ID USN-3435-1 Type ubuntu Reporter Ubuntu Modified 2017-10-02T00:00:00
Description
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain sensitive information, bypass phishing and malware protection, spoof the origin in modal dialogs, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824)
Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7805)
Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to download and open non-executable files without interaction, or obtain elevated privileges. (CVE-2017-7816, CVE-2017-7821)
{"history": [], "description": "Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain sensitive information, bypass phishing and malware protection, spoof the origin in modal dialogs, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824)\n\nMartin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7805)\n\nMultiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to download and open non-executable files without interaction, or obtain elevated privileges. (CVE-2017-7816, CVE-2017-7821)", "affectedPackage": [{"OSVersion": "16.04", "OS": "Ubuntu", "arch": "noarch", "operator": "lt", "packageFilename": "UNKNOWN", "packageName": "firefox", "packageVersion": "56.0+build6-0ubuntu0.16.04.1"}, {"OSVersion": "14.04", "OS": "Ubuntu", "arch": "noarch", "operator": "lt", "packageFilename": "UNKNOWN", "packageName": "firefox", "packageVersion": "56.0+build6-0ubuntu0.14.04.1"}, {"OSVersion": "17.04", "OS": "Ubuntu", "arch": "noarch", "operator": "lt", "packageFilename": "UNKNOWN", "packageName": "firefox", "packageVersion": "56.0+build6-0ubuntu0.17.04.1"}], "reporter": "Ubuntu", "href": "https://usn.ubuntu.com/3435-1/", "type": "ubuntu", "hashmap": [{"key": "affectedPackage", "hash": "007221992881ea869f46c9b8abcb8470"}, {"key": "bulletinFamily", "hash": "4913a9178621eadcdf191db17915fbcb"}, {"key": "cvelist", "hash": "1464c3aab1df574fe9fefd4c020a915a"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "b166361f331d885d59f8dfb2d5c6d4fe"}, {"key": "href", "hash": "c550abf5b68c3b4ea6e38b69def0ed33"}, {"key": "modified", "hash": "3db1b146de566df7a8886805a31d637b"}, {"key": "published", "hash": "3db1b146de566df7a8886805a31d637b"}, {"key": "references", "hash": "1f0e75c173180ba42513e940d93235b1"}, {"key": "reporter", "hash": "3d945423f8e9496c429a5d8c65b4604f"}, {"key": "title", "hash": "56c07d06aeca91d4fcd6eed6c8d8db87"}, {"key": "type", "hash": "1d41c853af58d3a7ae54990ce29417d8"}], "viewCount": 0, "references": ["https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7816", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7812", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7818", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7819", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7815", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7821", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7810", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7823", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7805", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7820", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7822", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7824", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7793", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7813", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7811", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-7814"], "lastseen": "2018-03-29T18:18:03", "published": "2017-10-02T00:00:00", "objectVersion": "1.3", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7822", "CVE-2017-7815", "CVE-2017-7821", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7820", "CVE-2017-7813", "CVE-2017-7811", "CVE-2017-7812", "CVE-2017-7819", "CVE-2017-7816", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "id": "USN-3435-1", "hash": "78cf6e74103e5caafd563f31d576e7be04aac7d3e91c76a2fd23c3fce72d221e", "modified": "2017-10-02T00:00:00", "title": "Firefox vulnerabilities", "edition": 1, "cvss": {"score": 0.0, "vector": "NONE"}, "bulletinFamily": "unix", "enchantments": {"vulnersScore": 6.8}}
{"result": {"cve": [{"id": "CVE-2017-7824", "type": "cve", "title": "CVE-2017-7824", "description": "A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.", "published": "2018-06-11T17:29:11", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7824", "cvelist": ["CVE-2017-7824"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7810", "type": "cve", "title": "CVE-2017-7810", "description": "Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.", "published": "2018-06-11T17:29:10", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7810", "cvelist": ["CVE-2017-7810"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7822", "type": "cve", "title": "CVE-2017-7822", "description": "The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification. This might allow for the authentication key to be determined in some instances. This vulnerability affects Firefox < 56.", "published": "2018-06-11T17:29:10", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7822", "cvelist": ["CVE-2017-7822"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7815", "type": "cve", "title": "CVE-2017-7815", "description": "On pages containing an iframe, the \"data:\" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiprocess turned off. Installations with e10s turned on do not support the modal dialog functionality. This vulnerability affects Firefox < 56.", "published": "2018-06-11T17:29:10", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7815", "cvelist": ["CVE-2017-7815"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7821", "type": "cve", "title": "CVE-2017-7821", "description": "A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those document types. This vulnerability affects Firefox < 56.", "published": "2018-06-11T17:29:10", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7821", "cvelist": ["CVE-2017-7821"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7805", "type": "cve", "title": "CVE-2017-7805", "description": "During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.", "published": "2018-06-11T17:29:10", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7805", "cvelist": ["CVE-2017-7805"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7823", "type": "cve", "title": "CVE-2017-7823", "description": "The content security policy (CSP) \"sandbox\" directive did not create a unique origin for the document, causing it to behave as if the \"allow-same-origin\" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.", "published": "2018-06-11T17:29:11", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7823", "cvelist": ["CVE-2017-7823"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7820", "type": "cve", "title": "CVE-2017-7820", "description": "The \"instanceof\" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects Firefox < 56.", "published": "2018-06-11T17:29:10", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7820", "cvelist": ["CVE-2017-7820"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7813", "type": "cve", "title": "CVE-2017-7813", "description": "Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. This vulnerability affects Firefox < 56.", "published": "2018-06-11T17:29:10", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7813", "cvelist": ["CVE-2017-7813"], "lastseen": "2018-06-13T10:45:36"}, {"id": "CVE-2017-7811", "type": "cve", "title": "CVE-2017-7811", "description": "Memory