The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 52.0. It is, therefore, affected by multiple vulnerabilities :

  - Mozilla developers and community members Boris Zbarsky,     Christian Holler, Honza Bambas, Jon Coppeard, Randell     Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd     reported memory safety bugs present in Firefox 51 and     Firefox ESR 45.7. Some of these bugs showed evidence of     memory corruption and we presume that with enough     effort that some of these could be exploited to run     arbitrary code. (CVE-2017-5398)

  - Mozilla developers and community members Carsten Book,     Calixte Denizet, Christian Holler, Andrew McCreight,     David Bolter, David Keeler, Jon Coppeard, Tyson Smith,     Ronald Crane, Tooru Fujisawa, Ben Kelly, Bob Owen, Jed     Davis, Julian Seward, Julian Hector, Philipp, Markus     Stange, and Andre Bargull reported memory safety bugs     present in Firefox 51. Some of these bugs showed     evidence of memory corruption and we presume that with     enough effort that some of these could be exploited to     run arbitrary code. (CVE-2017-5399)

  - JIT-spray targeting asm.js combined with a heap spray     allows for a bypass of ASLR and DEP protections leading     to potential memory corruption attacks. (CVE-2017-5400)

  - A crash triggerable by web content in which an     ErrorResult references unassigned memory due to a logic     error. The resulting crash may be exploitable.
    (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a     FontFace object after the object has been already been     destroyed while working with fonts. This results in a     potentially exploitable crash. (CVE-2017-5402)

  - When adding a range to an object in the DOM, it is     possible to use addRange to add the range to an     incorrect root object. This triggers a use-after-free,     resulting in a potentially exploitable crash.
    (CVE-2017-5403)

  - A use-after-free error can occur when manipulating     ranges in selections with one node inside a native     anonymous tree and one node outside of it. This results     in a potentially exploitable crash. (CVE-2017-5404)

  - Certain response codes in FTP connections can result in     the use of uninitialized values for ports in FTP     operations. (CVE-2017-5405)

  - A segmentation fault can occur in the Skia graphics     library during some canvas operations due to issues     with mask/clip intersection and empty masks.
    (CVE-2017-5406)

  - Using SVG filters that don't use the fixed point math     implementation on a target iframe, a malicious page can     extract pixel values from a targeted user. This can be     used to extract history information and read text     values across domains. This violates same-origin policy     and leads to information disclosure. (CVE-2017-5407)

  - Video files loaded video captions cross-origin without     checking for the presence of CORS headers permitting     such cross-origin use, leading to potential information     disclosure for video captions. (CVE-2017-5408)

  - Memory corruption resulting in a potentially     exploitable crash during garbage collection of     JavaScript due errors in how incremental sweeping is     managed for memory cleanup. (CVE-2017-5410)

  - A buffer overflow read during SVG filter color value     operations, resulting in data exposure. (CVE-2017-5412)

  - A segmentation fault can occur during some     bidirectional layout operations. (CVE-2017-5413)

  - The file picker dialog can choose and display the wrong     local default directory when instantiated. On some     operating systems, this can lead to information     disclosure, such as the operating system or the local     account name. (CVE-2017-5414)

  - An attack can use a blob URL and script to spoof an     arbitrary addressbar URL prefaced by blob: as the     protocol, leading to user confusion and further     spoofing attacks. (CVE-2017-5415)

  - In certain circumstances a networking event listener     can be prematurely released. This appears to result in     a null dereference in practice. (CVE-2017-5416)

  - When dragging content from the primary browser pane to     the addressbar on a malicious site, it is possible to     change the addressbar so that the displayed location     following navigation does not match the URL of the     newly loaded page. This allows for spoofing attacks.
    (CVE-2017-5417)

  - An out of bounds read error occurs when parsing some     HTTP digest authorization responses, resulting in     information leakage through the reading of random     memory containing matches to specifically set patterns.
    (CVE-2017-5418)

