この更新プログラムで、Firefoxをバージョン52.1.0 ESRにアップグレードします。

セキュリティ修正プログラム:

  - 無効な形式の Web コンテンツの処理で、複数の欠陥が見つかりました。悪意のあるコンテンツを含むWebページが、Firefoxをクラッシュさせたり、Firefoxを実行しているユーザーの権限で任意のコードを実行したりする可能性があります。(CVE-2017-5429、CVE-2017-5432、CVE-2017-5433、CVE-2017-5434、CVE-2017-5435、CVE-2017-5436、CVE-2017-5438、CVE-2017-5439、CVE-2017-5440、CVE-2017-5441、CVE-2017-5442、CVE-2017-5443、CVE-2017-5444、CVE-2017-5445、CVE-2017-5446、CVE-2017-5447、CVE-2017-5448、CVE-2017-5449、CVE-2017-5459、CVE-2017-5460、CVE-2017-5464、CVE-2017-5465、CVE-2017-5469)

この更新プログラムで、Firefoxをバージョン52.1.0 ESRにアップグレードします。

セキュリティ修正プログラム:

  - 無効な形式の Web コンテンツの処理で、複数の欠陥が見つかりました。悪意のあるコンテンツを含むWebページが、Firefoxをクラッシュさせたり、Firefoxを実行しているユーザーの権限で任意のコードを実行したりする可能性があります。(CVE-2017-5429、CVE-2017-5430、CVE-2017-5432、CVE-2017-5433、CVE-2017-5434、CVE-2017-5435、CVE-2017-5436、CVE-2017-5438、CVE-2017-5439、CVE-2017-5440、CVE-2017-5441、CVE-2017-5442、CVE-2017-5443、CVE-2017-5444、CVE-2017-5445、CVE-2017-5446、CVE-2017-5447、CVE-2017-5448、CVE-2017-5449、CVE-2017-5451、CVE-2017-5454、CVE-2017-5455、CVE-2017-5456、CVE-2017-5459、CVE-2017-5460、CVE-2017-5464、CVE-2017-5465、CVE-2017-5466、CVE-2017-5467、CVE-2017-5469)

The version of Mozilla Thunderbird installed on the remote Windows host is prior to 52.1 It is, therefore, affected by multiple vulnerabilities :

  - Multiple flaws exist in the Libevent library, within files evdns.c and evutil.c, due to improper validation of input when handling IP address strings, empty base name strings, and DNS packets. 認証されていないリモートの攻撃者がこれらを悪用し、サービス拒否状態を引き起こしたり、任意のコードを実行する可能性があります。
    (CVE-2016-10195, CVE-2016-10196, CVE-2016-10197)

  - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-5429, CVE-2017-5430)

  - A use-after-free error exists in input text selection that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-5432)

  - A use-after-free error exists in the SMIL animation functions when handling animation elements. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5433)

  - A use-after-free error exists when redirecting focus handling that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-5434)

  - A use-after-free error exists in design mode interactions when handling transaction processing in the editor. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5435)

  - An out-of-bounds write error exists in the Graphite 2 library when handling specially crafted Graphite fonts.
    認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5436)

  - A use-after-free error exists in the nsAutoPtr() function during XSLT processing due to the result handler being held by a freed handler. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5438)

  - A use-after-free error exists in the Length() function in nsTArray when handling template parameters during XSLT processing. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5439)

  - A use-after-free error exists in the txExecutionState destructor when processing XSLT content. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5440)

  - A use-after-free error exists when holding a selection during scroll events. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。
    (CVE-2017-5441)

  - A use-after-free error exists when changing styles in DOM elements that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-5442)

  - An out-of-bounds write error exists while decoding improperly formed BinHex format archives that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code.
    (CVE-2017-5443)

  - A buffer overflow condition exists while parsing application/http-index-format format content due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via improperly formatted data, to disclose out-of-bounds memory content. (CVE-2017-5444)

  - A flaw exists in nsDirIndexParser.cpp when parsing application/http-index-format format content in which uninitialized values are used to create an array. 認証されていないリモートの攻撃者がこれを悪用し、メモリコンテンツを漏洩させる可能性があります。（CVE-2017-5445）

  - An out-of-bounds read error exists when handling HTTP/2 DATA connections to a server that sends DATA frames with incorrect content. An unauthenticated, remote attacker can exploit to cause a denial of service condition or the disclosure of memory contents. (CVE-2017-5446)

