Уязвимость библиотеки парсинга Expat, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость набора библиотек Network Security Services и браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие

Уязвимость браузера Firefox, позволяющая нарушителю провести XSS-атаки

Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к полному списку отключенных плагинов

Уязвимость браузеров Firefox ESR и Firefox, позволяющая нарушителю вызвать отказ в обслуживании, провести кликджекинг или спуфинг-атаку

Уязвимость браузера Firefox, позволяющая нарушителю повлиять на целостность информации

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю обойти существующую политику ограничения доступа и изменить свойство location.host

Уязвимость браузера Firefox, позволяющая нарушителю проводить спуфинг-атаки

Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к локальным файлам

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти существующую политику ограничения доступа или читать произвольные файлы

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю изменять произвольные файлы

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю подменить адресную строку

Уязвимость браузера Firefox, позволяющая нарушителю получить информацию о последних посещенных страницах

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c использованием памяти после освобождения при обработке транзакций в редакторе, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции nsTArray Length() браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции txExecutionState браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код

Уязвимость функции evutil_parse_sockaddr_port (evutil.c) библиотеки асинхронного уведомления событий Libevent, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость реализации метода nsDirIndexParser::ParseData (netwerk\streamconv\converters\nsDirIndexParser.cpp) браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю получить доступ к защищаемой информации

Уязвимость реализации технологии HTTP/2 браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость механизма подмены адресной строки через взаимодействие пользователя с адресной строкой и событием «onblur» браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю проводить спуфинг-атаки

Уязвимость функции PFileSystemRequestConstructor браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c обходом защиты доступа к файловой системе в песочнице, позволяющая нарушителю получить доступ к защищаемой информации

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c непринятием мер по защите структуры веб-страницы, позволяющая нарушителю нарушителю проводить межсайтовые сценарные атаки

Уязвимость графической библиотеки Skia браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c выходом операции за границы буфера в памяти при манипуляции с деревом доступа DOM, позволяющая нарушителю выполнить произвольный код

Уязвимость класса DOMSVGLength браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код

Уязвимость функции mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю подделывать обновления надстроек

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element.

Use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when contenteditable mode is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering deletion of DOM elements that were created in the editor.

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu.

Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL.

The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a Content Security Policy (CSP) referrer directive with zero values.

Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.

Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demonstrated by the microphone permission or the geolocation permission.

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses.

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site.

Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes.

Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java applets, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted applet.

Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors.

Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.

Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document.

Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls.

Mozilla Firefox before 48.0 allows remote attackers to spoof the location bar via crafted characters in the media type of a data: URL.

Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations.

The Updater in Mozilla Firefox before 48.0 on Windows allows local users to write to arbitrary files via vectors involving the callback application-path parameter and a hard link.

Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items.

Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript that is mishandled during incremental garbage collection.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.

Mozilla Firefox before 48.0 mishandles changes from 'INPUT type="password"' to 'INPUT type="text"' within a single Session Manager session, which might allow attackers to discover cleartext passwords by reading a session restoration file.

Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.

The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion."

Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.

Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTransfer) actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site.

Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring.

Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion.

The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via text runs in conjunction with a "display: contents" Cascading Style Sheets (CSS) property.

The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site.

The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site.

Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.

Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code by leveraging improper interaction between empty filters and CANVAS element rendering.

Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute.

Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.

Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.

Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code.

Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.

Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource.

Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.

A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox < 49.0.2.

Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.

Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.

A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.

A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.

A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox < 50.

Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history. This vulnerability affects Firefox < 50.

WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affects Firefox < 50.

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 50.

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox < 50.

Severity: MEDIUM (5.9) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

• 94337
• 94337
• 1037298
• 1037298
• https://bugzilla.mozilla.org/show_bug.cgi?id=1276976
• https://bugzilla.mozilla.org/show_bug.cgi?id=1276976
• https://www.mozilla.org/security/advisories/mfsa2016-89/
• https://www.mozilla.org/security/advisories/mfsa2016-89/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9077

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox < 50.

