リモートのWindowsホストにインストールされているMozilla Firefox ESRは、52.5.2より前のバージョンです。したがって、コードの実行を許す脆弱性や悪用可能なクラッシュを引き起こす脆弱性など、複数の脆弱性の影響を受けます。

このMozillaFirefoxの52.5.2esrへの更新では、以下の問題を修正します：

  - CVE-2017-7843：プライベートブラウジングモードのWebワーカーが、IndexedDBデータを書き込む可能性があります（boo#1072034、bmo#1410106、MFSA 2017-28）

Firefoxのプライベートブラウジングモードが、データベースに永続的なデータを書き込むことが可能であり、このモードでブラウジングしている場合でも、Webサイトがユーザーを追跡する可能性があることが判明しました。

Debian 7「Wheezy」では、これらの問題はバージョン52.5.2esr-1~deb7u1で修正されました。

お使いのfirefox-esrパッケージのアップグレードをお勧めします。

注: Tenable Network Securityは、前述の記述ブロックを DLA セキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

远程主机受到 GLSA-201802-03 中所述漏洞的影响（Mozilla Firefox：多个漏洞）在 Mozilla Firefox 中发现多个漏洞。如需详细信息，请查看供参考的 CVE 标识符。影响：远程攻击者可诱骗用户查看特制网页，可能导致以进程的权限执行任意代码或拒绝服务情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、欺骗地址栏、执行点击劫持攻击、绕过安全限制和保护机制，或造成其他不明影响。解决方法：目前无任何已知的解决方法。

来自 Red Hat 安全公告 2017:3382： firefox 更新现可用于 Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7。 Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。 Mozilla Firefox 是一款开源网页浏览器。 此更新将 Firefox 升级到版本 52.5.1 ESR。 安全补丁： * 在 Firefox 中发现隐私缺陷。在私人浏览模式下，工作线程可将持久性数据写入 IndexedDB，该数据在退出时不会被清除，并且会在多个会话间持久保存。恶意网站可利用此缺陷绕过私人浏览保护和唯一指纹访客。(CVE-2017-7843) Red Hat 在此感谢 Mozilla 项目报告此问题。上游感谢原始报告者 Konark。

firefox 更新现可用于 Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。Mozilla Firefox 是一款开源网页浏览器。此更新将 Firefox 升级到版本 52.5.1 ESR。安全修复：* 在 Firefox. 中发现隐私缺陷。在私人浏览模式下，工作线程可将持久性数据写入 IndexedDB，该数据在退出时不会被清除，并且会在多个会话间持久保存。恶意网站可利用此缺陷绕过私人浏览保护和唯一指纹访客。(CVE-2017-7843) Red Hat 在此感谢 Mozilla 项目报告此问题。上游感谢原始报告者 Konark。

Versions of Mozilla Firefox earlier than 57 are unpatched for the following vulnerabilities :