  - An out-of-bounds read error exists when processing glyph widths during text layout. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態またはメモリコンテンツの漏洩を引き起こす可能性があります。
    (CVE-2017-5447)

  - A flaw exists when handling bidirectional Unicode text in conjunction with CSS animations that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution or arbitrary code.
    (CVE-2017-5449)

  - A flaw exists in the handling of specially crafted 'onblur' events. An unauthenticated, remote attacker can exploit this, via a specially crafted event, to spoof the address bar, making the loaded site appear to be different from the one actually loaded. (CVE-2017-5451)

  - A flaw exists in the FileSystemSecurity: : Forget() function within file FileSystemSecurity.cpp when using the File Picker due to improper sanitization of input containing path traversal sequences. An unauthenticated, remote attacker can exploit this to bypass file system access protections in the sandbox and read arbitrary files on the local file system. (CVE-2017-5454)

  - A buffer overflow condition exists in WebGL when handling web content due to improper validation of certain input. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5459)

  - A use-after-free error exists in frame selection when handling a specially crafted combination of script content and key presses by the user. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。
    (CVE-2017-5460)

  - An out-of-bounds write error exists in the Network Security Services (NSS) library during Base64 decoding operations due to insufficient memory being allocated to a buffer. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5461)

  - A flaw exists in the Network Security Services (NSS) library during DRBG number generation due to the internal state V not correctly carrying bits over. 認証されていないリモートの攻撃者がこの脆弱性を悪用し、予測可能な乱数生成を引き起こす可能性があります。
    (CVE-2017-5462)

  - A flaw exists when making changes to DOM content in the accessibility tree due to improper validation of certain input, which can lead to the DOM tree becoming out of sync with the accessibility tree. An unauthenticated, remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2017-5464)

  - An out-of-bounds read error exists in ConvolvePixel when processing SVG content, which allows for otherwise inaccessible memory being copied into SVG graphic content. 認証されていないリモートの攻撃者がこれを悪用して、メモリコンテンツの漏洩、またはサービス拒否状態を引き起こす可能性があります。 (CVE-2017-5465)

  - A cross-site scripting (XSS) vulnerability exists due to improper handling of data: text/html URL redirects when a reload is triggered, which causes the reloaded data: text/html page to have its origin set incorrectly.
    認証されていないリモートの攻撃者がこれを悪用し、特別に細工されたリクエストを介してユーザーのブラウザセッションで任意のスクリプトコードを実行する可能性があります。 (CVE-2017-5466)

  - A memory corruption issue exists when rendering Skia content outside of the bounds of a clipping region due to improper validation of certain input. 認証されていないリモートの攻撃者がこれを悪用し、サービス拒否状態または任意のコードの実行を引き起こす可能性があります。 (CVE-2017-5467)

  - A buffer overflow condition exists in the FLEX generated code due to improper validation of user-supplied input.
    認証されていないリモート攻撃者がこの脆弱性を悪用し、任意のコードを実行する可能性があります。 (CVE-2017-5469)

thunderbirdの更新プログラムが、Red Hat Enterprise Linux 6とRed Hat Enterprise Linux 7で利用可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度高と評価しています。詳細な重要度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。Mozilla Thunderbirdはスタンドアロンのメールおよびニュースグループクライアントです。この更新プログラムで、Thunderbirdをバージョン52.1.0にアップグレードします。セキュリティ修正プログラム：* 不正な形式のWebコンテンツの処理に、複数の欠陥が見つかりました。悪意あるコンテンツを含むWebページにより、Thunderbirdをクラッシュさせたり、Thunderbirdを実行しているユーザーの権限で任意のコードが実行されたりする可能性があります。（CVE-2017-5429、CVE-2017-5433、CVE-2017-5435、CVE-2017-5436、CVE-2017-5459、CVE-2017-5466、CVE-2017-5432、CVE-2017-5434、CVE-2017-5438、CVE-2017-5439、CVE-2017-5440、CVE-2017-5441、CVE-2017-5442、CVE-2017-5443、CVE-2017-5444、CVE-2017-5446、CVE-2017-5447、CVE-2017-5454、CVE-2017-5460、CVE-2017-5464、CVE-2017-5465、CVE-2017-5469、CVE-2016-10195、CVE-2016-10196、CVE-2017-5445、CVE-2017-5449、CVE-2017-5451、CVE-2017-5467、CVE-2016-10197）Red Hatは、これらの問題を報告してくれたMozillaプロジェクトに感謝の意を表します。アップストリームは、Petr Cerny氏、Nils氏、Ivan Fratric氏（Google Project Zero）、Takeshi Terada氏、Heather Miller氏（Google Skia team）、Chun Han Hsiao氏、Chamal De Silva氏、Nicolas Gregoire氏、Holger Fuhrmannek氏、Atte Kettunen氏、Haik Aftandilian氏、Jordi Chancel氏を最初の報告者として認めています。