Severity: HIGH (7.0) Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

• 94337
• 94337
• 1037298
• 1037298
• https://bugzilla.mozilla.org/show_bug.cgi?id=1298552
• https://bugzilla.mozilla.org/show_bug.cgi?id=1298552
• https://www.mozilla.org/security/advisories/mfsa2016-89/
• https://www.mozilla.org/security/advisories/mfsa2016-89/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9080

Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 94883
• 94883
• 1037461
• 1037461
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1289701%2C1314401%2C1315848
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1289701%2C1314401%2C1315848
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9893

Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2016:2946
• RHSA-2016:2946
• RHSA-2016:2973
• RHSA-2016:2973
• 94885
• 94885
• 1037461
• 1037461
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1319524%2C1298773%2C1299098%2C1309834%2C1312609%2C1313212%2C1317805%2C1312548%2C1315631%2C1287912
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1319524%2C1298773%2C1299098%2C1309834%2C1312609%2C1313212%2C1317805%2C1312548%2C1315631%2C1287912
• GLSA-201701-15
• GLSA-201701-15
• DSA-3757
• DSA-3757
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-96/
• https://www.mozilla.org/security/advisories/mfsa2016-96/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9894

A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.1.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 94883
• 94883
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1306628
• https://bugzilla.mozilla.org/show_bug.cgi?id=1306628
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9895

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

• RHSA-2016:2946
• RHSA-2016:2946
• RHSA-2016:2973
• RHSA-2016:2973
• 94885
• 94885
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1312272
• https://bugzilla.mozilla.org/show_bug.cgi?id=1312272
• GLSA-201701-15
• GLSA-201701-15
• DSA-3757
• DSA-3757
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-96/
• https://www.mozilla.org/security/advisories/mfsa2016-96/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9896

Use-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not currently enabled by default. This vulnerability affects Firefox < 50.1.

Severity: HIGH (8.1) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 94883
• 94883
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1315543
• https://bugzilla.mozilla.org/show_bug.cgi?id=1315543
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9897

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• RHSA-2016:2946
• RHSA-2016:2946
• 94885
• 94885
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1301381
• https://bugzilla.mozilla.org/show_bug.cgi?id=1301381
• GLSA-201701-15
• GLSA-201701-15
• DSA-3757
• DSA-3757
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-96/
• https://www.mozilla.org/security/advisories/mfsa2016-96/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9898

Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2016:2946
• RHSA-2016:2946
• 94885
• 94885
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1314442
• https://bugzilla.mozilla.org/show_bug.cgi?id=1314442
• GLSA-201701-15
• GLSA-201701-15
• DSA-3757
• DSA-3757
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-96/
• https://www.mozilla.org/security/advisories/mfsa2016-96/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9900

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• RHSA-2016:2946
• RHSA-2016:2946
• RHSA-2016:2973
• RHSA-2016:2973
• 94885
• 94885
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1319122
• https://bugzilla.mozilla.org/show_bug.cgi?id=1319122
• GLSA-201701-15
• GLSA-201701-15
• DSA-3757
• DSA-3757
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-96/
• https://www.mozilla.org/security/advisories/mfsa2016-96/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2016:2946
• RHSA-2016:2946
• RHSA-2016:2973
• RHSA-2016:2973
• 94885
• 94885
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1320057
• https://bugzilla.mozilla.org/show_bug.cgi?id=1320057
• GLSA-201701-15
• GLSA-201701-15
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-95/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

• RHSA-2016:2946
• RHSA-2016:2946
• RHSA-2016:2973
• RHSA-2016:2973
• 94885
• 94885
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1320039
• https://bugzilla.mozilla.org/show_bug.cgi?id=1320039
• GLSA-201701-15
• GLSA-201701-15
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-95/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9903

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox < 50.1.

Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

• 94883
• 94883
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1315435
• https://bugzilla.mozilla.org/show_bug.cgi?id=1315435
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2016-9904

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• RHSA-2016:2946
• RHSA-2016:2946
• 94885
• 94885
• 1037461
• 1037461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1317936
• https://bugzilla.mozilla.org/show_bug.cgi?id=1317936
• GLSA-201701-15
• GLSA-201701-15
• DSA-3757
• DSA-3757
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-94/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-95/
• https://www.mozilla.org/security/advisories/mfsa2016-96/
• https://www.mozilla.org/security/advisories/mfsa2016-96/