safety bugs were reported in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56.", "published": "2018-06-11T17:29:10", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7811", "cvelist": ["CVE-2017-7811"], "lastseen": "2018-06-13T10:45:36"}], "nessus": [{"id": "OPENSUSE-2017-1114.NASL", "type": "nessus", "title": "openSUSE Security Update : Mozilla Firefox and NSS (openSUSE-2017-1114)", "description": "This update to Mozilla Firefox 52.4esr, along with Mozilla NSS 3.28.6, fixes security issues and bugs. The following vulnerabilities advised upstream under MFSA 2017-22 (boo#1060445) were fixed :\n\n - CVE-2017-7793: Use-after-free with Fetch API\n\n - CVE-2017-7818: Use-after-free during ARIA array manipulation\n\n - CVE-2017-7819: Use-after-free while resizing images in design mode\n\n - CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE\n\n - CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings\n\n - CVE-2017-7823: CSP sandbox directive did not create a unique origin\n\n - CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4 The following security issue was fixed in Mozilla NSS 3.28.6 :\n\n - CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005)\n\nThe following bug was fixed :\n\n - boo#1029917: language accept header use incorrect locale\n\nFor compatibility reasons, java-1_8_0-openjdk was rebuilt to the updated version of NSS.", "published": "2017-10-03T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103621", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-11-17T00:52:00"}, {"id": "CENTOS_RHSA-2017-2831.NASL", "type": "nessus", "title": "CentOS 6 / 7 : firefox (CESA-2017:2831)", "description": "An update for firefox is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nMozilla Firefox is an open source web browser.\n\nThis update upgrades Firefox to version 52.4.0 ESR.\n\nSecurity Fix(es) :\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, Sebastian Hengst, Abhishek Arya, Nils, Omair, Andre Weissflog, Francois Marier, and Jun Kokatsu as the original reporters.", "published": "2017-10-02T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103573", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-06-14T07:54:58"}, {"id": "EULEROS_SA-2017-1249.NASL", "type": "nessus", "title": "EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1249)", "description": "According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2017-10-19T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103940", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-06-14T07:41:57"}, {"id": "REDHAT-RHSA-2017-2885.NASL", "type": "nessus", "title": "RHEL 6 / 7 : thunderbird (RHSA-2017:2885)", "description": "An update for thunderbird is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nMozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 52.4.0.\n\nSecurity Fix(es) :\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, Sebastian Hengst, Abhishek Arya, Nils, Omair, Andre Weissflog, Francois Marier, and Jun Kokatsu as the original reporters.", "published": "2017-10-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103805", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-29T13:41:50"}, {"id": "SL_20171012_THUNDERBIRD_ON_SL6_X.NASL", "type": "nessus", "title": "Scientific Linux Security Update : thunderbird on SL6.x, SL7.x i386/x86_64", "description": "This update upgrades Thunderbird to version 52.4.0.\n\nSecurity Fix(es) :\n\n - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)", "published": "2017-10-13T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103831", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-29T13:45:02"}, {"id": "ORACLELINUX_ELSA-2017-2831.NASL", "type": "nessus", "title": "Oracle Linux 6 / 7 : firefox (ELSA-2017-2831)", "description": "From Red Hat Security Advisory 2017:2831 :\n\nAn update for firefox is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nMozilla Firefox is an open source web browser.\n\nThis update upgrades Firefox to version 52.4.0 ESR.\n\nSecurity Fix(es) :\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, Sebastian Hengst, Abhishek Arya, Nils, Omair, Andre Weissflog, Francois Marier, and Jun Kokatsu as the original reporters.", "published": "2017-09-29T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103558", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-11-17T00:40:01"}, {"id": "MACOSX_FIREFOX_52_4_ESR.NASL", "type": "nessus", "title": "Mozilla Firefox ESR < 52.4 Multiple Vulnerabilities (macOS)", "description": "The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.4. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.", "published": "2017-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103677", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818"], "lastseen": "2017-11-17T00:49:20"}, {"id": "EULEROS_SA-2017-1248.NASL", "type": "nessus", "title": "EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1248)", "description": "According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2017-10-19T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103939", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-06-14T07:42:19"}, {"id": "MOZILLA_FIREFOX_52_4_ESR.NASL", "type": "nessus", "title": "Mozilla Firefox ESR < 52.4 Multiple Vulnerabilities", "description": "The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 52.4. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.", "published": "2017-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103679", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818"], "lastseen": "2018-03-31T05:11:43"}, {"id": "SUSE_SU-2017-2688-1.NASL", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2017:2688-1)", "description": "This update for MozillaFirefox to ESR 52.4, mozilla-nss fixes the following issues: This security issue was fixed for mozilla-nss :\n\n - CVE-2017-7805: Prevent use-after-free in TLS 1.2 when generating handshake hashes (bsc#1061005) These security issues were fixed for Firefox\n\n - CVE-2017-7825: Fixed some Tibetan and Arabic unicode characters rendering (bsc#1060445).\n\n - CVE-2017-7805: Prevent Use-after-free in TLS 1.2 generating handshake hashes (bsc#1060445).\n\n - CVE-2017-7819: Prevent Use-after-free while resizing images in design mode (bsc#1060445).\n\n - CVE-2017-7818: Prevent Use-after-free during ARIA array manipulation (bsc#1060445).\n\n - CVE-2017-7793: Prevent Use-after-free with Fetch API (bsc#1060445).\n\n - CVE-2017-7824: Prevent Buffer overflow when drawing and validating elements with ANGLE (bsc#1060445).\n\n - CVE-2017-7810: Fixed several memory safety bugs (bsc#1060445).\n\n - CVE-2017-7823: CSP sandbox directive did not create a unique origin (bsc#1060445).\n\n - CVE-2017-7814: Blob and data URLs bypassed phishing and malware protection warnings (bsc#1060445).