Thunderbirdで複数のセキュリティの問題が発見されました。ユーザーが誘導されて特別に細工されたWebサイトを開くと、攻撃者がこれらを悪用して、初期化されていないメモリを読み取る、アプリケーションをクラッシュさせてサービス拒否を引き起こす、任意のコードを実行するなどの可能性があります。
(CVE-2017-5429、CVE-2017-5430、CVE-2017-5436、CVE-2017-5443、CVE-2017-5444、CVE-2017-5445、CVE-2017-5446、CVE-2017-5447、CVE-2017-5461、CVE-2017-5467) 

Thunderbirdで複数のセキュリティの問題が発見されました。ユーザーが誘導されて、参照コンテキストで特別に細工されたWebサイトを開くと、攻撃者がこれを悪用し、アドレスバーのコンテンツを偽装する、クロスサイトスクリプティング攻撃を仕掛ける、アプリケーションをクラッシュさせてサービス拒否を引き起こす、任意のコードを実行するなどの可能性があります。
(CVE-2017-5432、CVE-2017-5433、CVE-2017-5434、CVE-2017-5435、CVE-2017-5437、CVE-2017-5438、CVE-2017-5439、CVE-2017-5440、CVE-2017-5441、CVE-2017-5442、CVE-2017-5449、CVE-2017-5451、CVE-2017-5454、CVE-2017-5459、CVE-2017-5460、CVE-2017-5464、CVE-2017-5465、CVE-2017-5466、CVE-2017-5469、CVE-2017-10195、CVE-2017-10196、CVE-2017-10197)

NSS の DRBG 番号生成で欠陥が発見されました。中間者攻撃を実行できる攻撃者がこの欠陥を悪用して、秘密情報を漏えいさせる可能性があります。
(CVE-2017-5462)。

注意: Tenable Network Security は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Versions of Mozilla Firefox prior to 53 are unpatched for the following vulnerabilities :

