Versions of Mozilla Firefox earlier than 56 are unpatched for the following vulnerabilities :

 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in the 'js::AddPropertyTypesAfterProtoChange()' function in 'js/src/vm/NativeObject.cpp' that is triggered when handling the 'unknown-properties' flag. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'layout/style/nsCSSPseudoElements.cpp' that is triggered when handling pseudo-element atoms. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'dom/base/nsDocument.cpp' that is triggered when handling intersection observers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'LayerTransactionParent::Destroy()' function in 'gfx/layers/ipc/LayerTransactionParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'FPSCounter::PrintHistogram()' function in 'gfx/layers/composite/FPSCounter.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'FlagAllOperandsAsHavingRemovedUses()' function in 'js/src/jit/IonAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'memory/mozjemalloc/mozjemalloc.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ReadCompressedIndexDataValuesFromBlob()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'js/src/vm/StructuredClone.cpp' that is triggered when handling structured clone reads. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A flaw exists in 'editor/libeditor/HTMLEditor.cpp' that is triggered when handling root elements in the editor. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/GraphDriver.cpp' that is triggered when handling errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'hnj_hyphen_hyphword()' function in 'hyphen.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code within a process linked against the library.
 - A flaw exists in the 'EditorBase::FinalizeSelection()' function in 'editor/libeditor/EditorBase.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'DocAccessible::DoARIAOwnsRelocation()' function in 'accessible/generic/DocAccessible.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. No further details have been provided by the vendor.
 - A use-after-free condition exists in the Fetch API related to missing thread safety. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when pages enter fullscreen mode without user notification. This allows a context-dependent attacker to spoof the address bar.
 - A use-after-free error exists in 'accessible/generic/DocAccessible.cpp' that is triggered when manipulating Accessible Rich Internet Applications (ARIA) elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in design mode that is triggered when objects are resized. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'ssl3_HandleCertificateVerify()' function in 'lib/ssl/ssl3con.c' that is triggered when handling handshake hashes during TLS '1.2' exchanges. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as the content principal is not properly checked when handling drag and drop actions onto the browser UI. With specially crafted web content including file: URLs, a context-dependent attacker can open local files.
 - A flaw exists in the PendingLookup class in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered when handling downloads encoded with data: and blob: URL elements. This may allow a context-dependent attacker to bypass the phishing and malware protection feature.
 - An integer truncation flaw exists in the JavaScript parser that may allow a context-dependent attacker to potentially disclose memory contents.
 - A flaw exists in the 'MacOSFontEntry::ReadCMAP()' function in 'gfx/thebes/gfxMacPlatformFontList.mm' that is triggered as certain tibetan and arabic unicode characters are displayed as whitespace in combination with macOS fonts. With a specially crafted IDN domain, a context-dependent attacker can spoof a valid URL and conduct phishing attacks.
 - A flaw exists that is triggered when creating a modal dialog using the data: protocol via JavaScript. With a specially crafted web page, a context-dependent attacker can spoof the origin of the modal dialog.
 - A flaw exists in the WebExtensions component that is triggered when handling popups and panels in the extension UI. This may allow a context-dependent attacker to load an 'about:' URL.
 - A flaw exists in the WebExtensions component that is triggered when handling file downloads. This may allow a context-dependent attacker to download and open files without user interaction.
 - A flaw exists in the 'nsDocument::InitCSP()' function in 'dom/base/nsDocument.cpp' that is triggered as the sandbox directive does not create unique origin. This may result in incorrect enforcement of the content security policy (CSP).
 - A flaw exists in the WebCrypto API that is triggered as the AES-GCM implementation allows a zero-length IV. This may allow a context-dependent attacker to determine the authentication key.
 - A flaw exists that is is triggered as results of the 'instanceof' operator can be manipulated. With specially crafted web content, a context-dependent attacker can bypass the Xray wrapper mechanism.
 - An unspecified flaw exists that is triggered when drawing and validating elements with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.

Mozilla Foundation reports :

CVE-2017-7793: Use-after-free with Fetch API

CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode

CVE-2017-7818: Use-after-free during ARIA array manipulation

CVE-2017-7819: Use-after-free while resizing images in design mode

CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE

CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes

CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files

CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

CVE-2017-7813: Integer truncation in the JavaScript parser

CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces

CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations

CVE-2017-7816: WebExtensions can load about: URLs in extension UI

CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction

CVE-2017-7823: CSP sandbox directive did not create a unique origin

CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV

CVE-2017-7820: Xray wrapper bypass with new tab and web console

CVE-2017-7811: Memory safety bugs fixed in Firefox 56

CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 56. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable application crashes.

The version of Firefox installed on the remote Windows host is prior to 56.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-21 advisory.

  - Mozilla developers and community members Christian Holler, Jason Kratzer, Tobias Schneider, Tyson Smith,     David Keeler, Nicolas B. Pierron, Mike Hommey, Ronald Crane, Tooru Fujisawa, and Philipp reported memory     safety bugs present in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume     that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2017-7811)

  - A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for     WebGL content. This is due to an incorrect value being passed within the library during checks and results     in a potentially exploitable crash. (CVE-2017-7824)

  - A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are     freed when still in use, resulting in a potentially exploitable crash. (CVE-2017-7793)

  - A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification,     allowing a fake address bar to be displayed. This allows an attacker to spoof which page is actually     loaded and in use.  Note: This attack only affects Firefox for Android. Other operating systems are not     affected. (CVE-2017-7817)

  - A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications     (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash.
    (CVE-2017-7818)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 56.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-21 advisory.

  - Mozilla developers and community members Christian Holler, Jason Kratzer, Tobias Schneider, Tyson Smith,     David Keeler, Nicolas B. Pierron, Mike Hommey, Ronald Crane, Tooru Fujisawa, and Philipp reported memory     safety bugs present in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume     that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2017-7811)

  - A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for     WebGL content. This is due to an incorrect value being passed within the library during checks and results     in a potentially exploitable crash. (CVE-2017-7824)

  - A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are     freed when still in use, resulting in a potentially exploitable crash. (CVE-2017-7793)

  - A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification,     allowing a fake address bar to be displayed. This allows an attacker to spoof which page is actually     loaded and in use.  Note: This attack only affects Firefox for Android. Other operating systems are not     affected. (CVE-2017-7817)

  - A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications     (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash.
    (CVE-2017-7818)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
700321	Mozilla Firefox < 56 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/21/2018	3/6/2019	high
103556	FreeBSD : mozilla -- multiple vulnerabilities (1098a15b-b0f6-42b7-b5c7-8a8646e8be07)	Nessus	FreeBSD Local Security Checks	9/29/2017	11/19/2025	critical
103678	Mozilla Firefox < 56 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	10/6/2017	3/3/2026	critical
103680	Mozilla Firefox < 56.0	Nessus	Windows	10/6/2017	11/18/2025	critical
275634	Mozilla Firefox < 56.0	Nessus	MacOS X Local Security Checks	11/18/2025	11/18/2025	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical

critical