Уязвимость библиотеки парсинга Expat, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость набора библиотек Network Security Services и браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие

Уязвимость браузера Firefox, позволяющая нарушителю провести XSS-атаки

Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к полному списку отключенных плагинов

Уязвимость браузеров Firefox ESR и Firefox, позволяющая нарушителю вызвать отказ в обслуживании, провести кликджекинг или спуфинг-атаку

Уязвимость браузера Firefox, позволяющая нарушителю повлиять на целостность информации

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю обойти существующую политику ограничения доступа и изменить свойство location.host

Уязвимость браузера Firefox, позволяющая нарушителю проводить спуфинг-атаки

Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к локальным файлам

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти существующую политику ограничения доступа или читать произвольные файлы

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю изменять произвольные файлы

Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Firefox, позволяющая нарушителю подменить адресную строку

Уязвимость браузера Firefox, позволяющая нарушителю получить информацию о последних посещенных страницах

Уязвимость компонента Developer Tools браузера Mozilla Firefox ESR, позволяющая нарушителю выполнить произвольный код

Уязвимость реализации технологии WebSockets браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с использованием памяти после освобождения, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции nsImageLoadingContent::Notify браузера Mozilla Firefox ESR, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Уязвимость функции mozilla::dom::ImageDocument::UpdateSizeFromLayout браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции mozilla::a11y::DocAccessible::PutChildrenBack браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции mozilla::SVGGeometryFrame::GetCanvasTM() браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузера Mozilla Firefox ESR, вызванная выходом операции за границы буфера в памяти, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с недостатками в реализации SOP (Same-origin policy), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Уязвимость механизма AppCache браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю осуществить подмену домена

Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, вызванная выходом операции за границы буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость реализации протокола «data:» браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю оказать влияние на целостность защищаемой информации

Уязвимость реализации механизма CSP (Content Security Policy) браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Уязвимость браузера Mozilla Firefox ESR, связанная с ошибками при работе с памятью, позволяющая нарушителю выполнить произвольный код

Уязвимость функции lz4::decompress библиотеки Graphite 2 браузеров Mozilla Firefox и Mozilla Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c использованием памяти после освобождения при обработке транзакций в редакторе, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции nsTArray Length() браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции txExecutionState браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код

Уязвимость функции evutil_parse_sockaddr_port (evutil.c) библиотеки асинхронного уведомления событий Libevent, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость реализации метода nsDirIndexParser::ParseData (netwerk\streamconv\converters\nsDirIndexParser.cpp) браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю получить доступ к защищаемой информации

Уязвимость реализации технологии HTTP/2 браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость механизма подмены адресной строки через взаимодействие пользователя с адресной строкой и событием «onblur» браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю проводить спуфинг-атаки

Уязвимость функции PFileSystemRequestConstructor браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c обходом защиты доступа к файловой системе в песочнице, позволяющая нарушителю получить доступ к защищаемой информации

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c использованием памяти после освобождения при манипулировании элементами DOM, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции деструктора класса WindowsDllDetourPatcher браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю повысить свои привилегии

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная cо смешением символов из блока «Canadian Syllabics» с символами из других блоков, позволяющая нарушителю проводить спуфинг-атаки

Уязвимость аудиокодека Opus браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость интерфейса прикладного программирования клиентского хранилища IndexedDB браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость компонента XMLHttpRequest браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость компонента WebGL (Web-based Graphics Library) браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю раскрыть защищаемую информацию

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код

Уязвимость загрузчика фреймов браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c использованием памяти после освобождения, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c непринятием мер по защите структуры веб-страницы, позволяющая нарушителю нарушителю проводить межсайтовые сценарные атаки

Уязвимость реализации класса WindowsDllDetourPatcher браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю нарушить целостность данных

Уязвимость редактора метода ввода Input Method Editor (IME) браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c использованием памяти после освобождения, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость графической библиотеки Skia браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, связанная c выходом операции за границы буфера в памяти при манипуляции с деревом доступа DOM, позволяющая нарушителю выполнить произвольный код

Уязвимость класса DOMSVGLength браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код

Уязвимость функции mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код

Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю подделывать обновления надстроек

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element.

Use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when contenteditable mode is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering deletion of DOM elements that were created in the editor.

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu.

Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL.

The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a Content Security Policy (CSP) referrer directive with zero values.

Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.

Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demonstrated by the microphone permission or the geolocation permission.

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses.

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site.

Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes.

Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java applets, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted applet.

Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors.

Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.

Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document.

Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls.

Mozilla Firefox before 48.0 allows remote attackers to spoof the location bar via crafted characters in the media type of a data: URL.

Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations.

The Updater in Mozilla Firefox before 48.0 on Windows allows local users to write to arbitrary files via vectors involving the callback application-path parameter and a hard link.

Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items.

Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript that is mishandled during incremental garbage collection.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.

Mozilla Firefox before 48.0 mishandles changes from 'INPUT type="password"' to 'INPUT type="text"' within a single Session Manager session, which might allow attackers to discover cleartext passwords by reading a session restoration file.

Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.

The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion."

Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.

Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTransfer) actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site.

Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring.

Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion.

The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via text runs in conjunction with a "display: contents" Cascading Style Sheets (CSS) property.

The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site.

The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site.

Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.

Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code by leveraging improper interaction between empty filters and CANVAS element rendering.

Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute.

Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.

Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.

Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code.

Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.

Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource.

Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.

A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox < 49.0.2.

Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.

Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.

A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.

A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.

A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox < 50.

Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history. This vulnerability affects Firefox < 50.

WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affects Firefox < 50.

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 50.

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox < 50. Severity: MEDIUM (5.9) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N References: 94337 94337 1037298 1037298 https://bugzilla.mozilla.org/show_bug.cgi?id=1276976 https://bugzilla.mozilla.org/show_bug.cgi?id=1276976 https://www.mozilla.org/security/advisories/mfsa2016-89/ https://www.mozilla.org/security/advisories/mfsa2016-89/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9077 Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox < 50. Severity: HIGH (7.0) Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H References: 94337 94337 1037298 1037298 https://bugzilla.mozilla.org/show_bug.cgi?id=1298552 https://bugzilla.mozilla.org/show_bug.cgi?id=1298552 https://www.mozilla.org/security/advisories/mfsa2016-89/ https://www.mozilla.org/security/advisories/mfsa2016-89/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9080 Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 94883 94883 1037461 1037461 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1289701%2C1314401%2C1315848 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1289701%2C1314401%2C1315848 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9893 Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2016:2946 RHSA-2016:2946 RHSA-2016:2973 RHSA-2016:2973 94885 94885 1037461 1037461 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1319524%2C1298773%2C1299098%2C1309834%2C1312609%2C1313212%2C1317805%2C1312548%2C1315631%2C1287912 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1319524%2C1298773%2C1299098%2C1309834%2C1312609%2C1313212%2C1317805%2C1312548%2C1315631%2C1287912 GLSA-201701-15 GLSA-201701-15 DSA-3757 DSA-3757 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-96/ https://www.mozilla.org/security/advisories/mfsa2016-96/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9894 A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.1. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 94883 94883 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1306628 https://bugzilla.mozilla.org/show_bug.cgi?id=1306628 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9895 Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References: RHSA-2016:2946 RHSA-2016:2946 RHSA-2016:2973 RHSA-2016:2973 94885 94885 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1312272 https://bugzilla.mozilla.org/show_bug.cgi?id=1312272 GLSA-201701-15 GLSA-201701-15 DSA-3757 DSA-3757 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-96/ https://www.mozilla.org/security/advisories/mfsa2016-96/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9896 Use-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not currently enabled by default. This vulnerability affects Firefox < 50.1. Severity: HIGH (8.1) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H References: 94883 94883 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1315543 https://bugzilla.mozilla.org/show_bug.cgi?id=1315543 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9897 Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: RHSA-2016:2946 RHSA-2016:2946 94885 94885 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1301381 https://bugzilla.mozilla.org/show_bug.cgi?id=1301381 GLSA-201701-15 GLSA-201701-15 DSA-3757 DSA-3757 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-96/ https://www.mozilla.org/security/advisories/mfsa2016-96/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9898 Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2016:2946 RHSA-2016:2946 94885 94885 