  - If a malicious site repeatedly triggers a modal     authentication prompt, eventually the browser UI will     become non-responsive, requiring shutdown through the     operating system. This is a denial of service (DOS)     attack. (CVE-2017-5419)

  - A javascript: url loaded by a malicious page can     obfuscate its location by blanking the URL displayed in     the addressbar, allowing for an attacker to spoof an     existing page without the malicious page's address     being displayed correctly. (CVE-2017-5420)

  - A malicious site could spoof the contents of the print     preview window if popup windows are enabled, resulting     in user confusion of what site is currently loaded.
    (CVE-2017-5421)

  - If a malicious site uses the view-source: protocol in a     series within a single hyperlink, it can trigger a     non-exploitable browser crash when the hyperlink is     selected. This was fixed by no longer making     view-source: linkable. (CVE-2017-5422)

  - The Gecko Media Plugin sandbox allows access to local     files that match specific regular expressions. On OS     OX, this matching allows access to some data in     subdirectories of /private/var that could expose     personal or temporary data. This has been updated to     not allow access to /private/var and its     subdirectories. Note: this issue only affects OS X.
    Other operating systems are not affected.
    (CVE-2017-5425)

  - A non-existent chrome.manifest file will attempt to be     loaded during startup from the primary installation     directory. If a malicious user with local access puts     chrome.manifest and other referenced files in this     directory, they will be loaded and activated during     startup. This could result in malicious software being     added without consent or modification of referenced     installed files. (CVE-2017-5427)

Note that Tenable Network Security has extracted the preceding description block directly from the Mozilla security advisories.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow in WebGL triggerable by web content,     resulting in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5459)

  - An out-of-bounds read during the processing of glyph     widths during text layout. This results in a potentially     exploitable crash and could allow an attacker to read     otherwise inaccessible memory. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5447)

  - An out-of-bounds read when an HTTP/2 connection to a     servers sends DATA frames with incorrect data content.
    This leads to a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5446)

  - A possibly exploitable crash triggered during layout and     manipulation of bidirectional unicode text in concert     with CSS animations. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5449)

  - A use-after-free vulnerability during changes in style     when manipulating DOM elements. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5442)

  - An out-of-bounds write vulnerability while decoding     improperly formed BinHex format archives. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5443)

  - A buffer overflow vulnerability while parsing     application/http-index-format format content when the     header contains improperly formatted data. This allows     for an out-of-bounds read of data from memory. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5444)

  - A use-after-free vulnerability when holding a selection     during scroll events. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5441)

  - A potential memory corruption and crash when using Skia     content when drawing content outside of the bounds of a     clipping region. This vulnerability affects Thunderbird     < 52.1, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5467)

  - A mechanism to bypass file system access protections in     the sandbox to use the file picker to access different     files than those selected in the file picker through the     use of relative paths. This allows for read only access     to the local file system. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5454)

  - A mechanism to spoof the addressbar through the user     interaction on the addressbar and the onblur event.
    The event could be used by script to affect text display     to make the loaded site appear to be different from the     one actually loaded within the addressbar. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5451)

  - A use-after-free vulnerability occurs during certain     text input selection resulting in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5432)

  - A use-after-free vulnerability in frame selection     triggered by a combination of malicious script content     and key presses by a user. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5460)

  - During DOM manipulations of the accessibility tree     through script, the DOM tree can become out of sync with     the accessibility tree, leading to memory corruption and     a potentially exploitable crash. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5464)

  - Fixed potential buffer overflows in generated Firefox     code due to CVE-2016-6354 issue in Flex. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5469)

  - An out-of-bounds read while processing SVG content in     ConvolvePixel. This results in a crash and also allows     for otherwise inaccessible memory being copied into SVG     graphic content, which could then displayed. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5465)

  - If a page is loaded from an original site through a     hyperlink and contains a redirect to a data:text/html     URL, triggering a reload will run the reloaded     data:text/html page with its origin set incorrectly.
    This allows for a cross-site scripting (XSS) attack.
    This vulnerability affects Thunderbird < 52.1, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5466)

