このMozillaFirefoxとmozilla-nssの更新では、次の問題が修正されます：Mozilla Firefox はESR 52.4に更新されました（bsc#1060445）

  - MFSA 2017-22/CVE-2017-7825：OS Xフォントが一部のチベット語とアラビア語のunicode文字をスペースとしてレンダリングする

  - MFSA 2017-22/CVE-2017-7805：ハンドシェイクハッシュを生成するTLS 1.2におけるメモリ解放後使用（Use-After-Free）

  - MFSA 2017-22/ CVE-2017-7819：デザインモードでの画像のサイズ変更中のメモリ解放後使用（Use After Free）

  - MFSA 2017-22/CVE-2017-7818：ARIA配列操作中のメモリ解放後使用（Use After Free）

  - MFSA 2017-22/CVE-2017-7793：Fetch APIでのメモリ解放後使用（Use After Free）

  - MFSA 2017-22/CVE-2017-7824：ANGLEで要素を描画したり検証したりする際のバッファオーバーフロー

  - MFSA 2017-22/CVE-2017-7810：Firefox 56とFirefox ESR 52.4で修正されたメモリ安全性に関するバグ

  - MFSA 2017-22/CVE-2017-7823：CSPサンドボックスディレクティブが固有のオリジンを作成しない

  - MFSA 2017-22/CVE-2017-7814：BlobおよびデータURLがフィッシングおよびマルウェア保護の警告をバイパスします。Mozilla Network Security Services（Mozilla NSS）はセキュリティ修正を受け取りました：

  - MFSA 2017-22/CVE-2017-7805：ハンドシェイクハッシュを生成するTLS 1.2におけるメモリ解放後使用（Use-After-Free）（bsc#1061005、bsc#1060445）

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートホストは、GLSA-201802-03（Mozilla Firefox：複数の脆弱性）で説明されている脆弱性に影響されています。複数の脆弱性がMozilla Firefoxで発見されています。詳細については、記載されているCVE識別番号を参照してください。影響：リモートの攻撃者が、ユーザーを誘導して特別に細工されたWebページを表示させる可能性があります。その結果、プロセスの権限で任意のコードが実行されたり、サービス拒否状態が引き起こされたりする可能性があります。さらに、リモートの攻撃者が、中間者攻撃を実行し、機密情報を取得し、アドレスバーを偽装し、クリックジャッキング攻撃を実施し、セキュリティ制限および保護メカニズムをバイパスし、その他の特定されていない影響を及ぼすことがあります。回避策：現時点では、既知の回避策はありません。

安全修复：- 使用客户端身份验证时，在 NSS 库的 TLS 1.2 实现中发现释放后使用缺陷。恶意客户端可利用此缺陷，导致针对 NSS 编译的应用程序崩溃，或者可能以运行该应用程序的用户权限执行任意代码。(CVE-2017-7805)

在 Firefox 中发现多个安全问题。如果用户受到诱骗打开特制的网站，攻击者可能利用这些漏洞读取未初始化内存、获取敏感信息、绕过钓鱼和恶意软件保护、伪造模态对话起源、执行跨站脚本 (XSS) 攻击、通过应用程序崩溃造成拒绝服务，或者执行任意代码。（CVE-2017-7793、CVE-2017-7810、CVE-2017-7811、CVE-2017-7812、CVE-2017-7813、CVE-2017-7814、CVE-2017-7815、CVE-2017-7818、CVE-2017-7819、CVE-2017-7820、CVE-2017-7822、CVE-2017-7823、CVE-2017-7824）

Martin Thomson 发现 NSS 未能正确生成握手哈希。远程攻击者可能利用此缺陷，通过应用程序崩溃造成拒绝服务或是执行任意代码。
(CVE-2017-7805)

在 WebExtensions 中发现多个安全问题。如果用户受到诱骗安装特制扩展，攻击者可能利用这些问题在不需要互动时下载和打开非可执行文件，或获取权限提升。（CVE-2017-7816、CVE-2017-7821）

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox ESR 版本低于 52.4。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可遭利用的崩溃。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 56。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可遭利用的应用程序崩溃。

