Denial of service vulnerability in multiple Mozilla products (CNVD-2017-07071)

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Address bar forgery vulnerability in multiple Mozilla products

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Buffer overflow vulnerability in multiple Mozilla products (CNVD-2017-07067)

Mozilla Firefox, FirefoxESR and Thunderbird are all developed by the Mozilla Foundation in the U.S. Firefox is an open-source web browser, and FirefoxESR is an extended-support version of Firefox.Thunderbird is a separate set of e-mail clients from the Thunderbird is a set of e-mail client softwa...

Information leakage vulnerability in several Mozilla products

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Memory misreference vulnerability in multiple Mozilla products (CNVD-2017-07059)

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Mozilla: Addressbar spoofing with onblur event (MFSA 2017-12)

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects...

Mozilla: Use-after-free in frame selection (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Mozilla: Memory corruption with accessibility and DOM manipulation (MFSA 2017-11, MFSA 2017-12)

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Mozilla: Use-after-free in nsTArray Length() during XSLT processing (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Security fix for the ALT Linux 10 package firefox-esr version 52.1.1-alt1

May 8, 2017 Andrey Cherepanov 52.1.1-alt1 - New ESR version 52.1.1 - Set plugin.loadflashonly setting to false to allow use all NPAPI plugins - Security fixes since 52.0: + CVE-2016-10196: Vulnerabilities in Libevent library + CVE-2017-5031: Use after free in ANGLE + CVE-2017-5428: integer overfl...

Security fix for the ALT Linux 10 package firefox-esr version 52.0-alt1

May 8, 2017 Andrey Cherepanov 52.0-alt1 - New release 52.0 based on legion@ build. - Built with internal icu. - Fixed: + CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP + CVE-2017-5401: Memory Corruption when handling ErrorResult + CVE-2017-5402: Use-after-free working with events in...

Mozilla Firefox ESR Security Advisories (MFSA2017-14, MFSA2017-14) - Windows

Mozilla Firefox ESR is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mozilla Releases Security Updates

Mozilla has released security updates to address a vulnerability in Firefox and Firefox ESR. An attacker could exploit this vulnerability to take control of an affected system. US-CERT encourages users and administrators to review the Mozilla Security Advisories for Firefox 53.0.2 and Firefox ESR...

Mozilla Firefox ESR < 52.1

The version of Firefox ESR installed on the remote Windows host is prior to 52.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-12 advisory. - Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. CVE-2017-5469 - A...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.1 to fix security and stability issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-firefox-45.9.0esr-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. Also,...

Mozilla: Use-after-free in SMIL animation functions (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox E...

Mozilla: Origin confusion when reloading isolated data:text/html URL (MFSA 2017-12)

If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting XSS attack. This vulnerability affects Thunderbi...

Mozilla: Use-after-free in frame selection (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Mozilla: Use-after-free during transaction processing in the editor (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Mozilla: Uninitialized values used while parsing application/http-index-format content (MFSA 2017-11, MFSA 2017-12)

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and...