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2017-10-11T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103768", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-29T13:37:04"}], "openvas": [{"id": "OPENVAS:1361412562310851624", "type": "openvas", "title": "SuSE Update for Mozilla openSUSE-SU-2017:2615-1 (Mozilla)", "description": "Check the version of Mozilla", "published": "2017-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851624", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-12-12T11:22:27"}, {"id": "OPENVAS:1361412562310891118", "type": "openvas", "title": "Debian LTS Advisory ([SECURITY] [DLA 1118-1] firefox-esr security update)", "description": "Several security issues have been found in the Mozilla Firefox web\nbrowser: Multiple memory safety errors, use-after-frees, buffer\noverflows and other implementation errors may lead to the execution of\narbitrary code, denial of service, cross-site scripting or bypass of\nthe phishing and malware protection feature.", "published": "2018-02-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891118", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-03-29T18:47:58"}, {"id": "OPENVAS:1361412562310811941", "type": "openvas", "title": "Mozilla Thunderbird Security Updates( mfsa_2017-23_2017-23 )-MAC OS X", "description": "This host is installed with Mozilla\n Thunderbird and is prone to multiple vulnerabilities.", "published": "2017-10-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310811941", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-16T10:21:18"}, {"id": "OPENVAS:1361412562310811849", "type": "openvas", "title": "Mozilla Firefox ESR Security Updates(mfsa_2017-21_2017-22)-Windows", "description": "This host is installed with\n Mozilla Firefox ESR and is prone to multiple vulnerabilities.", "published": "2017-10-04T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310811849", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-05-23T14:57:03"}, {"id": "OPENVAS:1361412562310811851", "type": "openvas", "title": "Mozilla Firefox ESR Security Updates(mfsa_2017-21_2017-22)-MAC OS X", "description": "This host is installed with\n Mozilla Firefox ESR and is prone to multiple vulnerabilities.", "published": "2017-10-04T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310811851", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-05-23T14:57:04"}, {"id": "OPENVAS:1361412562310704014", "type": "openvas", "title": "Debian Security Advisory DSA 4014-1 (thunderbird - security update)", "description": "Multiple security issues have been found in Thunderbird, which may lead\nto the execution of arbitrary code or denial of service.", "published": "2017-11-01T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704014", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-11-06T13:03:10"}, {"id": "OPENVAS:1361412562310812009", "type": "openvas", "title": "RedHat Update for firefox RHSA-2017:2831-01", "description": "Check the version of firefox", "published": "2017-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812009", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-09T12:10:55"}, {"id": "OPENVAS:1361412562310843338", "type": "openvas", "title": "Ubuntu Update for thunderbird USN-3436-1", "description": "Check the version of thunderbird", "published": "2017-10-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843338", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-04-30T14:17:53"}, {"id": "OPENVAS:1361412562310812034", "type": "openvas", "title": "RedHat Update for thunderbird RHSA-2017:2885-01", "description": "Check the version of thunderbird", "published": "2017-10-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812034", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-17T18:25:43"}, {"id": "OPENVAS:1361412562310703987", "type": "openvas", "title": "Debian Security Advisory DSA 3987-1 (firefox-esr - security update)", "description": "Several security issues have been found in the Mozilla Firefox web\nbrowser: Multiple memory safety errors, use-after-frees, buffer\noverflows and other implementation errors may lead to the execution of\narbitrary code, denial of service, cross-site scripting or bypass of\nthe phishing and malware protection feature.", "published": "2017-09-29T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703987", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-09T12:10:47"}], "suse": [{"id": "SUSE-SU-2017:2688-1", "type": "suse", "title": "Security update for MozillaFirefox, mozilla-nss (important)", "description": "This update for MozillaFirefox to ESR 52.4, mozilla-nss fixes the\n following issues:\n\n This security issue was fixed for mozilla-nss:\n\n - CVE-2017-7805: Prevent use-after-free in TLS 1.2 when generating\n handshake hashes (bsc#1061005)\n\n These security issues were fixed for Firefox\n\n - CVE-2017-7825: Fixed some Tibetan and Arabic unicode characters\n rendering (bsc#1060445).\n - CVE-2017-7805: Prevent Use-after-free in TLS 1.2 generating handshake\n hashes (bsc#1060445).\n - CVE-2017-7819: Prevent Use-after-free while resizing images in design\n mode (bsc#1060445).\n - CVE-2017-7818: Prevent Use-after-free during ARIA array manipulation\n (bsc#1060445).\n - CVE-2017-7793: Prevent Use-after-free with Fetch API (bsc#1060445).\n - CVE-2017-7824: Prevent Buffer overflow when drawing and validating\n elements with ANGLE (bsc#1060445).\n - CVE-2017-7810: Fixed several memory safety bugs (bsc#1060445).\n - CVE-2017-7823: CSP sandbox directive did not create a unique origin\n (bsc#1060445).\n - CVE-2017-7814: Blob and data URLs bypassed phishing and malware\n protection warnings (bsc#1060445).\n\n", "published": "2017-10-10T15:09:53", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00008.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-10T17:54:31"}, {"id": "OPENSUSE-SU-2017:2615-1", "type": "suse", "title": "Security update for Mozilla Firefox and NSS (important)", "description": "This update to Mozilla Firefox 52.4esr, along with Mozilla NSS 3.28.6,\n fixes security issues and bugs.\n\n The following vulnerabilities advised upstream under MFSA 2017-22\n (boo#1060445) were fixed:\n\n - CVE-2017-7793: Use-after-free with Fetch API\n - CVE-2017-7818: Use-after-free during ARIA array manipulation\n - CVE-2017-7819: Use-after-free while resizing images in design mode\n - CVE-2017-7824: Buffer overflow when drawing and validating elements with\n ANGLE\n - CVE-2017-7814: Blob and data URLs bypass phishing and malware protection\n warnings\n - CVE-2017-7823: CSP sandbox directive did not create a unique origin\n - CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR\n 52.4\n\n The following security issue was fixed in Mozilla NSS 3.28.6:\n\n - CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes\n (bsc#1061005)\n\n The following bug was fixed:\n\n - boo#1029917: language accept header use incorrect locale\n\n For compatibility reasons, java-1_8_0-openjdk was rebuilt to the updated\n version of NSS.\n\n", "published": "2017-10-02T18:09:14", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00002.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-02T19:53:49"}, {"id": "OPENSUSE-SU-2017:2707-1", "type": "suse", "title": "Security update for MozillaThunderbird (important)", "description": "Mozilla Thunderbird was updated to 52.4.0 (boo#1060445)\n * new behavior was introduced for replies to mailing list posts: "When\n replying to a mailing list, reply will be sent to address in From\n header ignoring Reply-to header". A new preference\n mail.override_list_reply_to allows to restore the previous behavior.\n * Under certain circumstances (image attachment and non-image\n attachment), attached images were shown truncated in messages stored\n in IMAP folders not synchronised for offline use.