 - A race condition exists in 'dom/media/systemservices/MediaParent.cpp' that is triggered when getting deviceId keys. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/proxy/DeadObjectProxy.cpp' that is triggered when handling object proxies. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'xpcom/threads/SystemGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'nr_transport_addr_fmt_ifname_addr_string()' function in 'media/mtransport/third_party/nICEr/src/net/transport_addr.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a stack-based buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GPUProcessHost::OnChannelClosed()' function in 'gfx/ipc/GPUProcessHost.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'gfx/layers/AtomicRefCountedWithFinalize.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NewReactionRecord()' function in 'js/src/builtin/Promise.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'VerifyCMSDetachedSignatureIncludingCertificate()' function in 'security/manager/ssl/nsDataSignatureVerifier.cpp' that is triggered when handling PKCS#7 signedData content. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ContainerLayerComposite::mPrepared()' function in 'gfx/layers/composite/ContainerLayerComposite.cpp' that is triggered when handling layers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MArgumentsLength::computeRange()' function in 'js/src/jit/RangeAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'widget/windows/AudioSession.cpp' that is triggered when handling AudioSession objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when handling WebGL texture images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocShell::~nsDocShell()' function in 'docshell/base/nsDocShell.cpp' that is triggered when notifying observers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'CleanupOSFileConstants()' function in 'dom/system/OSFileConstants.cpp' related to use of uninitialized memory. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ApplicationReputationService::~ApplicationReputationService()' function in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered as certain pointers are not properly cleared. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EnumerableOwnProperties()' function in 'js/src/builtin/Object.cpp' that is triggered when rooting objects. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'CompositorBridgeChild::RecvDidComposite()' function in 'gfx/layers/ipc/CompositorBridgeChild.cpp' that is triggered when handling texture pools. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsViewManager::~nsViewManager()' function in 'view/nsViewManager.cpp' that is triggered as the PresShell object is not properly handled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TLSFilterTransaction::Close()' function in 'netwerk/protocol/http/TunnelUtils.cpp' that is triggered as timers are not properly handled when a transaction is canceled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EventStateManager::DispatchCrossProcessEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling drag events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling properties of adopted nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'PropertyReadNeedsTypeBarrier()' function in 'jit/MIR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A logic flaw exists in the 'IsMarkedBlack()' function in 'js/src/gc/Barrier.cpp' that is triggered during gray marking asserts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that triggered when flushing and resizing the layout, which may cause the PressShell object to be freed while still in use. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as navigations in cross-origin iframes are revealed. Using the Resource Timing API, a context-dependent attacker to gain access to cross-origin URL information.
 - A flaw exists that is triggered as the security wrapper fails to deny access to certain exposed properties using the deprecated exposedProps mechanism on proxy objects. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of the combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave. This combinations do not display properly in punycode. With a specially crafted domain including a dotless version of  'i', a context-dependent attacker can spoof a domain.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of Arabic and Indic vowel marker characters that are combined with Latin characters in a domain name, which can cause the non-latin characters to be eclipsed in the address bar. This may allow a context-dependent attacker to spoof a domain.
 - A flaw exists that is triggered as data: URLs loaded into new tabs do not properly inherit the Content Security Policy (CSP) of the original page. This may allow a context-dependent attacker to bypass protection mechanisms.
 - A flaw exists in the 'nsMixedContentBlocker::AsyncOnChannelRedirect()' function in 'dom/security/nsMixedContentBlocker.cpp' that is triggered as mixed content blocking was not properly applied to resources when being redirected from an HTTPS environment to an HTTP environment. This may allow a context-dependent attacker to bypass restricts and load blocked content on pages.
 - A flaw exists in the 'CurlWrapper::Init()' function in 'toolkit/components/telemetry/pingsender/pingsender_unix_common.cpp' that is triggered as it fails to validate the libcurl library before loading it. This may allow a local attacker to replace libcurl files and gain elevated privileges.
 - A flaw exists in the 'nsContentSink::ProcessMETATag()' function in 'dom/base/nsContentSink.cpp' that is triggered during the handling of <meta> tags in SVG passed via <img> tags. This may allow a context-dependent attacker to set cookies for a page.
 - A flaw exists in 'netwerk/dns/nsIDNService.cpp' that is triggered as Punycode format text is not properly displayed in international domain names when triggered by a sub-domain. This may allow a context-dependent attacker to conduct a limited spoofing attack.
 - A flaw exists in the 'stripUnsafeProtocolOnPaste()' function in 'base/content/browser.js' that is triggered during the handling of control characters before javascript: URLs. This may allow a context-dependent attacker to bypass self-XSS protection mechanisms.
 - A flaw exists in the '_writeItem()' function in 'toolkit/components/places/BookmarkHTMLUtils.jsm' that allows a cross-site scripting (self-XSS) attack. This flaw exists exists because the program does not validate input to exported bookmarks before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in their own browser.
 - A flaw exists that is triggered as the referrer policy is not always honored when handling <link> elements. This may allow a context-dependent attacker to bypass the referrer policy.
 - A flaw exists in the 'PerDocumentStyleDataImpl::visited_styles_enabled()' function in 'servo/components/style/gecko/data.rs'. The issue is triggered when handling the CSS ':visited' selector for a document being used as an SVG image. With a specially crafted web page, a context-dependent attacker disclose visited history information.
 - A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode.
 - An overflow condition exists that is triggered as certain input is not properly validated when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during conditional branches handling out-of-bounds checks. Using a vulnerable code pattern, or a JIT engine or interpreter to generate such a pattern, an attacker can perform a Flush+Reload or Evict+Reload side-channel attack on the cache and disclose parts of the privileged kernel memory.
 - A flaw exists in the fundamental design related to out-of-order process execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached before exceptions are raised for restricted memory access. Using transient instructions in combination with a Flush+Reload side-channel attack a local attacker can disclose parts of the privileged kernel memory.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.

Versions of Mozilla Firefox earlier than 57.0.1 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'PerDocumentStyleDataImpl::visited_styles_enabled()' function in 'servo/components/style/gecko/data.rs'. The issue is triggered when handling the CSS ':visited' selector for a document being used as an SVG image. With a specially crafted web page, a context-dependent attacker disclose visited history information. (CVE-2017-7844)
 - A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode. (CVE-2017-7843)

Versions of Mozilla Firefox ESR earlier than 52.5.2 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode. (CVE-2017-7843)
 - An overflow condition exists that is triggered as certain input is not properly validated when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code. (CVE-2017-7845)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
105212	Mozilla Firefox ESR < 52.5.2の複数の脆弱性	Nessus	Windows	2017/12/13	2018/7/16	high
105246	openSUSEセキュリティ更新プログラム：MozillaFirefox（openSUSE-2017-1366）	Nessus	SuSE Local Security Checks	2017/12/14	2021/1/19	high
105118	Debian DLA-1202-1: firefox-esr セキュリティ更新	Nessus	Debian Local Security Checks	2017/12/11	2021/1/11	high
106884	GLSA-201802-03：Mozilla Firefox：多个漏洞	Nessus	Gentoo Local Security Checks	2018/2/20	2024/1/16	critical
105027	Oracle Linux 6 / 7 : firefox (ELSA-2017-3382)	Nessus	Oracle Linux Local Security Checks	2017/12/6	2021/1/14	high
105060	CentOS 6 / 7 : firefox (CESA-2017:3382)	Nessus	CentOS Local Security Checks	2017/12/7	2021/1/4	high
700322	Mozilla Firefox < 57 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	critical
700323	Mozilla Firefox < 57.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	low
700333	Mozilla Firefox ESR < 52.5.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/11/6	high

検出

プラグインの検索

high

high

high

critical

high

high

critical

low

high