The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3165-1 advisory.

    Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a     specially crafted message, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code. (CVE-2016-9893, CVE-2017-5373)

    Andrew Krasichkov discovered that event handlers on <marquee> elements were executed despite a Content     Security Policy (CSP) that disallowed inline JavaScript. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit this to conduct cross-site     scripting (XSS) attacks. (CVE-2016-9895)

    A memory corruption issue was discovered in WebGL in some circumstances. If a user were tricked in to     opening a specially crafted website in a browsing context, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9897)

    A use-after-free was discovered when manipulating DOM subtrees in the Editor. If a user were tricked in to     opening a specially crafted website in a browsing context, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9898)

    A use-after-free was discovered when manipulating DOM events and audio elements. If a user were tricked in     to opening a specially crafted website in a browsing context, an attacker could potentially exploit this     to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9899)

    It was discovered that external resources that should be blocked when loading SVG images can bypass     security restrictions using data: URLs. An attacker could potentially exploit this to obtain sensitive     information. (CVE-2016-9900)

    Jann Horn discovered that JavaScript Map/Set were vulnerable to timing attacks. If a user were tricked in     to opening a specially crafted website in a browsing context, an attacker could potentially exploit this     to obtain sensitive information across domains. (CVE-2016-9904)

    A crash was discovered in EnumerateSubDocuments while adding or removing sub-documents. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to execute arbitrary code. (CVE-2016-9905)

    JIT code allocation can allow a bypass of ASLR protections in some circumstances. If a user were tricked     in to opening a specially crafted website in a browsing context, an attacker could potentially exploit     this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5375)

    Nicolas Grgoire discovered a use-after-free when manipulating XSL in XSLT documents in some     circumstances. If a user were tricked in to opening a specially crafted website in a browsing context, an     attacker could potentially exploit this to cause a denial of service via application crash, or execute     arbitrary code. (CVE-2017-5376)

    Jann Horn discovered that an object's address could be discovered through hashed codes of JavaScript     objects shared between pages. If a user were tricked in to opening a specially crafted website in a     browsing context, an attacker could potentially exploit this to obtain sensitive information.
    (CVE-2017-5378)

    A use-after-free was discovered during DOM manipulation of SVG content in some circumstances. If a user     were tricked in to opening a specially crafted website in a browsing context, an attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-5380)

    Armin Razmjou discovered that certain unicode glyphs do not trigger punycode display. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to spoof the URL bar contents. (CVE-2017-5383)

    Jerri Rice discovered insecure communication methods in the Dev Tools JSON Viewer. An attacker could     potentially exploit this to gain additional privileges. (CVE-2017-5390)

    Filipe Gomes discovered a use-after-free in the media decoder in some circumstances. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-5396)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox.
    (CVE-2016-9079,CVE-2016-9893,CVE-2016-9895,CVE-2016-989     7,CVE-2016-9898,CVE-2016-9899,CVE-2016-9900,CVE-2016-99     01,CVE-2016-9902,CVE-2016-9904,CVE-2016-9905,CVE-2017-5     373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378,     CVE-2017-5380, CVE-2017-5383, CVE-2017-5386,     CVE-2017-5390, CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Mozilla Firefox ESR earlier than 45.6 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'GetNPObjectWrapper()' function in 'dom/plugins/base/nsJSNPRuntime.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ObjectGroup::defaultNewGroup()' function in 'js/src/vm/ObjectGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling HTML5 content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsDocShell::RestoreFromHistory()' function in 'docshell/base/nsDocShell.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'Factory::CreateDrawTargetForData()' function in 'gfx/2d/Factory.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaRecorder.cpp' that is triggered when handling a document's activity state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHttpChunkedDecoder::ParseChunkRemaining()' function in 'netwerk/protocol/http/nsHttpChunkedDecoder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling media content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocument::EnumerateSubDocuments()' function in 'dom/base/nsDocument.cpp' that is triggered when adding and removing sub-documents. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/BindingUtils.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling DOM subtrees. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'VaryingPacking::packVarying()' function in 'libANGLE/renderer/d3d/hlsl/VaryingPacking.cpp'. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling failing node adoption. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as event handlers for marquee elements are executed despite restrictions against inline JavaScript. This may allow a context-dependent attacker to bypass the Content Security Policy (CSP).
 - A flaw exists in the 'nsDataDocumentContentPolicy::ShouldLoad()' function in 'dom/base/nsDataDocumentContentPolicy.cpp', as external resources may be inappropriately loaded by SVG images by utilizing 'data: URLs'. This may allow a context-dependent attacker to disclose potentially sensitive cross-domain information.
 - A flaw exists that is triggered as HTML tags from the Pocket server are not properly sanitized before use. This may allow a context-dependent attacker to inject content and gain access to the Pocket Messaging API.
 - A flaw exists in 'browser/extensions/pocket/content/main.js' related to the Pocket toolbar button, as it fails to properly verify the origin of events. This may potentially allow a context-dependent attacker to execute commands from other contexts.
 - A flaw exists that is triggered as atom information may be exposed. This may allow a context-dependent attacker to use a JavaScript Map/Set timing attack to determine if atoms are used by other compartments or zones, potentially disclosing cross-domain information.