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1314442 https://bugzilla.mozilla.org/show_bug.cgi?id=1314442 GLSA-201701-15 GLSA-201701-15 DSA-3757 DSA-3757 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-96/ https://www.mozilla.org/security/advisories/mfsa2016-96/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9900 External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: RHSA-2016:2946 RHSA-2016:2946 RHSA-2016:2973 RHSA-2016:2973 94885 94885 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1319122 https://bugzilla.mozilla.org/show_bug.cgi?id=1319122 GLSA-201701-15 GLSA-201701-15 DSA-3757 DSA-3757 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-96/ https://www.mozilla.org/security/advisories/mfsa2016-96/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9901 HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2016:2946 RHSA-2016:2946 RHSA-2016:2973 RHSA-2016:2973 94885 94885 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1320057 https://bugzilla.mozilla.org/show_bug.cgi?id=1320057 GLSA-201701-15 GLSA-201701-15 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-95/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9902 The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References: RHSA-2016:2946 RHSA-2016:2946 RHSA-2016:2973 RHSA-2016:2973 94885 94885 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1320039 https://bugzilla.mozilla.org/show_bug.cgi?id=1320039 GLSA-201701-15 GLSA-201701-15 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-95/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9903 Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox < 50.1. Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References: 94883 94883 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1315435 https://bugzilla.mozilla.org/show_bug.cgi?id=1315435 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2016-9904 An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: RHSA-2016:2946 RHSA-2016:2946 94885 94885 1037461 1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1317936 https://bugzilla.mozilla.org/show_bug.cgi?id=1317936 GLSA-201701-15 GLSA-201701-15 DSA-3757 DSA-3757 https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-94/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-95/ https://www.mozilla.org/security/advisories/mfsa2016-96/ https://www.mozilla.org/security/advisories/mfsa2016-96/ Published: 2017-04-25 Modified: 2024-11-21 CVE-2017-5031 A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H References: RHSA-2017:0499 RHSA-2017:0499 DSA-3810 DSA-3810 96767 96767 98326 98326 https://bugzilla.mozilla.org/show_bug.cgi?id=1328762 https://bugzilla.mozilla.org/show_bug.cgi?id=1328762 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/682020 https://crbug.com/682020 GLSA-201704-02 GLSA-201704-02 https://www.mozilla.org/security/advisories/mfsa2017-14/ https://www.mozilla.org/security/advisories/mfsa2017-14/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5373 Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0190 RHSA-2017:0190 RHSA-2017:0238 RHSA-2017:0238 95762 95762 1037693 1037693 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1322315%2C1328834%2C1322420%2C1285833%2C1285960%2C1328251%2C1331058%2C1325938%2C1325877 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1322315%2C1328834%2C1322420%2C1285833%2C1285960%2C1328251%2C1331058%2C1325938%2C1325877 GLSA-201702-13 GLSA-201702-13 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-03/ https://www.mozilla.org/security/advisories/mfsa2017-03/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5374 Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 95759 95759 1037693 1037693 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1325344%2C1317501%2C1311319%2C1329989%2C1300145%2C1322305%2C1288561%2C1295747%2C1318766%2C1297808%2C1321374%2C1324810%2C1313385%2C1319888%2C1302231%2C1307458%2C1293327%2C1315447%2C1319456 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1325344%2C1317501%2C1311319%2C1329989%2C1300145%2C1322305%2C1288561%2C1295747%2C1318766%2C1297808%2C1321374%2C1324810%2C1313385%2C1319888%2C1302231%2C1307458%2C1293327%2C1315447%2C1319456 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5375 JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0190 RHSA-2017:0190 RHSA-2017:0238 RHSA-2017:0238 95757 95757 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1325200 https://bugzilla.mozilla.org/show_bug.cgi?id=1325200 GLSA-201702-13 GLSA-201702-13 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 DSA-3832 DSA-3832 42327 42327 44293 44293 44294 44294 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-03/ https://www.mozilla.org/security/advisories/mfsa2017-03/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5376 Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0190 RHSA-2017:0190 RHSA-2017:0238 RHSA-2017:0238 95758 95758 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1311687 https://bugzilla.mozilla.org/show_bug.cgi?id=1311687 GLSA-201702-13 GLSA-201702-13 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-03/ https://www.mozilla.org/security/advisories/mfsa2017-03/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5377 A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 95761 95761 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1306883 https://bugzilla.mozilla.org/show_bug.cgi?id=1306883 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5378 Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: RHSA-2017:0190 RHSA-2017:0190 RHSA-2017:0238 RHSA-2017:0238 95769 95769 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1312001 https://bugzilla.mozilla.org/show_bug.cgi?id=1312001 https://bugzilla.mozilla.org/show_bug.cgi?id=1330769 https://bugzilla.mozilla.org/show_bug.cgi?id=1330769 GLSA-201702-13 GLSA-201702-13 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-03/ https://www.mozilla.org/security/advisories/mfsa2017-03/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5379 Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects Firefox < 51. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1309198 https://bugzilla.mozilla.org/show_bug.cgi?id=1309198 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5380 A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0190 RHSA-2017:0190 RHSA-2017:0238 RHSA-2017:0238 95769 95769 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1322107 https://bugzilla.mozilla.org/show_bug.cgi?id=1322107 GLSA-201702-13 GLSA-201702-13 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-03/ https://www.mozilla.org/security/advisories/mfsa2017-03/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5381 The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be saved in unsafe locations with an arbitrary filename. This vulnerability affects Firefox < 51. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1017616 https://bugzilla.mozilla.org/show_bug.cgi?id=1017616 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5382 Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox < 51. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1295322 https://bugzilla.mozilla.org/show_bug.cgi?id=1295322 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5383 URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References: RHSA-2017:0190 RHSA-2017:0190 RHSA-2017:0238 RHSA-2017:0238 95769 95769 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1323338 https://bugzilla.mozilla.org/show_bug.cgi?id=1323338 https://bugzilla.mozilla.org/show_bug.cgi?id=1324716 https://bugzilla.mozilla.org/show_bug.cgi?id=1324716 GLSA-201702-13 GLSA-201702-13 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-03/ https://www.mozilla.org/security/advisories/mfsa2017-03/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5384 Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be sent to the proxy itself in the case of HTTPS. Normally the Proxy Auto-Config file is specified by the user or machine owner and presumed to be non-malicious, but if a user has enabled Web Proxy Auto Detect (WPAD) this file can be served remotely. This vulnerability affects Firefox < 51. Severity: MEDIUM (5.9) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1255474 https://bugzilla.mozilla.org/show_bug.cgi?id=1255474 https://www.contextis.com//resources/blog/leaking-https-urls-20-year-old-vulnerability/ https://www.contextis.com//resources/blog/leaking-https-urls-20-year-old-vulnerability/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5385 Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. This vulnerability affects Firefox < 51. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1295945 https://bugzilla.mozilla.org/show_bug.cgi?id=1295945 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5386 WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox < 51. Severity: HIGH (7.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L References: RHSA-2017:0190 RHSA-2017:0190 95769 95769 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1319070 https://bugzilla.mozilla.org/show_bug.cgi?id=1319070 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5387 The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "" tag refers to a file that does not exist if the source page is loaded locally. This vulnerability affects Firefox < 51. Severity: LOW (3.3) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1295023 https://bugzilla.mozilla.org/show_bug.cgi?id=1295023 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5388 A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN packets in a short period of time due to a lack of rate limiting being applied on e10s systems, allowing for a denial of service attack. This vulnerability affects Firefox < 51. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1281482 https://bugzilla.mozilla.org/show_bug.cgi?id=1281482 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5389 WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51. Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1308688 https://bugzilla.mozilla.org/show_bug.cgi?id=1308688 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5390 The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0190 RHSA-2017:0190 RHSA-2017:0238 RHSA-2017:0238 95769 95769 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1297361 https://bugzilla.mozilla.org/show_bug.cgi?id=1297361 GLSA-201702-13 GLSA-201702-13 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-03/ https://www.mozilla.org/security/advisories/mfsa2017-03/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5391 Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potential privilege escalation. This vulnerability affects Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1309310 https://bugzilla.mozilla.org/show_bug.cgi?id=1309310 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5393 The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This vulnerability affects Firefox < 51. Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References: 95763 95763 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1309282 https://bugzilla.mozilla.org/show_bug.cgi?id=1309282 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5396 A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0190 RHSA-2017:0190 RHSA-2017:0238 RHSA-2017:0238 95769 95769 1037693 1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1329403 https://bugzilla.mozilla.org/show_bug.cgi?id=1329403 GLSA-201702-13 GLSA-201702-13 GLSA-201702-22 GLSA-201702-22 DSA-3771 DSA-3771 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-02/ https://www.mozilla.org/security/advisories/mfsa2017-03/ https://www.mozilla.org/security/advisories/mfsa2017-03/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5397 The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibility of an installed malicious application or tools with write access to the file system to replace files used by Firefox with their own versions. This vulnerability affects Firefox < 51.0.3. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 96144 96144 https://bugzilla.mozilla.org/show_bug.cgi?id=1337304 https://bugzilla.mozilla.org/show_bug.cgi?id=1337304 https://www.mozilla.org/security/advisories/mfsa2017-04/ https://www.mozilla.org/security/advisories/mfsa2017-04/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5398 Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96651 96651 1037966 1037966 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1332550%2C1332597%2C1338383%2C1321612%2C1322971%2C1333568%2C1333887%2C1335450%2C1325052%2C1324379%2C1336510 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1332550%2C1332597%2C1338383%2C1321612%2C1322971%2C1333568%2C1333887%2C1335450%2C1325052%2C1324379%2C1336510 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5399 Memory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1332569%2C1315248%2C1261335%2C1321038%2C1331771%2C1339566%2C1339591%2C1240893%2C1341905%2C1323241%2C1336467%2C1270288%2C1295299%2C1296024%2C1304201%2C1306142%2C1307557%2C1308036%2C1334246%2C1334290%2C1317085%2C1339116%2C1324000%2C1323150%2C1332501%2C1320894%2C1333752%2C1303713%2C1321566%2C1264053%2C1343513 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1332569%2C1315248%2C1261335%2C1321038%2C1331771%2C1339566%2C1339591%2C1240893%2C1341905%2C1323241%2C1336467%2C1270288%2C1295299%2C1296024%2C1304201%2C1306142%2C1307557%2C1308036%2C1334246%2C1334290%2C1317085%2C1339116%2C1324000%2C1323150%2C1332501%2C1320894%2C1333752%2C1303713%2C1321566%2C1264053%2C1343513 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5400 JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96654 96654 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1334933 https://bugzilla.mozilla.org/show_bug.cgi?id=1334933 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5401 A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96677 96677 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1328861 https://bugzilla.mozilla.org/show_bug.cgi?id=1328861 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5402 A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96664 96664 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1334876 https://bugzilla.mozilla.org/show_bug.cgi?id=1334876 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5403 When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 96691 96691 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1340186 https://bugzilla.mozilla.org/show_bug.cgi?id=1340186 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5404 A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96664 96664 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1340138 https://bugzilla.mozilla.org/show_bug.cgi?id=1340138 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 41660 41660 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5405 Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96693 96693 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1336699 https://bugzilla.mozilla.org/show_bug.cgi?id=1336699 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5406 A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1306890 https://bugzilla.mozilla.org/show_bug.cgi?id=1306890 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5407 Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96693 96693 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1336622 https://bugzilla.mozilla.org/show_bug.cgi?id=1336622 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5408 Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96693 96693 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1313711 https://bugzilla.mozilla.org/show_bug.cgi?id=1313711 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5409 The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 45.8 and Firefox < 52. Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N References: 96696 96696 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1321814 https://bugzilla.mozilla.org/show_bug.cgi?id=1321814 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5410 Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0459 RHSA-2017:0459 RHSA-2017:0461 RHSA-2017:0461 RHSA-2017:0498 RHSA-2017:0498 96693 96693 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1330687 https://bugzilla.mozilla.org/show_bug.cgi?id=1330687 GLSA-201705-06 GLSA-201705-06 GLSA-201705-07 GLSA-201705-07 DSA-3805 DSA-3805 DSA-3832 DSA-3832 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-06/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-07/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5411 A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage can be freed while still in use in some circumstances, leading to a potentially exploitable crash. Note: This issue is in "libGLES", which is only in use on Windows. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1325511 https://bugzilla.mozilla.org/show_bug.cgi?id=1325511 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5412 A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1328323 https://bugzilla.mozilla.org/show_bug.cgi?id=1328323 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5413 A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1337504 https://bugzilla.mozilla.org/show_bug.cgi?id=1337504 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5414 The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1319370 https://bugzilla.mozilla.org/show_bug.cgi?id=1319370 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5415 An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox < 52. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1321719 https://bugzilla.mozilla.org/show_bug.cgi?id=1321719 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5416 In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1328121 https://bugzilla.mozilla.org/show_bug.cgi?id=1328121 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5417 When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page. This allows for spoofing attacks. This vulnerability affects Firefox < 52. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=791597 https://bugzilla.mozilla.org/show_bug.cgi?id=791597 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5418 An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1338876 https://bugzilla.mozilla.org/show_bug.cgi?id=1338876 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5419 If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service (DOS) attack. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1312243 https://bugzilla.mozilla.org/show_bug.cgi?id=1312243 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5420 A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. This vulnerability affects Firefox < 52. Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1284395 https://bugzilla.mozilla.org/show_bug.cgi?id=1284395 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5421 A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1301876 https://bugzilla.mozilla.org/show_bug.cgi?id=1301876 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5422 If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink is selected. This was fixed by no longer making "view-source:" linkable. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1295002 https://bugzilla.mozilla.org/show_bug.cgi?id=1295002 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5425 The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of "/private/var" that could expose personal or temporary data. This has been updated to not allow access to "/private/var" and its subdirectories. Note: this issue only affects OS X. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1322716 https://bugzilla.mozilla.org/show_bug.cgi?id=1322716 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5426 On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected only by the running filter which is typically weak compared to the sandbox. Note: this issue only affects Linux. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References: 96694 96694 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1257361 https://bugzilla.mozilla.org/show_bug.cgi?id=1257361 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-09/ https://www.mozilla.org/security/advisories/mfsa2017-09/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5427 A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in malicious software being added without consent or modification of referenced installed files. This vulnerability affects Firefox < 52. Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N References: 96692 96692 1037966 1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1295542 https://bugzilla.mozilla.org/show_bug.cgi?id=1295542 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-05/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5428 An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: RHSA-2017:0558 RHSA-2017:0558 96959 96959 1038060 1038060 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 https://www.mozilla.org/security/advisories/mfsa2017-08/ https://www.mozilla.org/security/advisories/mfsa2017-08/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5429 Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 97940 97940 1038320 1038320 RHSA-2017:1104 RHSA-2017:1104 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1343261%2C1350844%2C1341096%2C1342823%2C1348894%2C1348941%2C1349340%2C1352926%2C1353088%2C https://bugzilla.mozilla.org/buglist.cgi?bug_id=1343261%2C1350844%2C1341096%2C1342823%2C1348894%2C1348941%2C1349340%2C1352926%2C1353088%2C DSA-3831 DSA-3831 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5430 Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 97940 97940 1038320 1038320 RHSA-2017:1106 RHSA-2017:1106 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1342101%2C1340482%2C1344686%2C1329796%2C1346419%2C1349621%2C1344081%2C1344305%2C1348143%2C1349719%2C1353476%2C1337418%2C1346140%2C1339722 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1342101%2C1340482%2C1344686%2C1329796%2C1346419%2C1349621%2C1344081%2C1344305%2C1348143%2C1349719%2C1353476%2C1337418%2C1346140%2C1339722 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5435 A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 97940 97940 1038320 1038320 RHSA-2017:1104 RHSA-2017:1104 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1350683 https://bugzilla.mozilla.org/show_bug.cgi?id=1350683 DSA-3831 DSA-3831 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5439 A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 103053 103053 97940 97940 1038320 1038320 RHSA-2017:1104 RHSA-2017:1104 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1336830 https://bugzilla.mozilla.org/show_bug.cgi?id=1336830 DSA-3831 DSA-3831 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5440 A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 97940 97940 1038320 1038320 RHSA-2017:1104 RHSA-2017:1104 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1336832 https://bugzilla.mozilla.org/show_bug.cgi?id=1336832 DSA-3831 DSA-3831 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5444 A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: 97940 97940 1038320 1038320 RHSA-2017:1104 RHSA-2017:1104 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1344461 https://bugzilla.mozilla.org/show_bug.cgi?id=1344461 DSA-3831 DSA-3831 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5446 An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 97940 97940 1038320 1038320 RHSA-2017:1104 RHSA-2017:1104 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1343505 https://bugzilla.mozilla.org/show_bug.cgi?id=1343505 DSA-3831 DSA-3831 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5451 A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Severity: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N References: 97940 97940 1038320 1038320 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1273537 https://bugzilla.mozilla.org/show_bug.cgi?id=1273537 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5454 A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: 97940 97940 1038320 1038320 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1349276 https://bugzilla.mozilla.org/show_bug.cgi?id=1349276 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5455 The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References: 97940 97940 1038320 1038320 RHSA-2017:1106 RHSA-2017:1106 https://bugzilla.mozilla.org/show_bug.cgi?id=1341191 https://bugzilla.mozilla.org/show_bug.cgi?id=1341191 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5456 A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 97940 97940 1038320 1038320 RHSA-2017:1106 RHSA-2017:1106 https://bugzilla.mozilla.org/show_bug.cgi?id=1344415 https://bugzilla.mozilla.org/show_bug.cgi?id=1344415 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5464 During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 97940 97940 1038320 1038320 RHSA-2017:1104 RHSA-2017:1104 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1347075 https://bugzilla.mozilla.org/show_bug.cgi?id=1347075 DSA-3831 DSA-3831 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-11/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5466 If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N References: 97940 97940 1038320 1038320 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1353975 https://bugzilla.mozilla.org/show_bug.cgi?id=1353975 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5467 A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: 97940 97940 1038320 1038320 RHSA-2017:1106 RHSA-2017:1106 RHSA-2017:1201 RHSA-2017:1201 https://bugzilla.mozilla.org/show_bug.cgi?id=1347262 https://bugzilla.mozilla.org/show_bug.cgi?id=1347262 