/1/25	2021/1/4	critical
96940	openSUSE Security Update : MozillaFirefox (openSUSE-2017-187)	Nessus	SuSE Local Security Checks	2017/2/2	2021/1/19	critical
96743	FreeBSD: mozilla -- 複数の脆弱性（e60169c4-aa86-46b0-8ae2-0d81f683df09）	Nessus	FreeBSD Local Security Checks	2017/1/25	2021/1/4	critical
96940	openSUSEセキュリティ更新プログラム：MozillaFirefox（openSUSE-2017-187）	Nessus	SuSE Local Security Checks	2017/2/2	2021/1/19	critical
9927	Mozilla Firefox < 51 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/1/31	2019/3/6	high

偵測

搜尋 Plugin

critical

critical

critical

critical

high