Martin Thomson 发现 Mozilla 网络安全服务库 nss 在生成握手哈希值时，TLS 1.2 实现中容易出现释放后使用漏洞。远程攻击者可利用此缺陷导致使用 nss 库的应用程序崩溃，从而造成拒绝服务，或可能执行任意代码。

已在 Mozilla Thunderbird 邮件客户端中发现多个安全问题：多个内存安全错误、缓冲区溢出和其他实现错误可能导致崩溃或执行任意代码。经过此更新，源程序包名称从 icedove 更改为 thunderbird，因此以后的公告将不再提及 icedove。对于 Debian 7“Wheezy”，这些问题已在 1:52.4.0-1~deb7u1 版本中修复。我们建议您升级 thunderbird 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

已在 Thunderbird 中发现多个安全问题，可导致任意代码执行或拒绝服务。

远程主机受到 GLSA-201802-03 中所述漏洞的影响（Mozilla Firefox：多个漏洞）在 Mozilla Firefox 中发现多个漏洞。如需详细信息，请查看供参考的 CVE 标识符。影响：远程攻击者可诱骗用户查看特制网页，可能导致以进程的权限执行任意代码或拒绝服务情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、欺骗地址栏、执行点击劫持攻击、绕过安全限制和保护机制，或造成其他不明影响。解决方法：目前无任何已知的解决方法。

Versions of Mozilla Firefox earlier than 56 are unpatched for the following vulnerabilities :

 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'js::AddPropertyTypesAfterProtoChange()' function in 'js/src/vm/NativeObject.cpp' that is triggered when handling the 'unknown-properties' flag. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'layout/style/nsCSSPseudoElements.cpp' that is triggered when handling pseudo-element atoms. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'dom/base/nsDocument.cpp' that is triggered when handling intersection observers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'LayerTransactionParent::Destroy()' function in 'gfx/layers/ipc/LayerTransactionParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'FPSCounter::PrintHistogram()' function in 'gfx/layers/composite/FPSCounter.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'FlagAllOperandsAsHavingRemovedUses()' function in 'js/src/jit/IonAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'memory/mozjemalloc/mozjemalloc.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ReadCompressedIndexDataValuesFromBlob()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'js/src/vm/StructuredClone.cpp' that is triggered when handling structured clone reads. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling root elements in the editor. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/GraphDriver.cpp' that is triggered when handling errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'hnj_hyphen_hyphword()' function in 'hyphen.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code within a process linked against the library.
 - A flaw exists in the 'EditorBase::FinalizeSelection()' function in 'editor/libeditor/EditorBase.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A use-after-free condition exists in the Fetch API related to missing thread safety. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when pages enter fullscreen mode without user notification. This allows a context-dependent attacker to spoof the address bar.
 - A use-after-free error exists in 'accessible/generic/DocAccessible.cpp' that is triggered when manipulating Accessible Rich Internet Applications (ARIA) elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in design mode that is triggered when objects are resized. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'ssl3_HandleCertificateVerify()' function in 'lib/ssl/ssl3con.c' that is triggered when handling handshake hashes during TLS '1.2' exchanges. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as the content principal is not properly checked when handling drag and drop actions onto the browser UI. With specially crafted web content including file: URLs, a context-dependent attacker can open local files.
 - A flaw exists in the PendingLookup class in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered when handling downloads encoded with data: and blob: URL elements. This may allow a context-dependent attacker to bypass the phishing and malware protection feature.
 - An integer truncation flaw exists in the JavaScript parser that may allow a context-dependent attacker to potentially disclose memory contents.
 - A flaw exists in the 'MacOSFontEntry::ReadCMAP()' function in 'gfx/thebes/gfxMacPlatformFontList.mm' that is triggered as certain tibetan and arabic unicode characters are displayed as whitespace in combination with macOS fonts. With a specially crafted IDN domain, a context-dependent attacker can spoof a valid URL and conduct phishing attacks.
 - A flaw exists that is triggered when creating a modal dialog using the data: protocol via JavaScript. With a specially crafted web page, a context-dependent attacker can spoof the origin of the modal dialog.
 - A flaw exists in the WebExtensions component that is triggered when handling popups and panels in the extension UI. This may allow a context-dependent attacker to load an 'about:' URL.
 - A flaw exists in the WebExtensions component that is triggered when handling file downloads. This may allow a context-dependent attacker to download and open files without user interaction.
 - A flaw exists in the 'nsDocument::InitCSP()' function in 'dom/base/nsDocument.cpp' that is triggered as the sandbox directive does not create unique origin. This may result in incorrect enforcement of the content security policy (CSP).
 - A flaw exists in the WebCrypto API that is triggered as the AES-GCM implementation allows a zero-length IV. This may allow a context-dependent attacker to determine the authentication key.
 - A flaw exists that is is triggered as results of the 'instanceof' operator can be manipulated. With specially crafted web content, a context-dependent attacker can bypass the Xray wrapper mechanism.
 - An unspecified flaw exists that is triggered when drawing and validating elements with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.