\n * IMAP UIDs > 0x7FFFFFFF now handled properly Security fixes from Gecko\n 52.4esr\n * CVE-2017-7793 (bmo#1371889) Use-after-free with Fetch API\n * CVE-2017-7818 (bmo#1363723) Use-after-free during ARIA array\n manipulation\n * CVE-2017-7819 (bmo#1380292) Use-after-free while resizing images in\n design mode\n * CVE-2017-7824 (bmo#1398381) Buffer overflow when drawing and\n validating elements with ANGLE\n * CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement) Use-after-free\n in TLS 1.2 generating handshake hashes\n * CVE-2017-7814 (bmo#1376036) Blob and data URLs bypass phishing and\n malware protection warnings\n * CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only) OS X fonts render\n some Tibetan and Arabic unicode characters as spaces\n * CVE-2017-7823 (bmo#1396320) CSP sandbox directive did not create a\n unique origin\n * CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR\n 52.4\n\n - Add alsa-devel BuildRequires: we care for ALSA support to be built and\n thus need to ensure we get the dependencies in place. In the past,\n alsa-devel was pulled in by accident: we buildrequire libgnome-devel.\n This required esound-devel and that in turn pulled in alsa-devel for us.\n libgnome is being fixed to no longer require esound-devel.\n\n", "published": "2017-10-12T00:11:14", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00013.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-12T01:54:37"}, {"id": "SUSE-SU-2017:2872-2", "type": "suse", "title": "Security update for MozillaFirefox, mozilla-nss (important)", "description": "This update for MozillaFirefox and mozilla-nss fixes the following issues:\n\n Mozilla Firefox was updated to ESR 52.4 (bsc#1060445)\n\n * MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic\n unicode characters as spaces\n * MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating\n handshake hashes\n * MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in\n design mode\n * MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation\n * MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API\n * MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating\n elements with ANGLE\n * MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and\n Firefox ESR 52.4\n * MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a\n unique origin\n * MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and\n malware protection warnings\n\n Mozilla Network Security Services (Mozilla NSS) received a security fix:\n\n * MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating\n handshake hashes (bsc#1061005, bsc#1060445)\n\n", "published": "2017-11-13T21:08:19", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2017-11/msg00024.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-11-14T00:33:44"}, {"id": "SUSE-SU-2017:2872-1", "type": "suse", "title": "Security update for MozillaFirefox, mozilla-nss (important)", "description": "This update for MozillaFirefox and mozilla-nss fixes the following issues:\n\n Mozilla Firefox was updated to ESR 52.4 (bsc#1060445)\n\n * MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic\n unicode characters as spaces\n * MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating\n handshake hashes\n * MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in\n design mode\n * MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation\n * MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API\n * MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating\n elements with ANGLE\n * MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and\n Firefox ESR 52.4\n * MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a\n unique origin\n * MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and\n malware protection warnings\n\n Mozilla Network Security Services (Mozilla NSS) received a security fix:\n\n * MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating\n handshake hashes (bsc#1061005, bsc#1060445)\n\n", "published": "2017-10-27T18:54:21", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00079.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-27T20:32:02"}, {"id": "OPENSUSE-SU-2017:2710-1", "type": "suse", "title": "Security update for MozillaThunderbird (important)", "description": "Mozilla Thunderbird was updated to 52.4.0 (boo#1060445)\n * new behavior was introduced for replies to mailing list posts: "When\n replying to a mailing list, reply will be sent to address in From\n header ignoring Reply-to header". A new preference\n mail.override_list_reply_to allows to restore the previous behavior.\n * Under certain circumstances (image attachment and non-image\n attachment), attached images were shown truncated in messages stored\n in IMAP folders not synchronised for offline use.\n * IMAP UIDs > 0x7FFFFFFF now handled properly Security fixes from Gecko\n 52.4esr\n * CVE-2017-7793 (bmo#1371889) Use-after-free with Fetch API\n * CVE-2017-7818 (bmo#1363723) Use-after-free during ARIA array\n manipulation\n * CVE-2017-7819 (bmo#1380292) Use-after-free while resizing images in\n design mode\n * CVE-2017-7824 (bmo#1398381) Buffer overflow when drawing and\n validating elements with ANGLE\n * CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement) Use-after-free\n in TLS 1.2 generating handshake hashes\n * CVE-2017-7814 (bmo#1376036) Blob and data URLs bypass phishing and\n malware protection warnings\n * CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only) OS X fonts render\n some Tibetan and Arabic unicode characters as spaces\n * CVE-2017-7823 (bmo#1396320) CSP sandbox directive did not create a\n unique origin\n * CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR\n 52.4\n\n - Add alsa-devel BuildRequires: we care for ALSA support to be built and\n thus need to ensure we get the dependencies in place. In the past,\n alsa-devel was pulled in by accident: we buildrequire libgnome-devel.\n This required esound-devel and that in turn pulled in alsa-devel for us.\n libgnome is being fixed to no longer require esound-devel.\n\n", "published": "2017-10-12T00:13:55", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00014.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-12T01:54:37"}], "oraclelinux": [{"id": "ELSA-2017-2831", "type": "oraclelinux", "title": "firefox security update", "description": "[52.4.0-1.0.1]\n- Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file\n[52.4.0-1]\n- Update to 52.4.0 ESR\n[52.3.0-3]\n- Update to 52.3.0 ESR (b2)\n- Require correct nss version", "published": "2017-09-29T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://linux.oracle.com/errata/ELSA-2017-2831.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-09-29T14:00:49"}, {"id": "ELSA-2017-2885", "type": "oraclelinux", "title": "thunderbird security update", "description": "[52.4.0-2.0.1]\n- Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js\n[52.4.0-2]\n- Update to 52.4.0 (b2)", "published": "2017-10-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://linux.oracle.com/errata/ELSA-2017-2885.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-12T09:58:41"}, {"id": "ELSA-2017-2832", "type": "oraclelinux", "title": "nss security update", "description": "[3.28.4-12]\n- Backport patch to simplify transcript calculation for CertificateVerify", "published": "2017-09-28T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://linux.oracle.com/errata/ELSA-2017-2832.html", "cvelist": ["CVE-2017-7805"], "lastseen": "2018-01-25T04:53:12"}], "debian": [{"id": "DSA-3987", "type": "debian", "title": "firefox-esr -- security update", "description": "Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, cross-site scripting or bypass of the phishing and malware protection feature.\n\nFor the oldstable distribution (jessie), these problems have been fixed in version 52.4.0esr-1~deb8u1.