  - A use-after-free vulnerability in SMIL animation     functions occurs when pointers to animation elements in     an array are dropped from the animation controller while     still in use. This results in a potentially exploitable     crash. This vulnerability affects Thunderbird < 52.1,     Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5433)

  - A use-after-free vulnerability occurs when redirecting     focus handling which results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5434)

  - A use-after-free vulnerability during XSLT processing     due to the result handler being held by a freed handler     during handling. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR <     52.1, and Firefox < 53. (CVE-2017-5438)

  - A use-after-free vulnerability during XSLT processing     due to poor handling of template parameters. This     results in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5439)

  - A use-after-free vulnerability occurs during transaction     processing in the editor during design mode     interactions. This results in a potentially exploitable     crash. This vulnerability affects Thunderbird < 52.1,     Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5435)

  - Memory safety bugs were reported in Thunderbird 45.7.
    Some of these bugs showed evidence of memory corruption     and we presume that with enough effort that some of     these could be exploited to run arbitrary code. This     vulnerability affects Firefox < 52, Firefox ESR < 45.8,     Thunderbird < 52, and Thunderbird < 45.8.
    (CVE-2017-5398)

  - JIT-spray targeting asm.js combined with a heap spray     allows for a bypass of ASLR and DEP protections leading     to potential memory corruption attacks. This     vulnerability affects Firefox < 52, Firefox ESR < 45.8,     Thunderbird < 52, and Thunderbird < 45.8.
    (CVE-2017-5400)

  - A crash triggerable by web content in which an     ErrorResult references unassigned memory due to a     logic error. The resulting crash may be exploitable.
    This vulnerability affects Firefox < 52, Firefox ESR <     45.8, Thunderbird < 52, and Thunderbird < 45.8.
    (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a     FontFace object after the object has been already been     destroyed while working with fonts. This results in a     potentially exploitable crash. This vulnerability     affects Firefox < 52, Firefox ESR < 45.8, Thunderbird <     52, and Thunderbird < 45.8. (CVE-2017-5402)

  - A use-after-free error can occur when manipulating     ranges in selections with one node inside a native     anonymous tree and one node outside of it. This results     in a potentially exploitable crash. This vulnerability     affects Firefox < 52, Firefox ESR < 45.8, Thunderbird <     52, and Thunderbird < 45.8. (CVE-2017-5404)

  - Certain response codes in FTP connections can result in     the use of uninitialized values for ports in FTP     operations. This vulnerability affects Firefox < 52,     Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird <     45.8. (CVE-2017-5405)

  - Using SVG filters that don't use the fixed point math     implementation on a target iframe, a malicious page can     extract pixel values from a targeted user. This can be     used to extract history information and read text values     across domains. This violates same-origin policy and     leads to information disclosure. This vulnerability     affects Firefox < 52, Firefox ESR < 45.8, Thunderbird <     52, and Thunderbird < 45.8. (CVE-2017-5407)

  - Video files loaded video captions cross-origin without     checking for the presence of CORS headers permitting     such cross-origin use, leading to potential information     disclosure for video captions. This vulnerability     affects Firefox < 52, Firefox ESR < 45.8, Thunderbird <     52, and Thunderbird < 45.8. (CVE-2017-5408)

  - Memory corruption resulting in a potentially exploitable     crash during garbage collection of JavaScript due errors     in how incremental sweeping is managed for memory     cleanup. This vulnerability affects Firefox < 52,     Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird <     45.8. (CVE-2017-5410)

  - An out-of-bounds read vulnerability with the Opus     encoder when the number of channels in an audio stream     changes while the encoder is in use. This vulnerability     affects Firefox < 54, Firefox ESR < 52.2, and     Thunderbird < 52.2. (CVE-2017-7758)

  - A use-after-free vulnerability in IndexedDB when one of     its objects is destroyed in memory while a method on it     is still being executed. This results in a potentially     exploitable crash. This vulnerability affects Firefox <     54, Firefox ESR < 52.2, and Thunderbird < 52.2.
    (CVE-2017-7757)

