Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 54.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 54.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-15 advisory.

  - A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer     overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2     version 1.3.10. (CVE-2017-7778)

  - A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS     layout when attempting to use a node in the tree that no longer exists. This results in a potentially     exploitable crash. (CVE-2017-5472)

  - A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This     results in a potentially exploitable crash. (CVE-2017-7749)

  - A use-after-free vulnerability during video control operations when a <code><track></code> element     holds a reference to an older window if that window has been replaced in the DOM. This results in a     potentially exploitable crash. (CVE-2017-7750)

  - A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable     crash. (CVE-2017-7751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption     and we presume that with enough effort that some of these could be exploited to run arbitrary code. This     vulnerability affects Firefox < 54. (CVE-2017-5471)

Note that Nessus relies on the presence of the package as reported by the vendor.

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, spoof the addressbar contents, or execute arbitrary code. (CVE-2017-5470, CVE-2017-5471, CVE-2017-5472, CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754, CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7762, CVE-2017-7764)

Multiple security issues were discovered in the Graphite 2 library used by Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, or execute arbitrary code. (CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Firefox installed on the remote Windows host is prior to 54.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-15 advisory.

  - A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer     overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2     version 1.3.10. (CVE-2017-7778)

  - A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS     layout when attempting to use a node in the tree that no longer exists. This results in a potentially     exploitable crash. (CVE-2017-5472)

  - A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This     results in a potentially exploitable crash. (CVE-2017-7749)

  - A use-after-free vulnerability during video control operations when a <code><track></code> element     holds a reference to an older window if that window has been replaced in the DOM. This results in a     potentially exploitable crash. (CVE-2017-7750)

  - A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable     crash. (CVE-2017-7751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 54. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code by convincing a user to visit a specially crafted     website. (CVE-2017-5470, CVE-2017-5471)

  - A use-after-free error exists in the EndUpdate()     function in nsCSSFrameConstructor.cpp that is triggered     when reconstructing trees during regeneration of CSS     layouts. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-5472)

  - A use-after-free error exists in the Reload() function     in nsDocShell.cpp that is triggered when using an     incorrect URL during the reload of a docshell. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7749)

  - A use-after-free error exists in the Hide() function in     nsDocumentViewer.cpp that is triggered when handling     track elements. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2017-7750)

  - A use-after-free error exists in the nsDocumentViewer     class in nsDocumentViewer.cpp that is triggered when     handling content viewer listeners. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7751)

  - A use-after-free error exists that is triggered when     handling events while specific user interaction occurs     with the input method editor (IME). An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7752)

  - An out-of-bounds read error exists in the IsComplete()     function in WebGLTexture.cpp that is triggered when     handling textures. An unauthenticated, remote attacker     can exploit this to disclose memory contents.
    (CVE-2017-7754)

  - A privilege escalation vulnerability exists due to     improper loading of dynamic-link library (DLL) files. A     local attacker can exploit this, via a specially crafted     DLL file in the installation path, to inject and execute     arbitrary code. (CVE-2017-7755)

  - A use-after-free error exists in the SetRequestHead()     function in XMLHttpRequestMainThread.cpp that is     triggered when logging XML HTTP Requests (XHR). An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7756)

  - A use-after-free error exists in ActorsParent.cpp due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-7757)

  - An out-of-bounds read error exists in the     AppendAudioSegment() function in TrackEncoder.cpp that     is triggered when the number of channels in an audio     stream changes while the Opus encoder is in use. An     unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-7758)

  - A flaw exists in the NS_main() function in updater.cpp     due to improper validation of input when handling     callback file path parameters. A local attacker can     exploit this to manipulate files in the installation     directory. (CVE-2017-7760)

  - A flaw exists in the Maintenance Service helper.exe     application that is triggered as permissions for a     temporary directory are set to writable by     non-privileged users. A local attacker can exploit this     to delete arbitrary files on the system. (CVE-2017-7761)

  - A flaw exists that is triggered when displaying URLs     including authentication sections in reader mode. An     unauthenticated, remote attacker can exploit this, via a     specially crafted URL, to spoof domains in the address     bar. (CVE-2017-7762)

  - A flaw exists in the ReadCMAP() function in     gfxMacPlatformFontList.mm that is triggered when     handling tibetan characters in combination with macOS     fonts. An unauthenticated, remote attacker can exploit     this, via a specially crafted IDN domain, to spoof a     valid URL. (CVE-2017-7763)

  - A flaw exists in the isLabelSafe() function in     nsIDNService.cpp that is triggered when handling     characters from different unicode blocks. An     unauthenticated, remote attacker can exploit this, via a     specially crafted IDN domain, to spoof a valid URL and     conduct phishing attacks. (CVE-2017-7764)

  - Multiple integer overflow conditions exist in the     Graphite component in the decompress() function in     Decompressor.cpp due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2017-7772,     CVE-2017-7778)