\n\nFor the stable distribution (stretch), these problems have been fixed in version 52.4.0esr-1~deb9u1.\n\nWe recommend that you upgrade your firefox-esr packages.", "published": "2017-09-29T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://www.debian.org/security/dsa-3987", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-12-12T15:26:19"}, {"id": "DSA-4014", "type": "debian", "title": "thunderbird -- security update", "description": "Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service.\n\nFor the oldstable distribution (jessie), these problems have been fixed in version 1:52.4.0-1~deb8u1.\n\nFor the stable distribution (stretch), these problems have been fixed in version 1:52.4.0-1~deb9u1.\n\nWe recommend that you upgrade your thunderbird packages.", "published": "2017-11-01T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://www.debian.org/security/dsa-4014", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-11-11T14:35:10"}, {"id": "DSA-3998", "type": "debian", "title": "nss -- security update", "description": "Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash, resulting in a denial of service, or potentially to execute arbitrary code.\n\nFor the oldstable distribution (jessie), this problem has been fixed in version 2:3.26-1+debu8u3.\n\nFor the stable distribution (stretch), this problem has been fixed in version 2:3.26.2-1.1+deb9u1.\n\nFor the testing distribution (buster), this problem has been fixed in version 2:3.33-1.\n\nFor the unstable distribution (sid), this problem has been fixed in version 2:3.33-1.\n\nWe recommend that you upgrade your nss packages.", "published": "2017-10-11T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://www.debian.org/security/dsa-3998", "cvelist": ["CVE-2017-7805"], "lastseen": "2017-10-12T13:41:34"}], "centos": [{"id": "CESA-2017:2831", "type": "centos", "title": "firefox security update", "description": "**CentOS Errata and Security Advisory** CESA-2017:2831\n\n\nMozilla Firefox is an open source web browser.\n\nThis update upgrades Firefox to version 52.4.0 ESR.\n\nSecurity Fix(es):\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, Sebastian Hengst, Abhishek Arya, Nils, Omair, Andre Weissflog, Fran\u00e7ois Marier, and Jun Kokatsu as the original reporters.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2017-September/022551.html\nhttp://lists.centos.org/pipermail/centos-announce/2017-September/022553.html\n\n**Affected packages:**\nfirefox\n\n**Upstream details at:**\n", "published": "2017-09-29T19:44:59", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.centos.org/pipermail/centos-announce/2017-September/022553.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-03T18:24:53"}, {"id": "CESA-2017:2885", "type": "centos", "title": "thunderbird security update", "description": "**CentOS Errata and Security Advisory** CESA-2017:2885\n\n\nMozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 52.4.0.\n\nSecurity Fix(es):\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, Sebastian Hengst, Abhishek Arya, Nils, Omair, Andre Weissflog, Fran\u00e7ois Marier, and Jun Kokatsu as the original reporters.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2017-October/022566.html\nhttp://lists.centos.org/pipermail/centos-announce/2017-October/022567.html\n\n**Affected packages:**\nthunderbird\n\n**Upstream details at:**\n", "published": "2017-10-12T12:12:05", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.centos.org/pipermail/centos-announce/2017-October/022566.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-12T18:05:13"}, {"id": "CESA-2017:2832", "type": "centos", "title": "nss security update", "description": "**CentOS Errata and Security Advisory** CESA-2017:2832\n\n\nNetwork Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.\n\nSecurity Fix(es):\n\n* A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with the permission of the user running the application. (CVE-2017-7805)\n\nRed Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Martin Thomson as the original reporter.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2017-September/022550.html\nhttp://lists.centos.org/pipermail/centos-announce/2017-September/022552.html\n\n**Affected packages:**\nnss\nnss-devel\nnss-pkcs11-devel\nnss-sysinit\nnss-tools\n\n**Upstream details at:**\n", "published": "2017-09-29T19:42:08", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://lists.centos.org/pipermail/centos-announce/2017-September/022552.html", "cvelist": ["CVE-2017-7805"], "lastseen": "2017-10-03T18:24:50"}], "ubuntu": [{"id": "USN-3436-1", "type": "ubuntu", "title": "Thunderbird vulnerabilities", "description": "Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing-like context, an attacker could potentially exploit these to read uninitialized memory, bypass phishing and malware protection, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7814, CVE-2017-7818, CVE-2017-7819, CVE-2017-7823, CVE-2017-7824)\n\nMartin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7805)", "published": "2017-10-11T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://usn.ubuntu.com/3436-1/", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-03-29T18:20:46"}, {"id": "USN-3435-2", "type": "ubuntu", "title": "Firefox regression", "description": "USN-3435-1 fixed vulnerabilities in Firefox. The update caused the Flash plugin to crash in some circumstances. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nMultiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain sensitive information, bypass phishing and malware protection, spoof the origin in modal dialogs, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824)\n\nMartin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7805)\n\nMultiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to download and open non-executable files without interaction, or obtain elevated privileges. (CVE-2017-7816, CVE-2017-7821)", "published": "2017-10-04T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://usn.ubuntu.com/3435-2/", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7822", "CVE-2017-7815", "CVE-2017-7821", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7820", "CVE-2017-7813", "CVE-2017-7811", "CVE-2017-7812", "CVE-2017-7819", "CVE-2017-7816", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-03-29T18:20:05"}, {"id": "USN-3431-1", "type": "ubuntu", "title": "NSS vulnerability", "description": "Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.", "published": "2017-10-02T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://usn.ubuntu.com/3431-1/", "cvelist": ["CVE-2017-7805"], "lastseen": "2018-03-29T18:19:23"}], "redhat": [{"id": "RHSA-2017:2885", "type": "redhat", "title": "(RHSA-2017:2885) Important: thunderbird security update", "description": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 52.4.0.\n\nSecurity Fix(es):\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, Sebastian Hengst, Abhishek Arya, Nils, Omair, Andre Weissflog, Fran\u00e7ois Marier, and Jun Kokatsu as the original reporters.", "published": "2017-10-12T02:55:46", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://access.redhat.com/errata/RHSA-2017:2885", "cvelist": ["CVE-2017-7793", "CVE-2017-7810", "CVE-2017-7814", "CVE-2017-7818", "CVE-2017-7819", "CVE-2017-7823", "CVE-2017-7824"], "lastseen": "2018-06-13T00:00:30"}, {"id": "RHSA-2017:2831", "type": "redhat", "title": "(RHSA-2017:2831) Critical: firefox security update", "description": "Mozilla Firefox is an open source web browser.