  - A number of security vulnerabilities in the Graphite 2     library including out-of-bounds reads, buffer overflow     reads and writes, and the use of uninitialized memory.
    These issues were addressed in Graphite 2 version     1.3.10. This vulnerability affects Firefox < 54, Firefox     ESR < 52.2, and Thunderbird < 52.2. (CVE-2017-7778)

  - An out of bounds read vulnerability was found in     libevent in the search_make_new function. If an attacker     could cause an application using libevent to attempt     resolving an empty hostname, an out of bounds read could     occur possibly leading to a crash. (CVE-2016-10197)

  - A vulnerability was found in libevent with the parsing     of DNS requests and replies. An attacker could send a     forged DNS response to an application using libevent     which could lead to reading data out of bounds on the     heap, potentially disclosing a small amount of     application memory. (CVE-2016-10195)

  - A vulnerability was found in libevent with the parsing     of IPv6 addresses. If an attacker could cause an     application using libevent to parse a malformed address     in IPv6 notation of more than 2GiB in length, a stack     overflow would occur leading to a crash.
    (CVE-2016-10196)

  - A use-after-free vulnerability during video control     operations when a  element holds a reference to     an older window if that window has been replaced in the     DOM. This results in a potentially exploitable crash.
    This vulnerability affects Firefox < 54, Firefox ESR <     52.2, and Thunderbird < 52.2. (CVE-2017-7750)

  - A use-after-free and use-after-scope vulnerability when     logging errors from headers for XML HTTP Requests (XHR).
    This could result in a potentially exploitable crash.
    This vulnerability affects Firefox < 54, Firefox ESR <     52.2, and Thunderbird < 52.2. (CVE-2017-7756)

  - A use-after-free vulnerability when using an incorrect     URL during the reloading of a docshell. This results in     a potentially exploitable crash. This vulnerability     affects Firefox < 54, Firefox ESR < 52.2, and     Thunderbird < 52.2. (CVE-2017-7749)

  - A use-after-free vulnerability during specific user     interactions with the input method editor (IME) in some     languages due to how events are handled. This results in     a potentially exploitable crash but would require     specific user interaction to trigger. This vulnerability     affects Firefox < 54, Firefox ESR < 52.2, and     Thunderbird < 52.2. (CVE-2017-7752)

  - A use-after-free vulnerability with content viewer     listeners that results in a potentially exploitable     crash. This vulnerability affects Firefox < 54, Firefox     ESR < 52.2, and Thunderbird < 52.2. (CVE-2017-7751)

  - A use-after-free vulnerability with the frameloader     during tree reconstruction while regenerating CSS layout     when attempting to use a node in the tree that no longer     exists. This results in a potentially exploitable crash.
    This vulnerability affects Firefox < 54, Firefox ESR <     52.2, and Thunderbird < 52.2. (CVE-2017-5472)

  - An out-of-bounds read in WebGL with a maliciously     crafted ImageInfo object during WebGL operations. This     vulnerability affects Firefox < 54, Firefox ESR < 52.2,     and Thunderbird < 52.2. (CVE-2017-7754)

  - Memory safety bugs were reported in Firefox 53 and     Firefox ESR 52.1. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 54, Firefox     ESR < 52.2, and Thunderbird < 52.2. (CVE-2017-5470)

  - An out of bounds read flaw related to     graphite2::Silf::readGraphite has been reported in     graphite2. An attacker could possibly exploit this flaw     to disclose potentially sensitive memory or cause an     application crash. (CVE-2017-7774)

  - A heap-based buffer overflow flaw related to     lz4::decompress (src/Decompressor) has been reported     in graphite2. An attacker could exploit this issue to     cause a crash or, possibly, execute arbitrary code.
    (CVE-2017-7773)