Published: 2017-04-25
Modified: 2024-11-21

CVE-2017-5031

A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0499
• RHSA-2017:0499
• DSA-3810
• DSA-3810
• 96767
• 96767
• 98326
• 98326
• https://bugzilla.mozilla.org/show_bug.cgi?id=1328762
• https://bugzilla.mozilla.org/show_bug.cgi?id=1328762
• https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
• https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
• https://crbug.com/682020
• https://crbug.com/682020
• GLSA-201704-02
• GLSA-201704-02
• https://www.mozilla.org/security/advisories/mfsa2017-14/
• https://www.mozilla.org/security/advisories/mfsa2017-14/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5373

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0190
• RHSA-2017:0190
• RHSA-2017:0238
• RHSA-2017:0238
• 95762
• 95762
• 1037693
• 1037693
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1322315%2C1328834%2C1322420%2C1285833%2C1285960%2C1328251%2C1331058%2C1325938%2C1325877
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1322315%2C1328834%2C1322420%2C1285833%2C1285960%2C1328251%2C1331058%2C1325938%2C1325877
• GLSA-201702-13
• GLSA-201702-13
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-03/
• https://www.mozilla.org/security/advisories/mfsa2017-03/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5374

Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 95759
• 95759
• 1037693
• 1037693
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1325344%2C1317501%2C1311319%2C1329989%2C1300145%2C1322305%2C1288561%2C1295747%2C1318766%2C1297808%2C1321374%2C1324810%2C1313385%2C1319888%2C1302231%2C1307458%2C1293327%2C1315447%2C1319456
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1325344%2C1317501%2C1311319%2C1329989%2C1300145%2C1322305%2C1288561%2C1295747%2C1318766%2C1297808%2C1321374%2C1324810%2C1313385%2C1319888%2C1302231%2C1307458%2C1293327%2C1315447%2C1319456
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5375

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0190
• RHSA-2017:0190
• RHSA-2017:0238
• RHSA-2017:0238
• 95757
• 95757
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1325200
• https://bugzilla.mozilla.org/show_bug.cgi?id=1325200
• GLSA-201702-13
• GLSA-201702-13
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• DSA-3832
• DSA-3832
• 42327
• 42327
• 44293
• 44293
• 44294
• 44294
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-03/
• https://www.mozilla.org/security/advisories/mfsa2017-03/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5376

Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0190
• RHSA-2017:0190
• RHSA-2017:0238
• RHSA-2017:0238
• 95758
• 95758
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1311687
• https://bugzilla.mozilla.org/show_bug.cgi?id=1311687
• GLSA-201702-13
• GLSA-201702-13
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-03/
• https://www.mozilla.org/security/advisories/mfsa2017-03/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5377

A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 95761
• 95761
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1306883
• https://bugzilla.mozilla.org/show_bug.cgi?id=1306883
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5378

Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• RHSA-2017:0190
• RHSA-2017:0190
• RHSA-2017:0238
• RHSA-2017:0238
• 95769
• 95769
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1312001
• https://bugzilla.mozilla.org/show_bug.cgi?id=1312001
• https://bugzilla.mozilla.org/show_bug.cgi?id=1330769
• https://bugzilla.mozilla.org/show_bug.cgi?id=1330769
• GLSA-201702-13
• GLSA-201702-13
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-03/
• https://www.mozilla.org/security/advisories/mfsa2017-03/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5379

Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects Firefox < 51.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1309198
• https://bugzilla.mozilla.org/show_bug.cgi?id=1309198
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5380

A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0190
• RHSA-2017:0190
• RHSA-2017:0238
• RHSA-2017:0238
• 95769
• 95769
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1322107
• https://bugzilla.mozilla.org/show_bug.cgi?id=1322107
• GLSA-201702-13
• GLSA-201702-13
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-03/
• https://www.mozilla.org/security/advisories/mfsa2017-03/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5381

The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be saved in unsafe locations with an arbitrary filename. This vulnerability affects Firefox < 51.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1017616
• https://bugzilla.mozilla.org/show_bug.cgi?id=1017616
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5382

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox < 51.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295322
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295322
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5383

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

• RHSA-2017:0190
• RHSA-2017:0190
• RHSA-2017:0238
• RHSA-2017:0238
• 95769
• 95769
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1323338
• https://bugzilla.mozilla.org/show_bug.cgi?id=1323338
• https://bugzilla.mozilla.org/show_bug.cgi?id=1324716
• https://bugzilla.mozilla.org/show_bug.cgi?id=1324716
• GLSA-201702-13
• GLSA-201702-13
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-03/
• https://www.mozilla.org/security/advisories/mfsa2017-03/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5384

Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be sent to the proxy itself in the case of HTTPS. Normally the Proxy Auto-Config file is specified by the user or machine owner and presumed to be non-malicious, but if a user has enabled Web Proxy Auto Detect (WPAD) this file can be served remotely. This vulnerability affects Firefox < 51.