\n\nThis update upgrades Firefox to version 52.4.0 ESR.\n\nSecurity Fix(es):\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, Sebastian Hengst, Abhishek Arya, Nils, Omair, Andre Weissflog, Fran\u00e7ois Marier, and Jun Kokatsu as the original reporters.", "published": "2017-09-28T22:56:55", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://access.redhat.com/errata/RHSA-2017:2831", "cvelist": ["CVE-2017-7793", "CVE-2017-7810", "CVE-2017-7814", "CVE-2017-7818", "CVE-2017-7819", "CVE-2017-7823", "CVE-2017-7824"], "lastseen": "2018-06-07T16:11:46"}, {"id": "RHSA-2017:2832", "type": "redhat", "title": "(RHSA-2017:2832) Important: nss security update", "description": "Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.\n\nSecurity Fix(es):\n\n* A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with the permission of the user running the application. (CVE-2017-7805)\n\nRed Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Martin Thomson as the original reporter.", "published": "2017-09-28T23:01:49", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://access.redhat.com/errata/RHSA-2017:2832", "cvelist": ["CVE-2017-7805"], "lastseen": "2018-06-07T16:11:17"}], "kaspersky": [{"id": "KLA11116", "type": "kaspersky", "title": "\r KLA11116Multiple vulnerabilities in Mozilla Thunderbird\t\t\t ", "description": "### *CVSS*:\n7.5\n\n### *Detect date*:\n10/09/2017\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, perform cross-site scripting and execute arbitrary code.\n\n### *Affected products*:\nMozilla Thunderbird versions earlier than 52.4\n\n### *Solution*:\nUpdate to the latest version \n[Download Mozilla Thunderbird](<https://www.mozilla.org/en-US/thunderbird/>)\n\n### *Original advisories*:\n[Mozilla Foundation Security Advisory 2017-23](<https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Mozilla Thunderbird](<https://threats.kaspersky.com/en/product/Mozilla-Thunderbird/>)\n\n### *CVE-IDS*:\n[CVE-2017-7810](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7810>) \n[CVE-2017-7823](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7823>) \n[CVE-2017-7825](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7825>) \n[CVE-2017-7814](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7814>) \n[CVE-2017-7805](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7805>) \n[CVE-2017-7824](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7824>) \n[CVE-2017-7819](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7819>) \n[CVE-2017-7818](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7818>) \n[CVE-2017-7793](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7793>)", "published": "2017-10-09T00:00:00", "cvss": {"score": 7.5, "vector": "NONE"}, "href": "https://threats.kaspersky.com/en/vulnerability/KLA11116", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7825", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7819", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-03-30T14:11:20"}, {"id": "KLA11109", "type": "kaspersky", "title": "\r KLA11109Multiple vulnerabilities in Mozilla Firefox and Firefox ESR\t\t\t ", "description": "### *CVSS*:\n7.5\n\n### *Detect date*:\n09/28/2017\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Firefox and Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, spoof user interface, bypass security restrictions, obtain sensitive information and perform cross-site scripting.\n\n### *Affected products*:\nMozilla Firefox versions earlier than 56 \nMozilla Firefox ESR versions earlier than 52.4\n\n### *Solution*:\nUpdate to the latest version \n[Download Mozilla Firefox ESR](<https://www.mozilla.org/en-US/firefox/organizations/all/>) \n[Download Mozilla Firefox](<https://www.mozilla.org/en-US/firefox/new/>)\n\n### *Original advisories*:\n[MSFA 2017-22](<https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/>) \n[MSFA 2017-21](<https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/>) \n\n\n### *Impacts*:\nRLF \n\n### *Related products*:\n[Mozilla Firefox ESR](<https://threats.kaspersky.com/en/product/Mozilla-Firefox-ESR/>)\n\n### *CVE-IDS*:\n[CVE-2017-7811](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7811>) \n[CVE-2017-7820](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7820>) \n[CVE-2017-7822](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7822>) \n[CVE-2017-7821](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7821>) \n[CVE-2017-7816](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7816>) \n[CVE-2017-7815](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7815>) \n[CVE-2017-7813](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7813>) \n[CVE-2017-7812](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7812>) \n[CVE-2017-7817](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7817>) \n[CVE-2017-7810](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7810>) \n[CVE-2017-7823](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7823>) \n[CVE-2017-7825](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7825>) \n[CVE-2017-7814](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7814>) \n[CVE-2017-7805](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7805>) \n[CVE-2017-7824](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7824>) \n[CVE-2017-7819](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7819>) \n[CVE-2017-7818](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7818>) \n[CVE-2017-7793](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7793>)", "published": "2017-09-28T00:00:00", "cvss": {"score": 7.5, "vector": "NONE"}, "href": "https://threats.kaspersky.com/en/vulnerability/KLA11109", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7822", "CVE-2017-7815", "CVE-2017-7825", "CVE-2017-7821", "CVE-2017-7817", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7820", "CVE-2017-7813", "CVE-2017-7811", "CVE-2017-7812", "CVE-2017-7819", "CVE-2017-7816", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2018-03-30T14:11:02"}], "freebsd": [{"id": "1098A15B-B0F6-42B7-B5C7-8A8646E8BE07", "type": "freebsd", "title": "mozilla -- multiple vulnerabilities", "description": "\nMozilla Foundation reports:\n\nCVE-2017-7793: Use-after-free with Fetch API\nCVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode\nCVE-2017-7818: Use-after-free during ARIA array manipulation\nCVE-2017-7819: Use-after-free while resizing images in design mode\nCVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE\nCVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes\nCVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files\nCVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings\nCVE-2017-7813: Integer truncation in the JavaScript parser\nCVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces\nCVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations\nCVE-2017-7816: WebExtensions can load about: URLs in extension UI\nCVE-2017-7821: WebExtensions can download and open non-executable files without user interaction\nCVE-2017-7823: CSP sandbox directive did not create a unique origin\nCVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV\nCVE-2017-7820: Xray wrapper bypass with new tab and web console\nCVE-2017-7811: Memory safety bugs fixed in Firefox 56\nCVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4\n\n", "published": "2017-09-28T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vuxml.freebsd.org/freebsd/1098a15b-b0f6-42b7-b5c7-8a8646e8be07.html", "cvelist": ["CVE-2017-7824", "CVE-2017-7810", "CVE-2017-7822", "CVE-2017-7815", "CVE-2017-7825", "CVE-2017-7821", "CVE-2017-7817", "CVE-2017-7805", "CVE-2017-7823", "CVE-2017-7820", "CVE-2017-7813", "CVE-2017-7811", "CVE-2017-7812", "CVE-2017-7819", "CVE-2017-7816", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7814"], "lastseen": "2017-10-03T09:53:33"}, {"id": "E71FD9D3-AF47-11E7-A633-009C02A2AB30", "type": "freebsd", "title": "nss -- Use-after-free in TLS 1.2 generating handshake hashes", "description": "\nMozilla reports:\n\nDuring TLS 1.2 exchanges, handshake hashes are generated which\n\t point to a message buffer. This saved data is used for later\n\t messages but in some cases, the handshake transcript can\n\t exceed the space available in the current buffer, causing the\n\t allocation of a new buffer. This leaves a pointer pointing to\n\t the old, freed buffer, resulting in a use-after-free when\n\t handshake hashes are then calculated afterwards. This can\n\t result in a potentially exploitable crash.