  - A heap-based buffer overflow flaw related to     lz4::decompress has been reported in graphite2. An     attacker could exploit this issue to cause a crash or,     possibly, execute arbitrary code. (CVE-2017-7772)

  - An out of bounds read flaw related to     graphite2::Pass::readPass has been reported in     graphite2. An attacker could possibly exploit this flaw     to disclose potentially sensitive memory or cause an     application crash. (CVE-2017-7771)

  - The use of uninitialized memory related to     graphite2::GlyphCache::Loader::read_glyph has been     reported in graphite2. An attacker could possibly     exploit this flaw to negatively impact the execution of     an application using graphite2 in unknown ways.
    (CVE-2017-7777)

  - An out of bounds read flaw related to     graphite2::Silf::getClassGlyph has been reported in     graphite2. An attacker could possibly exploit this flaw     to disclose potentially sensitive memory or cause an     application crash. (CVE-2017-7776)

  - Characters from the Canadian Syllabics unicode block     can be mixed with characters from other unicode blocks     in the addressbar instead of being rendered as their raw     punycode form, allowing for domain name spoofing     attacks through character confusion. The current Unicode     standard allows characters from Aspirational Use     Scripts such as Canadian Syllabics to be mixed with     Latin characters in the moderately restrictive IDN     profile. We have changed Firefox behavior to match the     upcoming Unicode version 10.0 which removes this     category and treats them as Limited Use Scripts.. This     vulnerability affects Firefox < 54, Firefox ESR < 52.2,     and Thunderbird < 52.2. (CVE-2017-7764)

  - Memory safety bugs were reported in Firefox 52, Firefox     ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of     these bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could     be exploited to run arbitrary code. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5429)

  - A vulnerability while parsing application/http-index-     format format content where uninitialized values are     used to create an array. This could allow the reading of     uninitialized memory into the arrays affected. This     vulnerability affects Thunderbird < 52.1, Firefox ESR <     45.9, Firefox ESR < 52.1, and Firefox < 53.
    (CVE-2017-5445)

  - A use-after-free vulnerability during XSLT processing     due to a failure to propagate error conditions during     matching while evaluating context, leading to objects     being used when they no longer exist. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox     ESR < 52.1, and Firefox < 53. (CVE-2017-5440)

  - An out-of-bounds write in the Graphite 2 library     triggered with a maliciously crafted Graphite font. This     results in a potentially exploitable crash. This issue     was fixed in the Graphite 2 library as well as Mozilla     products. This vulnerability affects Thunderbird < 52.1,     Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <     53. (CVE-2017-5436)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 52.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-09 advisory.

  - Mozilla developers and community members Carsten Book, Calixte Denizet, Christian Holler, Andrew     McCreight, David Bolter, David Keeler, Jon Coppeard, Tyson Smith, Ronald Crane, Tooru Fujisawa, Ben Kelly,     Bob Owen, Jed Davis, Julian Seward, Julian Hector, Philipp, Markus Stange, and  Andr Bargull reported     memory safety bugs present in Firefox 51. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could be exploited to run arbitrary code.
    (CVE-2017-5399)

  - A segmentation fault can occur during some bidirectional layout operations. (CVE-2017-5413)

  - JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections     leading to potential memory corruption attacks. (CVE-2017-5400)

  - A crash triggerable by web content in which an <code>ErrorResult</code> references unassigned memory due     to a logic error. The resulting crash may be exploitable. (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a <code>FontFace</code> object after the object has     been already been destroyed while working with fonts. This results in a potentially exploitable crash.
    (CVE-2017-5402)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:0461 advisory.

    Mozilla Firefox is an open source web browser.

    This update upgrades Firefox to version 52.0 ESR.