Severity: MEDIUM (5.9) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1255474
• https://bugzilla.mozilla.org/show_bug.cgi?id=1255474
• https://www.contextis.com//resources/blog/leaking-https-urls-20-year-old-vulnerability/
• https://www.contextis.com//resources/blog/leaking-https-urls-20-year-old-vulnerability/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5385

Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. This vulnerability affects Firefox < 51.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295945
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295945
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox < 51.

Severity: HIGH (7.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References:

• RHSA-2017:0190
• RHSA-2017:0190
• 95769
• 95769
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1319070
• https://bugzilla.mozilla.org/show_bug.cgi?id=1319070
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5387

The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "" tag refers to a file that does not exist if the source page is loaded locally. This vulnerability affects Firefox < 51.

Severity: LOW (3.3) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295023
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295023
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5388

A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN packets in a short period of time due to a lack of rate limiting being applied on e10s systems, allowing for a denial of service attack. This vulnerability affects Firefox < 51.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1281482
• https://bugzilla.mozilla.org/show_bug.cgi?id=1281482
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5389

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1308688
• https://bugzilla.mozilla.org/show_bug.cgi?id=1308688
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5390

The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0190
• RHSA-2017:0190
• RHSA-2017:0238
• RHSA-2017:0238
• 95769
• 95769
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1297361
• https://bugzilla.mozilla.org/show_bug.cgi?id=1297361
• GLSA-201702-13
• GLSA-201702-13
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-03/
• https://www.mozilla.org/security/advisories/mfsa2017-03/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5391

Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potential privilege escalation. This vulnerability affects Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1309310
• https://bugzilla.mozilla.org/show_bug.cgi?id=1309310
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5393

The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This vulnerability affects Firefox < 51.

Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

• 95763
• 95763
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1309282
• https://bugzilla.mozilla.org/show_bug.cgi?id=1309282
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5396

A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0190
• RHSA-2017:0190
• RHSA-2017:0238
• RHSA-2017:0238
• 95769
• 95769
• 1037693
• 1037693
• https://bugzilla.mozilla.org/show_bug.cgi?id=1329403
• https://bugzilla.mozilla.org/show_bug.cgi?id=1329403
• GLSA-201702-13
• GLSA-201702-13
• GLSA-201702-22
• GLSA-201702-22
• DSA-3771
• DSA-3771
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-01/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-02/
• https://www.mozilla.org/security/advisories/mfsa2017-03/
• https://www.mozilla.org/security/advisories/mfsa2017-03/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5397

The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibility of an installed malicious application or tools with write access to the file system to replace files used by Firefox with their own versions. This vulnerability affects Firefox < 51.0.3.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 96144
• 96144
• https://bugzilla.mozilla.org/show_bug.cgi?id=1337304
• https://bugzilla.mozilla.org/show_bug.cgi?id=1337304
• https://www.mozilla.org/security/advisories/mfsa2017-04/
• https://www.mozilla.org/security/advisories/mfsa2017-04/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5398

Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96651
• 96651
• 1037966
• 1037966
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1332550%2C1332597%2C1338383%2C1321612%2C1322971%2C1333568%2C1333887%2C1335450%2C1325052%2C1324379%2C1336510
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1332550%2C1332597%2C1338383%2C1321612%2C1322971%2C1333568%2C1333887%2C1335450%2C1325052%2C1324379%2C1336510
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5399