Versions of Mozilla Firefox ESR earlier than 52.4 are unpatched for the following vulnerabilities :

 - A flaw exists in 'js/src/vm/StructuredClone.cpp' that is triggered when handling structured clone reads. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling root elements in the editor. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/GraphDriver.cpp' that is triggered when handling errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'hnj_hyphen_hyphword()' function in 'hyphen.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code within a process linked against the library.
 - A flaw exists in the 'EditorBase::FinalizeSelection()' function in 'editor/libeditor/EditorBase.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free condition exists in the Fetch API related to missing thread safety. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'accessible/generic/DocAccessible.cpp' that is triggered when manipulating Accessible Rich Internet Applications (ARIA) elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in design mode that is triggered when objects are resized. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'ssl3_HandleCertificateVerify()' function in 'lib/ssl/ssl3con.c' that is triggered when handling handshake hashes during TLS '1.2' exchanges. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the PendingLookup class in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered when handling downloads encoded with data: and blob: URL elements. This may allow a context-dependent attacker to bypass the phishing and malware protection feature.
 - A flaw exists in the 'MacOSFontEntry::ReadCMAP()' function in 'gfx/thebes/gfxMacPlatformFontList.mm' that is triggered as certain tibetan and arabic unicode characters are displayed as whitespace in combination with macOS fonts. With a specially crafted IDN domain, a context-dependent attacker can spoof a valid URL and conduct phishing attacks.
 - A flaw exists in the 'nsDocument::InitCSP()' function in 'dom/base/nsDocument.cpp' that is triggered as the sandbox directive does not create unique origin. This may result in incorrect enforcement of the content security policy (CSP).
 - An unspecified flaw exists that is triggered when drawing and validating elements with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
104542	SUSE SLES11セキュリティ更新プログラム：MozillaFirefox、mozilla-nss（SUSE-SU-2017:2872-2）	Nessus	SuSE Local Security Checks	2017/11/14	2021/1/19	critical
106884	GLSA-201802-03：Mozilla Firefox：複数の脆弱性	Nessus	Gentoo Local Security Checks	2018/2/20	2024/1/16	critical
103595	Scientific Linux 安全更新：SL6.x、SL7.x i386/x86_64 中的 nss	Nessus	Scientific Linux Local Security Checks	2017/10/2	2021/1/14	high
103646	Ubuntu 14.04 LTS / 16.04 LTS：Firefox 漏洞 (USN-3435-1)	Nessus	Ubuntu Local Security Checks	2017/10/3	2024/8/27	critical
103677	Mozilla Firefox ESR < 52.4 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/10/6	2019/11/12	critical
103678	Mozilla Firefox < 56 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/10/6	2019/11/12	critical
103794	Debian DSA-3998-1：nss - 安全更新	Nessus	Debian Local Security Checks	2017/10/12	2021/1/4	high
104335	Debian DLA-1153-1：icedove/thunderbird 安全更新	Nessus	Debian Local Security Checks	2017/11/2	2021/1/11	critical
104340	Debian DSA-4014-1：thunderbird - 安全更新	Nessus	Debian Local Security Checks	2017/11/2	2021/1/4	critical
106884	GLSA-201802-03：Mozilla Firefox：多个漏洞	Nessus	Gentoo Local Security Checks	2018/2/20	2024/1/16	critical
700321	Mozilla Firefox < 56 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	high
700331	Mozilla Firefox ESR < 52.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/11/6	high

検出

プラグインの検索

critical

critical

high

critical

critical

critical

high

critical

critical

critical

high

high