\n\n", "published": "2017-08-04T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vuxml.freebsd.org/freebsd/e71fd9d3-af47-11e7-a633-009c02a2ab30.html", "cvelist": ["CVE-2017-7805"], "lastseen": "2018-01-30T00:52:53"}], "gentoo": [{"id": "GLSA-201803-14", "type": "gentoo", "title": "Mozilla Thunderbird: Multiple vulnerabilities", "description": "### Background\n\nMozilla Thunderbird is a popular open-source email client from the Mozilla project. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the referenced Mozilla Foundation Security Advisories and CVE identifiers below for details. \n\n### Impact\n\nA remote attacker may be able to execute arbitrary code, cause a Denial of Service condition, obtain sensitive information, conduct URL hijacking, or conduct cross-site scripting (XSS). \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Thunderbird users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=mail-client/thunderbird-52.6.0\"\n \n\nAll Thunderbird binary users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=mail-client/thunderbird-bin-52.6.0\"", "published": "2018-03-28T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://security.gentoo.org/glsa/201803-14", "cvelist": ["CVE-2017-7847", "CVE-2017-7791", "CVE-2017-7784", "CVE-2017-7824", "CVE-2017-7800", "CVE-2017-7753", "CVE-2017-7801", "CVE-2017-7810", "CVE-2018-5097", "CVE-2018-5089", "CVE-2018-5096", "CVE-2018-5095", "CVE-2018-5098", "CVE-2017-7825", "CVE-2018-5102", "CVE-2017-7828", "CVE-2017-7848", "CVE-2017-7802", "CVE-2017-7787", "CVE-2017-7805", "CVE-2017-7829", "CVE-2017-7779", "CVE-2017-7785", "CVE-2017-7823", "CVE-2018-5117", "CVE-2017-7807", "CVE-2018-5104", "CVE-2017-7809", "CVE-2018-5103", "CVE-2017-7786", "CVE-2017-7846", "CVE-2017-7819", "CVE-2017-7803", "CVE-2017-7792", "CVE-2018-5099", "CVE-2017-7830", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-7826", "CVE-2017-7814"], "lastseen": "2018-04-04T07:02:03"}, {"id": "GLSA-201802-03", "type": "gentoo", "title": "Mozilla Firefox: Multiple vulnerabilities", "description": "### Background\n\nMozilla Firefox is a popular open-source web browser from the Mozilla Project. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Mozilla Firefox. Please review the referenced CVE identifiers for details. \n\n### Impact\n\nA remote attacker could entice a user to view a specially crafted web page, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Mozilla Firefox users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-client/firefox-52.6.0\"\n \n\nAll Mozilla Firefox binary users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-client/firefox-bin-52.6.0\"", "published": "2018-02-20T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/201802-03", "cvelist": ["CVE-2017-7772", "CVE-2017-7757", "CVE-2017-7754", "CVE-2017-7758", "CVE-2017-7773", "CVE-2017-7752", "CVE-2017-7791", "CVE-2017-7784", "CVE-2017-7824", "CVE-2017-5462", "CVE-2017-7800", "CVE-2017-7753", "CVE-2017-5436", "CVE-2017-7801", "CVE-2017-7810", "CVE-2018-5097", "CVE-2017-7778", "CVE-2017-5441", "CVE-2017-5472", "CVE-2016-10197", "CVE-2017-5442", "CVE-2017-5446", "CVE-2018-5089", "CVE-2017-5434", "CVE-2018-5091", "CVE-2017-7756", "CVE-2018-5096", "CVE-2017-5465", "CVE-2018-5095", "CVE-2017-7843", "CVE-2016-6354", "CVE-2017-7764", "CVE-2017-7771", "CVE-2018-5098", "CVE-2017-5429", "CVE-2018-5102", "CVE-2017-5440", "CVE-2017-5435", "CVE-2017-7802", "CVE-2017-7787", "CVE-2017-5432", "CVE-2017-5469", "CVE-2017-7749", "CVE-2017-7805", "CVE-2017-5470", "CVE-2017-5438", "CVE-2017-5439", "CVE-2017-7779", "CVE-2017-5445", "CVE-2016-10196", "CVE-2017-7785", "CVE-2017-5433", "CVE-2017-7751", "CVE-2017-7823", "CVE-2018-5117", "CVE-2017-7807", "CVE-2017-5447", "CVE-2017-5444", "CVE-2017-7750", "CVE-2017-5460", "CVE-2017-7777", "CVE-2018-5104", "CVE-2017-7809", "CVE-2017-7775", "CVE-2018-5103", "CVE-2017-7798", "CVE-2017-7786", "CVE-2017-7774", "CVE-2017-7776", "CVE-2017-7844", "CVE-2017-7819", "CVE-2017-5461", "CVE-2017-5437", "CVE-2017-7803", "CVE-2017-7792", "CVE-2018-5099", "CVE-2017-7793", "CVE-2017-7818", "CVE-2017-5448", "CVE-2017-5459", "CVE-2016-10195", "CVE-2017-5443", "CVE-2017-7814", "CVE-2017-5464"], "lastseen": "2018-02-20T04:07:02"}], "seebug": [{"id": "SSV:96617", "type": "seebug", "title": "Mozilla Firefox WebExtensions can download and open non-executable files without user interaction(CVE-2017-7821)", "description": "### CVE-2017-7821\r\n\"browser.downloads addon feature may be used for RCE\"\r\n\r\nSteps:\r\n\t1. Go to 'about:debugging'\r\n\t2. Unpack attached PoC somewhere\r\n\t3. Back in 'about:debugging' choose 'Load temp addon' and choose the poc\r\n\t4. jar file is automatically downloaded and executed.\r\n\t\r\nWe are able to download and execute jar files automatically.", "published": "2017-10-09T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.seebug.org/vuldb/ssvid-96617", "cvelist": ["CVE-2017-7821"], "lastseen": "2017-11-19T15:29:49"}], "zdt": [{"id": "1337DAY-ID-28675", "type": "zdt", "title": "Firefox browser.downloads addon Remote Code Execute (PoC) Vulnerability", "description": "Exploit for multiple platform in category dos / poc", "published": "2017-09-29T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://0day.today/exploit/description/28675", "cvelist": ["CVE-2017-7821"], "lastseen": "2018-01-04T11:08:13"}], "f5": [{"id": "F5:K58192514", "type": "f5", "title": "NSS vulnerability CVE-2017-7805", "description": "\nF5 Product Development has evaluated the currently supported releases for potential vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct | Versions known to be vulnerable | Versions known to be not vulnerable | Severity | CVSSv3 score | Vulnerable component or feature \n---|---|---|---|---|--- \nBIG-IP LTM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.5.1 - 11.6.2 \n11.2.1 | Not vulnerable | None | None \nBIG-IP AAM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.5.1 - 11.6.2 | Not vulnerable | None | None \nBIG-IP AFM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.5.1 - 11.6.2 | Not vulnerable | None | None \nBIG-IP Analytics | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.5.1 - 11.6.2 \n11.2.1 | Not vulnerable | None | None \nBIG-IP APM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.5.1 - 11.6.2 \n11.2.1 | Not vulnerable | None | None \nBIG-IP ASM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.5.1 - 11.6.2 \n11.2.1 | Not vulnerable | None | None \nBIG-IP DNS | None | 13.0.0 \n12.0.0 - 12.1.2 | Not vulnerable | None | None \nBIG-IP Edge Gateway | None | 11.2.1 | Not vulnerable | None | None \nBIG-IP GTM | None | 11.5.1 - 11.6.2 \n11.2.1 | Not vulnerable | None | None \nBIG-IP Link Controller | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.5.1 - 11.6.2 \n11.2.1 | Not vulnerable | None | None \nBIG-IP PEM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.5.1 - 11.6.2 | Not vulnerable | None | None \nBIG-IP WebAccelerator | None | 11.2.1 | Not vulnerable | None | None \nF5 WebSafe | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.6.2 | Not vulnerable | None | None \nARX | None | 6.2.0 - 6.4.0 | Not vulnerable | None | None \nEnterprise Manager | None | 3.1.1 | Not vulnerable | None | None \nBIG-IQ Cloud | None | 4.4.0 - 4.5.0 | Not vulnerable | None | None \nBIG-IQ Device | None | 4.4.0 - 4.5.0 | Not vulnerable | None | None \nBIG-IQ Security | None | 4.4.0 - 4.5.0 | Not vulnerable | None | None \nBIG-IQ ADC | None | 4.5.0 | Not vulnerable | None | None \nBIG-IQ Centralized Management | None | 5.0.0 - 5.3.0 \n4.6.0 | Not vulnerable | None | None \nBIG-IQ Cloud and Orchestration | None | 1.0.0 | Not vulnerable | None | None \nF5 iWorkflow | None | 2.0.0 - 2.3.0 | Not vulnerable | None | None \nLineRate | None | 2.5.0 - 2.6.2 | Not vulnerable | None | None \nTraffix SDC | None | 5.0.0 - 5.1.0 \n4.0.0 - 4.4.0 | Not vulnerable | None | None\n\nNone\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n", "published": "2017-11-03T01:54:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://support.f5.com/csp/article/K58192514", "cvelist": ["CVE-2017-7805"], "lastseen": "2017-11-03T02:33:25"}], "amazon": [{"id": "ALAS-2017-911", "type": "amazon", "title": "Important: nss", "description": "**Issue Overview:**\n\nPotential use-after-free in TLS 1.2 server when verifying client authentication: \nA use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with the permission of the user running the application. ([CVE-2017-7805 __](<https://access.redhat.com/security/cve/CVE-2017-7805>))\n\n \n**Affected Packages:** \n\n\nnss\n\n \n**Issue Correction:** \nRun _yum update nss_ to update your system. \n\n\n \n**New Packages:**\n \n \n i686: \n nss-tools-3.28.4-12.80.amzn1.i686 \n nss-debuginfo-3.28.4-12.80.amzn1.i686 \n nss-3.28.4-12.80.amzn1.i686 \n nss-sysinit-3.28.4-12.80.amzn1.i686 \n nss-pkcs11-devel-3.28.4-12.80.amzn1.i686 \n nss-devel-3.28.4-12.80.amzn1.i686 \n \n src: \n nss-3.28.4-12.80.amzn1.src \n \n x86_64: \n nss-pkcs11-devel-3.28.4-12.80.amzn1.x86_64 \n nss-devel-3.28.4-12.80.amzn1.x86_64 \n nss-3.28.4-12.80.amzn1.x86_64 \n nss-debuginfo-3.28.4-12.80.amzn1.x86_64 \n nss-sysinit-3.28.4-12.80.amzn1.x86_64 \n nss-tools-3.28.4-12.80.amzn1.x86_64 \n \n \n", "published": "2017-10-12T19:41:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://alas.aws.amazon.com/ALAS-2017-911.html", "cvelist": ["CVE-2017-7805"], "lastseen": "2017-10-13T03:55:37"}], "oracle": [{"id": "ORACLE:CPUAPR2018-3678067", "type": "oracle", "title": "Oracle Critical Patch Update - April 2018", "description": "A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:\n\n \n\n * [Critical Patch Updates, Security Alerts and Bulletins](<http://www.oracle.com/securityalerts>) for information about Oracle Security Advisories.\n\n \n\n**Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes without delay.**\n\nThis Critical Patch Update contains 255 new security fixes across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at [ April 2018 Critical Patch Update: Executive Summary and Analysis](<https://support.oracle.com/rs?type=doc&id=2383583.1>).\n\nThe January 2018 Critical Patch Update provided patches in response to the Spectre (CVE-2017-5753, CVE-2017-5715) and Meltdown (CVE-2017-5754) processor vulnerabilities. Please refer to this Advisory and the Addendum to the January 2018 Critical Patch Update Advisory for Spectre and Meltdown MOS note ([Doc ID 2347948.1](<https://support.oracle.com/rs?type=doc&id=2347948.1>)) for information on how to obtain these patches.\n", "published": "2018-04-17T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "", "cvelist": ["CVE-2018-2768", "CVE-2018-2802", "CVE-2018-2775", "CVE-2018-2815", "CVE-2018-2748", "CVE-2018-2836", "CVE-2017-9798", "CVE-2018-2878", "CVE-2018-2826", "CVE-2018-2827", "CVE-2017-5753", "CVE-2017-5754", "CVE-2018-2817", "CVE-2018-2800", "CVE-2018-2868", "CVE-2018-2832", "CVE-2018-2789", "CVE-2018-2852", "CVE-2018-2808", "CVE-2018-2749", "CVE-2018-2747", "CVE-2018-2563", "CVE-2018-2860", "CVE-2018-2769", "CVE-2017-13080", "CVE-2016-5019", "CVE-2018-2776", "CVE-2018-7489", "CVE-2016-6306", "CVE-2018-2841", "CVE-2018-2759", "CVE-2016-2183", "CVE-2018-2870", "CVE-2018-2844", "CVE-2018-2822", "CVE-2018-2853", "CVE-2018-2746", "CVE-2016-2178", "CVE-2018-2755", "CVE-2018-2810", "CVE-2018-2812", "CVE-2018-2803", "CVE-2016-9878", "CVE-2017-10400", "CVE-2017-3735", "CVE-2018-2823", "CVE-2018-2842", "CVE-2018-2786", "CVE-2018-2778", "CVE-2018-2820", "CVE-2018-2765", "CVE-2018-2876", "CVE-2016-3092", "CVE-2018-2856", "CVE-2018-2872", "CVE-2018-2858", "CVE-2016-6302", "CVE-2017-13082", "CVE-2018-2819", "CVE-2018-2783", "CVE-2018-2774", "CVE-2016-8745", "CVE-2016-2177", "CVE-2018-2784", "CVE-2018-2771", "CVE-2018-2835", "CVE-2018-2848", "CVE-2018-2840", "CVE-2016-0635", "CVE-2018-2863", "CVE-2018-2867", "CVE-2018-2845", "CVE-2018-2824", "CVE-2018-2861", "CVE-2018-2777", "CVE-2018-2738", "CVE-2018-2838", "CVE-2018-2849", "CVE-2015-7501", "CVE-2018-2754", "CVE-2018-2795", "CVE-2016-6307", "CVE-2017-3737", "CVE-2013-1768", "CVE-2017-15707", "CVE-2018-2791", "CVE-2018-2807", "CVE-2018-2766", "CVE-2018-2763", "CVE-2018-2780", "CVE-2018-2879", "CVE-2018-2752", "CVE-2016-6308", "CVE-2017-13078", "CVE-2017-5662", "CVE-2018-2816", "CVE-2014-0054", "CVE-2018-2793", "CVE-2016-2180", "CVE-2018-2742", "CVE-2018-2739", "CVE-2017-7805", "CVE-2018-2798", "CVE-2018-2814", "CVE-2018-2855", "CVE-2018-2799", "CVE-2017-5715", "CVE-2018-2787", "CVE-2016-2181", "CVE-2018-2818", "CVE-2016-6304", "CVE-2018-2753", "CVE-2018-2756", "CVE-2018-2851", "CVE-2018-2796", "CVE-2018-2764", "CVE-2018-2837", "CVE-2018-2847", "CVE-2018-0739", "CVE-2017-17562", "CVE-2018-2805", "CVE-2018-2572", "CVE-2018-2801", "CVE-2018-2761", "CVE-2018-2821", "CVE-2018-2782", "CVE-2018-2831", "CVE-2018-2773", "CVE-2018-2797", "CVE-2018-2864", "CVE-2018-2828", "CVE-2018-2866", "CVE-2018-2587", "CVE-2018-2829", "CVE-2017-7525", "CVE-2018-2770", "CVE-2016-7052", "CVE-2018-2718", "CVE-2018-2781", "CVE-2018-2830", "CVE-2018-2806", "CVE-2017-5664", "CVE-2018-2779", "CVE-2018-2825", "CVE-2018-2813", "CVE-2016-5007", "CVE-2018-2854", "CVE-2018-2811", "CVE-2018-2762", "CVE-2018-2869", "CVE-2018-2790", "CVE-2017-3738", "CVE-2018-2877", "CVE-2018-2865", "CVE-2018-2760", "CVE-2018-2834", "CVE-2016-6305", "CVE-2016-6303", "CVE-2018-2772", "CVE-2018-2846", "CVE-2018-2792", "CVE-2017-5645", "CVE-2016-2182", "CVE-2018-2833", "CVE-2017-12617", "CVE-2018-2859", "CVE-2018-2843", "CVE-2018-2804", "CVE-2017-10393", "CVE-2018-2788", "CVE-2018-2628", "CVE-2018-2785", "CVE-2018-2750", "CVE-2018-2873", "CVE-2015-7940", "CVE-2017-3736", "CVE-2018-2758", "CVE-2017-13077", "CVE-2016-3506", "CVE-2018-2737", "CVE-2018-2809", "CVE-2018-2871", "CVE-2017-15095", "CVE-2016-2179", "CVE-2016-6814", "CVE-2017-7674", "CVE-2018-2857", "CVE-2018-2839", "CVE-2018-2850", "CVE-2018-2862", "CVE-2016-6309", "CVE-2018-2794", "CVE-2018-2874"], "lastseen": "2018-05-24T02:50:47"}]}}