Memory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1332569%2C1315248%2C1261335%2C1321038%2C1331771%2C1339566%2C1339591%2C1240893%2C1341905%2C1323241%2C1336467%2C1270288%2C1295299%2C1296024%2C1304201%2C1306142%2C1307557%2C1308036%2C1334246%2C1334290%2C1317085%2C1339116%2C1324000%2C1323150%2C1332501%2C1320894%2C1333752%2C1303713%2C1321566%2C1264053%2C1343513
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1332569%2C1315248%2C1261335%2C1321038%2C1331771%2C1339566%2C1339591%2C1240893%2C1341905%2C1323241%2C1336467%2C1270288%2C1295299%2C1296024%2C1304201%2C1306142%2C1307557%2C1308036%2C1334246%2C1334290%2C1317085%2C1339116%2C1324000%2C1323150%2C1332501%2C1320894%2C1333752%2C1303713%2C1321566%2C1264053%2C1343513
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5400

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96654
• 96654
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1334933
• https://bugzilla.mozilla.org/show_bug.cgi?id=1334933
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5401

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96677
• 96677
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1328861
• https://bugzilla.mozilla.org/show_bug.cgi?id=1328861
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5402

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96664
• 96664
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1334876
• https://bugzilla.mozilla.org/show_bug.cgi?id=1334876
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5403

When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 96691
• 96691
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1340186
• https://bugzilla.mozilla.org/show_bug.cgi?id=1340186
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5404

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96664
• 96664
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1340138
• https://bugzilla.mozilla.org/show_bug.cgi?id=1340138
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• 41660
• 41660
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5405

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96693
• 96693
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1336699
• https://bugzilla.mozilla.org/show_bug.cgi?id=1336699
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5406

A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1306890
• https://bugzilla.mozilla.org/show_bug.cgi?id=1306890
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5407

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96693
• 96693
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1336622
• https://bugzilla.mozilla.org/show_bug.cgi?id=1336622
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5408

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96693
• 96693
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1313711
• https://bugzilla.mozilla.org/show_bug.cgi?id=1313711
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5409

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 45.8 and Firefox < 52.

Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References:

• 96696
• 96696
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1321814
• https://bugzilla.mozilla.org/show_bug.cgi?id=1321814
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5410

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0459
• RHSA-2017:0459
• RHSA-2017:0461
• RHSA-2017:0461
• RHSA-2017:0498
• RHSA-2017:0498
• 96693
• 96693
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1330687
• https://bugzilla.mozilla.org/show_bug.cgi?id=1330687
• GLSA-201705-06
• GLSA-201705-06
• GLSA-201705-07
• GLSA-201705-07
• DSA-3805
• DSA-3805
• DSA-3832
• DSA-3832
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-06/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-07/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5411

A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage can be freed while still in use in some circumstances, leading to a potentially exploitable crash. Note: This issue is in "libGLES", which is only in use on Windows. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1325511
• https://bugzilla.mozilla.org/show_bug.cgi?id=1325511
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5412

A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1328323
• https://bugzilla.mozilla.org/show_bug.cgi?id=1328323
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5413

A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1337504
• https://bugzilla.mozilla.org/show_bug.cgi?id=1337504
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5414

The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1319370
• https://bugzilla.mozilla.org/show_bug.cgi?id=1319370
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5415

An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox < 52.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1321719
• https://bugzilla.mozilla.org/show_bug.cgi?id=1321719
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5416

In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1328121
• https://bugzilla.mozilla.org/show_bug.cgi?id=1328121
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5417

When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page. This allows for spoofing attacks. This vulnerability affects Firefox < 52.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=791597
• https://bugzilla.mozilla.org/show_bug.cgi?id=791597
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5418

An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1338876
• https://bugzilla.mozilla.org/show_bug.cgi?id=1338876
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5419

If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service (DOS) attack. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1312243
• https://bugzilla.mozilla.org/show_bug.cgi?id=1312243
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5420

A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. This vulnerability affects Firefox < 52.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1284395
• https://bugzilla.mozilla.org/show_bug.cgi?id=1284395
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5421

A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1301876
• https://bugzilla.mozilla.org/show_bug.cgi?id=1301876
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5422

If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink is selected. This was fixed by no longer making "view-source:" linkable. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295002
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295002
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5425

The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of "/private/var" that could expose personal or temporary data. This has been updated to not allow access to "/private/var" and its subdirectories. Note: this issue only affects OS X. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1322716
• https://bugzilla.mozilla.org/show_bug.cgi?id=1322716
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5426

On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected only by the running filter which is typically weak compared to the sandbox. Note: this issue only affects Linux. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

• 96694
• 96694
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1257361
• https://bugzilla.mozilla.org/show_bug.cgi?id=1257361
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-09/
• https://www.mozilla.org/security/advisories/mfsa2017-09/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5427

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in malicious software being added without consent or modification of referenced installed files. This vulnerability affects Firefox < 52.

Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References:

• 96692
• 96692
• 1037966
• 1037966
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295542
• https://bugzilla.mozilla.org/show_bug.cgi?id=1295542
• https://www.mozilla.org/security/advisories/mfsa2017-05/
• https://www.mozilla.org/security/advisories/mfsa2017-05/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5428

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• RHSA-2017:0558
• RHSA-2017:0558
• 96959
• 96959
• 1038060
• 1038060
• https://bugzilla.mozilla.org/show_bug.cgi?id=1348168
• https://bugzilla.mozilla.org/show_bug.cgi?id=1348168
• https://www.mozilla.org/security/advisories/mfsa2017-08/
• https://www.mozilla.org/security/advisories/mfsa2017-08/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5429

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1104
• RHSA-2017:1104
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1343261%2C1350844%2C1341096%2C1342823%2C1348894%2C1348941%2C1349340%2C1352926%2C1353088%2C
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1343261%2C1350844%2C1341096%2C1342823%2C1348894%2C1348941%2C1349340%2C1352926%2C1353088%2C
• DSA-3831
• DSA-3831
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5430

Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1106
• RHSA-2017:1106
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1342101%2C1340482%2C1344686%2C1329796%2C1346419%2C1349621%2C1344081%2C1344305%2C1348143%2C1349719%2C1353476%2C1337418%2C1346140%2C1339722
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1342101%2C1340482%2C1344686%2C1329796%2C1346419%2C1349621%2C1344081%2C1344305%2C1348143%2C1349719%2C1353476%2C1337418%2C1346140%2C1339722
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5435

A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1104
• RHSA-2017:1104
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1350683
• https://bugzilla.mozilla.org/show_bug.cgi?id=1350683
• DSA-3831
• DSA-3831
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5439

A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 103053
• 103053
• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1104
• RHSA-2017:1104
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1336830
• https://bugzilla.mozilla.org/show_bug.cgi?id=1336830
• DSA-3831
• DSA-3831
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5440

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1104
• RHSA-2017:1104
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1336832
• https://bugzilla.mozilla.org/show_bug.cgi?id=1336832
• DSA-3831
• DSA-3831
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5444

A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1104
• RHSA-2017:1104
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1344461
• https://bugzilla.mozilla.org/show_bug.cgi?id=1344461
• DSA-3831
• DSA-3831
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5446

An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1104
• RHSA-2017:1104
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1343505
• https://bugzilla.mozilla.org/show_bug.cgi?id=1343505
• DSA-3831
• DSA-3831
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5451

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Severity: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1273537
• https://bugzilla.mozilla.org/show_bug.cgi?id=1273537
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5454

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1349276
• https://bugzilla.mozilla.org/show_bug.cgi?id=1349276
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5455

The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1106
• RHSA-2017:1106
• https://bugzilla.mozilla.org/show_bug.cgi?id=1341191
• https://bugzilla.mozilla.org/show_bug.cgi?id=1341191
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5456

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1106
• RHSA-2017:1106
• https://bugzilla.mozilla.org/show_bug.cgi?id=1344415
• https://bugzilla.mozilla.org/show_bug.cgi?id=1344415
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5464

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1104
• RHSA-2017:1104
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1347075
• https://bugzilla.mozilla.org/show_bug.cgi?id=1347075
• DSA-3831
• DSA-3831
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5466

If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1353975
• https://bugzilla.mozilla.org/show_bug.cgi?id=1353975
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

Published: 2018-06-12
Modified: 2024-11-21

CVE-2017-5467

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

• 97940
• 97940
• 1038320
• 1038320
• RHSA-2017:1106
• RHSA-2017:1106
• RHSA-2017:1201
• RHSA-2017:1201
• https://bugzilla.mozilla.org/show_bug.cgi?id=1347262
• https://bugzilla.mozilla.org/show_bug.cgi?id=1347262
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• https://www.mozilla.org/security/advisories/mfsa2017-13/

VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla

Version: 2.1.0

Back to top