    Security Fix(es):

    * Multiple flaws were found in the processing of malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the     user running Firefox. (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404,     CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5405)

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Nils,     Jerri Rice, Rh0, Anton Eliasson, David Kohlbrenner, Ivan Fratric of Google Project Zero, Anonymous, Eric     Lawrence of Chrome Security, Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup,     Andr Bargull, Kan-Ru Chen, and Nathan Froyd as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox installed on the remote Windows host is prior to 52.0. It is, therefore, affected by multiple vulnerabilities :

  - Mozilla developers and community members Boris Zbarsky,     Christian Holler, Honza Bambas, Jon Coppeard, Randell     Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd     reported memory safety bugs present in Firefox 51 and     Firefox ESR 45.7. Some of these bugs showed evidence of     memory corruption and we presume that with enough     effort that some of these could be exploited to run     arbitrary code. (CVE-2017-5398)

  - Mozilla developers and community members Carsten Book,     Calixte Denizet, Christian Holler, Andrew McCreight,     David Bolter, David Keeler, Jon Coppeard, Tyson Smith,     Ronald Crane, Tooru Fujisawa, Ben Kelly, Bob Owen, Jed     Davis, Julian Seward, Julian Hector, Philipp, Markus     Stange, and Andre Bargull reported memory safety bugs     present in Firefox 51. Some of these bugs showed     evidence of memory corruption and we presume that with     enough effort that some of these could be exploited to     run arbitrary code. (CVE-2017-5399)

  - JIT-spray targeting asm.js combined with a heap spray     allows for a bypass of ASLR and DEP protections leading     to potential memory corruption attacks. (CVE-2017-5400)

  - A crash triggerable by web content in which an     ErrorResult references unassigned memory due to a logic     error. The resulting crash may be exploitable.
    (CVE-2017-5401)

  - A use-after-free can occur when events are fired for a     FontFace object after the object has been already been     destroyed while working with fonts. This results in a     potentially exploitable crash. (CVE-2017-5402)

  - When adding a range to an object in the DOM, it is     possible to use addRange to add the range to an     incorrect root object. This triggers a use-after-free,     resulting in a potentially exploitable crash.
    (CVE-2017-5403)

  - A use-after-free error can occur when manipulating     ranges in selections with one node inside a native     anonymous tree and one node outside of it. This results     in a potentially exploitable crash. (CVE-2017-5404)

  - Certain response codes in FTP connections can result in     the use of uninitialized values for ports in FTP     operations. (CVE-2017-5405)

  - A segmentation fault can occur in the Skia graphics     library during some canvas operations due to issues     with mask/clip intersection and empty masks.
    (CVE-2017-5406)

  - Using SVG filters that don't use the fixed point math     implementation on a target iframe, a malicious page can     extract pixel values from a targeted user. This can be     used to extract history information and read text     values across domains. This violates same-origin policy     and leads to information disclosure. (CVE-2017-5407)

  - Video files loaded video captions cross-origin without     checking for the presence of CORS headers permitting     such cross-origin use, leading to potential information     disclosure for video captions. (CVE-2017-5408)

  - The Mozilla Windows updater can be called by a     non-privileged user to delete an arbitrary local file     by passing a special path to the callback parameter     through the Mozilla Maintenance Service, which has     privileged access. Note: This attack requires local     system access and only affects Windows. Other operating     systems are not affected. (CVE-2017-5409)

  - Memory corruption resulting in a potentially     exploitable crash during garbage collection of     JavaScript due errors in how incremental sweeping is     managed for memory cleanup. (CVE-2017-5410)

  - A use-after-free can occur during buffer storage     operations within the ANGLE graphics library, used for     WebGL content. The buffer storage can be freed while     still in use in some circumstances, leading to a     potentially exploitable crash. Note: This issue is in     libGLES, which is only in use on Windows. Other     operating systems are not affected. (CVE-2017-5411)

  - A buffer overflow read during SVG filter color value     operations, resulting in data exposure. (CVE-2017-5412)

  - A segmentation fault can occur during some     bidirectional layout operations. (CVE-2017-5413)

  - The file picker dialog can choose and display the wrong     local default directory when instantiated. On some     operating systems, this can lead to information     disclosure, such as the operating system or the local     account name. (CVE-2017-5414)