 - A use-after-free error exists that is related to certain text input selections. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5432)
 - A use-after-free error exists in the SMIL animation functions. The issue is triggered when handling animation elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5433)
 - A use-after-free error exists that is triggered when redirecting focus handling. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5434)
 - A use-after-free error exists that is triggered when processing transactions in the editor during design mode interactions. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5435)
 - A use-after-free error exists in the 'nsAutoPtr()' function that is triggered during XSLT processing. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5438)
 - A use-after-free error exists in the 'Length()' function in 'nsTArray' that is triggered when handling template parameters during XSLT processing. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5439)
 - A use-after-free error exists in the 'txExecutionState' destructor that is triggered during the processing of XSLT content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5440)
 - A use-after-free error exists that is triggered when holding a selection during scroll events. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5441)
 - A use-after-free error exists that is triggered when changing styles in DOM elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5442)
 - An out-of-bounds write flaw exists that is triggered during the decoding of improperly formed BinHex format archives. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2017-5443)
 - An overflow condition exists that is triggered as certain input is not properly validated when parsing 'application/http-index-format' content. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2017-5444)
 - A flaw exists in 'nsDirIndexParser.cpp' related to the use of uninitialized data. The issue is triggered when parsing 'application/http-index-format' content. This may allow a context-dependent attacker to disclose memory contents. (CVE-2017-5445)
 - An out-of-bounds read flaw exists that is triggered when handling HTTP/2 DATA connections that send DATA frames with incorrect data content. This may allow a context-dependent attacker to potentially disclose memory contents. (CVE-2017-5446)
 - An out-of-bounds read flaw exists that is triggered when processing glyph widths during text layouts. This may allow a context-dependent attacker to potentially disclose memory contents. (CVE-2017-5447)
 - An out-of-bounds write flaw exists in the 'ClearKeyDecryptor::Decrypt()' function in 'ClearKeyDecryptionManager.cpp' that is triggered when decrypting Clearkey-encrypted media content. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2017-5448)
 - A flaw exists that is triggered during the handling of bidirectional unicode text with CSS animations. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2017-5449)
 - A flaw exists that is triggered during the parsing of base domains that contain 'javascript: URI'. This may allow a context-dependent attacker to spoof a valid address bar. (CVE-2017-5450)
 - A flaw exists that is triggered during the handling of a specially crafted 'onblur' event. This may allow a context-dependent attacker to spoof a valid address bar. (CVE-2017-5451)
 - A flaw exists that is triggered when selecting an HTML editable page element while the existing location bar has been scrolled out of view. This may allow a context-dependent attacker to spoof a valid address bar. (CVE-2017-5452)
 - A flaw exists in the RSS reader preview page that is triggered as input supplied via URL parameters is not properly sanitized. This may allow a context-dependent attacker to spoof the 'TITLE' element. (CVE-2017-5453)
 - A flaw exists in the 'FileSystemSecurity::Forget()' function in 'FileSystemSecurity.cpp'. The issue is triggered as input containing path traversal style sequences (e.g. '../') is not properly sanitized when using the File Picker. This may allow a context-dependent attacker to bypass file system access protections and read arbitrary files from the local file system. (CVE-2017-5454)
 - An unspecified flaw exists in the internal feed reader APIs that is triggered when handling messages. This may allow a context-dependent attacker to bypass the sandbox. (CVE-2017-5455)
 - A flaw exists in the Entries API that is triggered when using a file system request constructor through an IPC message. This may allow a context-dependent attacker to bypass the file system access protections and gain read and write access to the local file system. (CVE-2017-5456)
 - A flaw exists that allows a reflected XSS attack. This flaw exists because the program does not validate input when dragging and dropping a 'javascript: URL' into the address bar. This may allow a context-dependent attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2017-5458)
 - An overflow condition exists in WebGL. The issue is triggered as certain input is not properly validated when handling web content. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2017-5459)
 - A use-after-free error exists in frame selection that is triggered when handling a combination of malicious script content and key presses. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-5460)
 - An overflow condition exists in Base64 decoding. The issue is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2017-5461)
 - A flaw exists in the DRBG number generation that is triggered as internal state V does not correctly carry bits over. This may result in potentially predictable random number generation. (CVE-2017-5462)
 - A flaw exists that is triggered during the handling of a specially crafted URL with android intents. This may allow a context-dependent attacker to spoof a valid address bar. (CVE-2017-5463)
 - A flaw exists that is triggered as certain input is not properly validated when making changes to DOM content in the accessibility tree. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2017-5464)
 - An out-of-bounds read flaw exists in 'ConvolvePixel' that is triggered when processing specially crafted SVG content. This may allow a context-dependent attacker to potentially disclose memory contents. (CVE-2017-5465)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the program does not validate input when handling 'data:text/html' URL redirects before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2017-5466)
 - A flaw exists that is triggered as certain input is not properly validated when rendering Skia content outside of the bounds of a clipping region. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2017-5467)
 - A flaw exists in developer tools that is triggered as ownership models are incorrectly applied. This may allow a context-dependent attacker to cause a crash. (CVE-2017-5468)
 - Multiple overflow conditions exist in the FLEX generated code. The issue is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2017-5469)
 - Multiple unspecified flaws exist that are triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2017-5429 ,CVE-2017-5430)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
99576	Scientific Linux セキュリティ更新: SL6.x i386/x86_64のfirefox（20170420）	Nessus	Scientific Linux Local Security Checks	2017/4/21	2024/1/16	critical
99619	Scientific Linux セキュリティ更新: SL7.x x86_64のfirefox（20170420）	Nessus	Scientific Linux Local Security Checks	2017/4/24	2024/1/16	critical
99968	Mozilla Thunderbird < 52.1 の複数の脆弱性	Nessus	Windows	2017/5/3	2019/11/13	critical
100021	RHEL 6/7：thunderbird（RHSA-2017:1201）	Nessus	Red Hat Local Security Checks	2017/5/8	2020/5/29	critical
100065	CentOS 6/7：Thunderbird（CESA-2017:1201）	Nessus	CentOS Local Security Checks	2017/5/10	2021/1/4	critical
100249	Ubuntu 14.04LTS / 16.04LTS: Thunderbird の脆弱性 (USN-3278-1)	Nessus	Ubuntu Local Security Checks	2017/5/17	2023/10/20	critical
700065	Mozilla Firefox < 53 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2017/4/21	2019/3/6	high

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

high