https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-10/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-12/ https://www.mozilla.org/security/advisories/mfsa2017-13/ https://www.mozilla.org/security/advisories/mfsa2017-13/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5470 Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 99041 99041 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1359639%2C1349595%2C1352295%2C1352556%2C1342552%2C1342567%2C1346012%2C1366140%2C1368732%2C1297111%2C1362590%2C1357462%2C1363280%2C1349266%2C1352093%2C1348424%2C1347748%2C1356025%2C1325513%2C1367692 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1359639%2C1349595%2C1352295%2C1352556%2C1342552%2C1342567%2C1346012%2C1366140%2C1368732%2C1297111%2C1362590%2C1357462%2C1363280%2C1349266%2C1352093%2C1348424%2C1347748%2C1356025%2C1325513%2C1367692 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-5472 A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 99040 99040 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1365602 https://bugzilla.mozilla.org/show_bug.cgi?id=1365602 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7749 A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1355039 https://bugzilla.mozilla.org/show_bug.cgi?id=1355039 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7750 A use-after-free vulnerability during video control operations when a "" element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1356558 https://bugzilla.mozilla.org/show_bug.cgi?id=1356558 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7751 A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1363396 https://bugzilla.mozilla.org/show_bug.cgi?id=1363396 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7752 A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1359547 https://bugzilla.mozilla.org/show_bug.cgi?id=1359547 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7753 An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H References: 100315 100315 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1353312 https://bugzilla.mozilla.org/show_bug.cgi?id=1353312 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7754 An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1357090 https://bugzilla.mozilla.org/show_bug.cgi?id=1357090 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7755 The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the installer is run with elevated privileges. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: HIGH (7.8) Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 https://bugzilla.mozilla.org/show_bug.cgi?id=1361326 https://bugzilla.mozilla.org/show_bug.cgi?id=1361326 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7756 A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1366595 https://bugzilla.mozilla.org/show_bug.cgi?id=1366595 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7757 A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1356824 https://bugzilla.mozilla.org/show_bug.cgi?id=1356824 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7758 An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1368490 https://bugzilla.mozilla.org/show_bug.cgi?id=1368490 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7760 The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the manipulation of files in the installation directory and privilege escalation by manipulating the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54. Severity: HIGH (7.8) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 https://bugzilla.mozilla.org/show_bug.cgi?id=1348645 https://bugzilla.mozilla.org/show_bug.cgi?id=1348645 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7761 The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54. Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N References: 99057 99057 1038689 1038689 https://bugzilla.mozilla.org/show_bug.cgi?id=1215648 https://bugzilla.mozilla.org/show_bug.cgi?id=1215648 https://sourceforge.net/p/nsis/bugs/1125/ https://sourceforge.net/p/nsis/bugs/1125/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7763 Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References: 99057 99057 1038689 1038689 https://bugzilla.mozilla.org/show_bug.cgi?id=1360309 https://bugzilla.mozilla.org/show_bug.cgi?id=1360309 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7764 Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References: 99057 99057 1038689 1038689 http://www.unicode.org/reports/tr31/tr31-26.html#Aspirational_Use_Scripts http://www.unicode.org/reports/tr31/tr31-26.html#Aspirational_Use_Scripts RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 https://bugzilla.mozilla.org/show_bug.cgi?id=1364283 https://bugzilla.mozilla.org/show_bug.cgi?id=1364283 DSA-3881 DSA-3881 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7765 The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark of the Web data, the security warning that Windows displays before running executables downloaded from the Internet is not shown. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References: 99057 99057 1038689 1038689 https://bugzilla.mozilla.org/show_bug.cgi?id=1273265 https://bugzilla.mozilla.org/show_bug.cgi?id=1273265 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7766 An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54. Severity: HIGH (7.8) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 https://bugzilla.mozilla.org/show_bug.cgi?id=1342742 https://bugzilla.mozilla.org/show_bug.cgi?id=1342742 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7767 The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54. Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N References: 99057 99057 1038689 1038689 https://bugzilla.mozilla.org/show_bug.cgi?id=1336964 https://bugzilla.mozilla.org/show_bug.cgi?id=1336964 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7768 The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access, bypassing system protections against unprivileged users. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54. Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N References: 99057 99057 1038689 1038689 https://bugzilla.mozilla.org/show_bug.cgi?id=1336979 https://bugzilla.mozilla.org/show_bug.cgi?id=1336979 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7778 A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 99057 99057 1038689 1038689 RHSA-2017:1440 RHSA-2017:1440 RHSA-2017:1561 RHSA-2017:1561 RHSA-2017:1793 RHSA-2017:1793 https://bugzilla.mozilla.org/show_bug.cgi?id=1349310 https://bugzilla.mozilla.org/show_bug.cgi?id=1349310 https://bugzilla.mozilla.org/show_bug.cgi?id=1350047 https://bugzilla.mozilla.org/show_bug.cgi?id=1350047 https://bugzilla.mozilla.org/show_bug.cgi?id=1352745 https://bugzilla.mozilla.org/show_bug.cgi?id=1352745 https://bugzilla.mozilla.org/show_bug.cgi?id=1352747 https://bugzilla.mozilla.org/show_bug.cgi?id=1352747 https://bugzilla.mozilla.org/show_bug.cgi?id=1355174 https://bugzilla.mozilla.org/show_bug.cgi?id=1355174 https://bugzilla.mozilla.org/show_bug.cgi?id=1355182 https://bugzilla.mozilla.org/show_bug.cgi?id=1355182 https://bugzilla.mozilla.org/show_bug.cgi?id=1356607 https://bugzilla.mozilla.org/show_bug.cgi?id=1356607 https://bugzilla.mozilla.org/show_bug.cgi?id=1358551 https://bugzilla.mozilla.org/show_bug.cgi?id=1358551 GLSA-201710-13 GLSA-201710-13 DSA-3881 DSA-3881 DSA-3894 DSA-3894 DSA-3918 DSA-3918 https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-15/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-16/ https://www.mozilla.org/security/advisories/mfsa2017-17/ https://www.mozilla.org/security/advisories/mfsa2017-17/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7779 Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100201 100201 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1354443%2C1368576%2C1366903%2C1369913%2C1371424%2C1346590%2C1371890%2C1372985%2C1362924%2C1368105%2C1369994%2C1371283%2C1368362%2C1378826%2C1380426%2C1368030%2C1373220%2C1321384%2C1383002 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1354443%2C1368576%2C1366903%2C1369913%2C1371424%2C1346590%2C1371890%2C1372985%2C1362924%2C1368105%2C1369994%2C1371283%2C1368362%2C1378826%2C1380426%2C1368030%2C1373220%2C1321384%2C1383002 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7782 An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References: 100243 100243 1039124 1039124 https://bugzilla.mozilla.org/show_bug.cgi?id=1344034 https://bugzilla.mozilla.org/show_bug.cgi?id=1344034 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7784 A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100202 100202 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1376087 https://bugzilla.mozilla.org/show_bug.cgi?id=1376087 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7785 A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100206 100206 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1356985 https://bugzilla.mozilla.org/show_bug.cgi?id=1356985 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7786 A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100206 100206 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1365189 https://bugzilla.mozilla.org/show_bug.cgi?id=1365189 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7787 Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References: 100234 100234 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1322896 https://bugzilla.mozilla.org/show_bug.cgi?id=1322896 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7791 On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N References: 100240 100240 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1365875 https://bugzilla.mozilla.org/show_bug.cgi?id=1365875 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7792 A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100206 100206 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1368652 https://bugzilla.mozilla.org/show_bug.cgi?id=1368652 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7798 The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool. This vulnerability affects Firefox ESR < 52.3 and Firefox < 55. Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H References: 100198 100198 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1371586%2C1372112 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1371586%2C1372112 DSA-3928 DSA-3928 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7800 A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100196 100196 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1374047 https://bugzilla.mozilla.org/show_bug.cgi?id=1374047 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7801 A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100197 100197 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1371259 https://bugzilla.mozilla.org/show_bug.cgi?id=1371259 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7802 A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100202 100202 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1378147 https://bugzilla.mozilla.org/show_bug.cgi?id=1378147 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7803 When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References: 100234 100234 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1377426 https://bugzilla.mozilla.org/show_bug.cgi?id=1377426 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7804 The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory. This can be used to bypass existing memory protections in this situation. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N References: 100234 100234 1039124 1039124 https://bugzilla.mozilla.org/show_bug.cgi?id=1372849 https://bugzilla.mozilla.org/show_bug.cgi?id=1372849 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7807 A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: HIGH (8.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N References: 100242 100242 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1376459 https://bugzilla.mozilla.org/show_bug.cgi?id=1376459 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ Published: 2018-06-12 Modified: 2024-11-21 CVE-2017-7809 A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: 100203 100203 1039124 1039124 RHSA-2017:2456 RHSA-2017:2456 RHSA-2017:2534 RHSA-2017:2534 https://bugzilla.mozilla.org/show_bug.cgi?id=1380284 https://bugzilla.mozilla.org/show_bug.cgi?id=1380284 GLSA-201803-14 GLSA-201803-14 DSA-3928 DSA-3928 DSA-3968 DSA-3968 https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-18/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-19/ https://www.mozilla.org/security/advisories/mfsa2017-20/ https://www.mozilla.org/security/advisories/mfsa2017-20/ VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla Version: 2.1.0 Back to top