  - An attack can use a blob URL and script to spoof an     arbitrary addressbar URL prefaced by blob: as the     protocol, leading to user confusion and further     spoofing attacks. (CVE-2017-5415)

  - In certain circumstances a networking event listener     can be prematurely released. This appears to result in     a null dereference in practice. (CVE-2017-5416)

  - When dragging content from the primary browser pane to     the addressbar on a malicious site, it is possible to     change the addressbar so that the displayed location     following navigation does not match the URL of the     newly loaded page. This allows for spoofing attacks.
    (CVE-2017-5417)

  - An out of bounds read error occurs when parsing some     HTTP digest authorization responses, resulting in     information leakage through the reading of random     memory containing matches to specifically set patterns.
    (CVE-2017-5418)

  - If a malicious site repeatedly triggers a modal     authentication prompt, eventually the browser UI will     become non-responsive, requiring shutdown through the     operating system. This is a denial of service (DOS)     attack. (CVE-2017-5419)

  - A javascript: url loaded by a malicious page can     obfuscate its location by blanking the URL displayed in     the addressbar, allowing for an attacker to spoof an     existing page without the malicious page's address     being displayed correctly. (CVE-2017-5420)

  - A malicious site could spoof the contents of the print     preview window if popup windows are enabled, resulting     in user confusion of what site is currently loaded.
    (CVE-2017-5421)

  - If a malicious site uses the view-source: protocol in a     series within a single hyperlink, it can trigger a     non-exploitable browser crash when the hyperlink is     selected. This was fixed by no longer making     view-source: linkable. (CVE-2017-5422)

  - A non-existent chrome.manifest file will attempt to be     loaded during startup from the primary installation     directory. If a malicious user with local access puts     chrome.manifest and other referenced files in this     directory, they will be loaded and activated during     startup. This could result in malicious software being     added without consent or modification of referenced     installed files. (CVE-2017-5427)

Note that Tenable Network Security has extracted the preceding description block directly from the Mozilla security advisories.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code, ASLR bypass, information disclosure or denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 45.8.0esr-1~deb7u1.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for thunderbird is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 45.8.0.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5405)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Nils, Jerri Rice, Rh0, Anton Eliasson, David Kohlbrenner, Ivan Fratric of Google Project Zero, Anonymous, Eric Lawrence of Chrome Security, Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd as the original reporters.

This update for MozillaFirefox and mozilla-nss fixes the following issues :

MozillaFirefox was updated to Firefox 52.0 (boo#1028391)

  - requires NSS >= 3.28.3

  - Pages containing insecure password fields now display a     warning directly within username and password fields.

  - Send and open a tab from one device to another with Sync

  - Removed NPAPI support for plugins other than Flash.
    Silverlight, Java, Acrobat and the like are no longer     supported.