  - An out-of-bounds read error exists in the Graphite     component in the readGraphite() function in Silf.cpp. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or disclose memory     contents. (CVE-2017-7774)

  - An out-of-bounds read error exists in the Graphite     component in getClassGlyph() function in Silf.cpp due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-7776)

  - A flaw exists in the Graphite component in the     read_glyph() function in GlyphCache.cpp related to use     of uninitialized memory. An unauthenticated, remote     attacker can exploit this to have an unspecified impact.
    (CVE-2017-7777)

Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code by convincing a user to visit a specially crafted website. (CVE-2017-5470, CVE-2017-5471)
 - A use-after-free error exists in the 'EndUpdate()' function in 'nsCSSFrameConstructor.cpp' that is triggered when reconstructing trees during regeneration of CSS layouts. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-5472)
 - A use-after-free error exists in the 'Reload()' function in 'nsDocShell.cpp' that is triggered when using an incorrect URL during the reload of a docshell. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7749)
 - A use-after-free error exists in the 'Hide()' function in 'nsDocumentViewer.cpp' that is triggered when handling track elements. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7750)
 - A use-after-free error exists in the nsDocumentViewer class in 'nsDocumentViewer.cpp' that is triggered when handling content viewer listeners. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7751)
 - A use-after-free error exists that is triggered when handling events while specific user interaction occurs with the input method editor (IME). An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7752)
 - An out-of-bounds read error exists in the 'IsComplete()' function in 'WebGLTexture.cpp' that is triggered when handling textures. An unauthenticated, remote attacker can exploit this to disclose memory contents. (CVE-2017-7754)
 - A privilege escalation vulnerability exists due to improper loading of dynamic-link library (DLL) files. A local attacker can exploit this, via a specially crafted DLL file in the installation path, to inject and execute arbitrary code. (CVE-2017-7755)
 - A use-after-free error exists in the 'SetRequestHead()' function in 'XMLHttpRequestMainThread.cpp' that is triggered when logging XML HTTP Requests (XHR). An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7756)
 - A use-after-free error exists in 'ActorsParent.cpp' due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7757)
 - An out-of-bounds read error exists in the 'AppendAudioSegment()' function in 'TrackEncoder.cpp' that is triggered when the number of channels in an audio stream changes while the Opus encoder is in use. An unauthenticated, remote attacker can exploit this to disclose sensitive information. (CVE-2017-7758)
 - A flaw exists in the 'NS_main()' function in 'updater.cpp' due to improper validation of input when handling callback file path parameters. A local attacker can exploit this to manipulate files in the installation directory. (CVE-2017-7760)
 - A flaw exists in the Maintenance Service 'helper.exe' application that is triggered as permissions for a temporary directory are set to writable by non-privileged users. A local attacker can exploit this to delete arbitrary files on the system. (CVE-2017-7761)
 - A flaw exists that is triggered when displaying URLs including authentication sections in reader mode. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to spoof domains in the address bar. (CVE-2017-7762)
 - A flaw exists in the 'ReadCMAP()' function in 'gfxMacPlatformFontList.mm' that is triggered when handling tibetan characters in combination with macOS fonts. An unauthenticated, remote attacker can exploit this, via a specially crafted IDN domain, to spoof a valid URL. (CVE-2017-7763)
 - A flaw exists in the 'isLabelSafe()' function in 'nsIDNService.cpp' that is triggered when handling characters from different unicode blocks. An unauthenticated, remote attacker can exploit this, via a specially crafted IDN domain, to spoof a valid URL and conduct phishing attacks. (CVE-2017-7764)
 - Multiple integer overflow conditions exist in the Graphite component in the 'decompress()' function in 'Decompressor.cpp' due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7772, CVE-2017-7778)
 - An out-of-bounds read error exists in the Graphite component in the 'readGraphite()' function in 'Silf.cpp'. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents. (CVE-2017-7774)
 - An out-of-bounds read error exists in the Graphite component in 'getClassGlyph()' function in 'Silf.cpp' due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2017-7776)
 - An flaw exists in the Graphite component in the 'read_glyph()' function in 'GlyphCache.cpp' related to use of uninitialized memory. An unauthenticated, remote attacker can exploit this to have an unspecified impact. (CVE-2017-7777)

Mozilla Foundation reports :

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
275614	Mozilla Firefox < 54.0	Nessus	MacOS X Local Security Checks	critical
248221	Linux Distros Unpatched Vulnerability : CVE-2017-5471	Nessus	Misc.	critical
100835	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3315-1)	Nessus	Ubuntu Local Security Checks	critical
100810	Mozilla Firefox < 54.0	Nessus	Windows	critical
100808	Mozilla Firefox < 54 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
700134	Mozilla Firefox < 54 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
100775	FreeBSD : mozilla -- multiple vulnerabilities (6cec1b0a-da15-467d-8691-1dea392d4c8d)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-5471

critical

Tenable Plugins

critical

critical

critical

critical

critical

high

critical