Versions of Mozilla Firefox prior to 50.1 are unpatched for the following vulnerabilities :

 - A flaw exists in 'layout/style/nsRuleNode.cpp' that is triggered when handling style contexts. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'GrResourceProvider::createBuffer()' function in 'gfx/skia/skia/src/gpu/GrResourceProvider.cpp'. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling clamped gradients. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A flaw exists in the 'GetNPObjectWrapper()' function in 'dom/plugins/base/nsJSNPRuntime.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ObjectGroup::defaultNewGroup()' function in 'js/src/vm/ObjectGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated when handling HTML5 content. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsDocShell::RestoreFromHistory()' function in 'docshell/base/nsDocShell.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'Factory::CreateDrawTargetForData()' function in 'gfx/2d/Factory.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaRecorder.cpp' that is triggered when handling a document's activity state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHttpChunkedDecoder::ParseChunkRemaining()' function in 'network/protocol/http/nsHttpChunkedDecoder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling media content. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/bindings/BindingUtils.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists because 'addon-sdk/source/lib/sdk/ui/frame/view.html' and 'addon-sdk/source/lib/sdk/ui/frame/view.js' within the Add-ons SDK do not properly validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and an add-on.
 - A use-after-free error exists in the handling of navigator objects within WebVR. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling DOM subtrees. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'VaryingPacking::packVarying()' function in 'libANGLE/renderer/d3d/hlsl/VaryingPacking.cpp'. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling failing node adoption. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as event handlers for marquee elements are executed despite restrictions against inline JavaScript. This may allow a context-dependent attacker to bypass the Content Security Policy (CSP).
 - A flaw exists in the 'nsDataDocumentContentPolicy::ShouldLoad()' function in 'dom/base/nsDataDocumentContentPolicy.cpp', as external resources may be inappropriately loaded by SVG images by utilizing 'data: URLs'. This may allow a context-dependent to disclose potentially sensitive cross-domain information.
 - A flaw exists that is triggered as HTML tags from the Pocket server are not properly sanitized before use. This may allow a context-dependent attacker to inject content and gain access to the Pocket Messaging API.
 - A flaw exists in 'browser/extensions/pocket/content/main.js' related to the Pocket toolbar button, as it fails to properly verify the origin of events. This may potentially allow a context-dependent attacker to execute commands from other contexts.
 - A flaw exists that is triggered as atom information may be exposed. This may allow a context-dependent attacker to use a JavaScript Map/Set timing attack to determine if atoms are used by other compartments or zones, potentially disclosing cross-domain information.

ID	Name	Product	Family	Published	Updated	Severity
96871	Ubuntu 14.04 LTS / 16.04 LTS : Thunderbird vulnerabilities (USN-3165-1)	Nessus	Ubuntu Local Security Checks	1/30/2017	8/27/2024	critical
99857	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1011)	Nessus	Huawei Local Security Checks	5/1/2017	6/22/2023	critical
9853	Mozilla Firefox ESR < 45.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/5/2017	11/6/2019	high
9851	Mozilla Firefox < 50.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/5/2017	3/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

high

high