  - Removed Battery Status API to reduce fingerprinting of     users by trackers

  - MFSA 2017-05 CVE-2017-5400: asm.js JIT-spray bypass of     ASLR and DEP (bmo#1334933) CVE-2017-5401: Memory     Corruption when handling ErrorResult (bmo#1328861)     CVE-2017-5402: Use-after-free working with events in     FontFace objects (bmo#1334876) CVE-2017-5403:
    Use-after-free using addRange to add range to an     incorrect root object (bmo#1340186) CVE-2017-5404:
    Use-after-free working with ranges in selections     (bmo#1340138) CVE-2017-5406: Segmentation fault in Skia     with canvas operations (bmo#1306890) CVE-2017-5407:
    Pixel and history stealing via floating-point timing     side channel with SVG filters (bmo#1336622)     CVE-2017-5410: Memory corruption during JavaScript     garbage collection incremental sweeping (bmo#1330687)     CVE-2017-5408: Cross-origin reading of video captions in     violation of CORS (bmo#1313711) CVE-2017-5412: Buffer     overflow read in SVG filters (bmo#1328323)     CVE-2017-5413: Segmentation fault during bidirectional     operations (bmo#1337504) CVE-2017-5414: File picker can     choose incorrect default directory (bmo#1319370)     CVE-2017-5415: Addressbar spoofing through blob URL     (bmo#1321719) CVE-2017-5416: Null dereference crash in     HttpChannel (bmo#1328121) CVE-2017-5417: Addressbar     spoofing by draging and dropping URLs (bmo#791597)     CVE-2017-5426: Gecko Media Plugin sandbox is not started     if seccomp-bpf filter is running (bmo#1257361)     CVE-2017-5427: Non-existent chrome.manifest file loaded     during startup (bmo#1295542) CVE-2017-5418: Out of     bounds read when parsing HTTP digest authorization     responses (bmo#1338876) CVE-2017-5419: Repeated     authentication prompts lead to DOS attack (bmo#1312243)     CVE-2017-5420: Javascript: URLs can obfuscate addressbar     location (bmo#1284395) CVE-2017-5405: FTP response codes     can cause use of uninitialized values for ports     (bmo#1336699) CVE-2017-5421: Print preview spoofing     (bmo#1301876) CVE-2017-5422: DOS attack by using     view-source: protocol repeatedly in one hyperlink     (bmo#1295002) CVE-2017-5399: Memory safety bugs fixed in     Firefox 52 CVE-2017-5398: Memory safety bugs fixed in     Firefox 52 and Firefox ESR 45.8

mozilla-nss was updated to NSS 3.28.3

  - This is a patch release to fix binary compatibility     issues. NSS version 3.28, 3.28.1 and 3.28.2 contained     changes that were in violation with the NSS     compatibility promise. ECParams, which is part of the     public API of the freebl/softokn parts of NSS, had been     changed to include an additional attribute. That size     increase caused crashes or malfunctioning with     applications that use that data structure directly, or     indirectly through ECPublicKey, ECPrivateKey,     NSSLOWKEYPublicKey, NSSLOWKEYPrivateKey, or potentially     other data structures that reference ECParams. The     change has been reverted to the original state in bug     bmo#1334108. SECKEYECPublicKey had been extended with a     new attribute, named 'encoding'. If an application     passed type SECKEYECPublicKey to NSS (as part of     SECKEYPublicKey), the NSS library read the uninitialized     attribute. With this NSS release     SECKEYECPublicKey.encoding is deprecated. NSS no longer     reads the attribute, and will always set it to     ECPoint_Undefined. See bug bmo#1340103.

  - requires NSPR >= 4.13.1

  - update to NSS 3.28.2 This is a stability and     compatibility release. Below is a summary of the     changes.

  - Fixed a NSS 3.28 regression in the signature scheme     flexibility that causes connectivity issues between iOS     8 clients and NSS servers with ECDSA certificates     (bmo#1334114)

  - Fixed a possible crash on some Windows systems     (bmo#1323150)

  - Fixed a compatibility issue with TLS clients that do not     provide a list of supported key exchange groups     (bmo#1330612)

ID	Name	Product	Family	Published	Updated	Severity
97637	Mozilla Firefox < 52.0 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	3/9/2017	3/3/2026	critical
127347	NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0110)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	5/7/2024	critical
275695	Mozilla Thunderbird < 52.0	Nessus	MacOS X Local Security Checks	11/18/2025	11/18/2025	critical
97629	RHEL 7 : firefox (RHSA-2017:0461)	Nessus	Red Hat Local Security Checks	3/9/2017	4/15/2025	critical
97639	Mozilla Firefox < 52.0 Multiple Vulnerabilities	Nessus	Windows	3/9/2017	12/30/2025	critical
97668	Debian DLA-852-1 : firefox-esr security update	Nessus	Debian Local Security Checks	3/13/2017	12/30/2025	critical
97717	RHEL 5 / 6 / 7 : thunderbird (RHSA-2017:0498)	Nessus	Red Hat Local Security Checks	3/14/2017	12/30/2025	critical
97747	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2017-344)	Nessus	SuSE Local Security Checks	3/15/2017	12/30/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical