製品・ソフトウェアに関する情報

JVN脆弱性詳細

Mozilla Firefox のブラウザエンジンにおけるサービス運用妨害 (DoS) の脆弱性

Title	Mozilla Firefox のブラウザエンジンにおけるサービス運用妨害 (DoS) の脆弱性
Summary	Mozilla Firefox のブラウザエンジンには、サービス運用妨害 (メモリ破損およびアプリケーションクラッシュ) 状態にされる、または任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、サービス運用妨害 (メモリ破損およびアプリケーションクラッシュ) 状態にされる、または任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 7, 2016, midnight
Registration Date	June 17, 2016, 4:57 p.m.
Last Update	Nov. 21, 2016, 10:57 a.m.

CVSS3.0 : 重要
Score	8.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS2.0 : 警告
Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected System

レッドハット

Red Hat Enterprise Linux Desktop 5 i386

Red Hat Enterprise Linux Desktop 5 x86_64

Red Hat Enterprise Linux Desktop 6 i386

Red Hat Enterprise Linux Desktop 6 x86_64

Red Hat Enterprise Linux Desktop 7 x86_64

Red Hat Enterprise Linux for IBM z Systems 5 s390x

Red Hat Enterprise Linux for IBM z Systems 6 s390x

Red Hat Enterprise Linux for IBM z Systems 7 s390x

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.2 s390x

Red Hat Enterprise Linux for Power, big endian 5 ppc

Red Hat Enterprise Linux for Power, big endian 6 ppc64

Red Hat Enterprise Linux for Power, big endian 7 ppc64

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.2 ppc64

Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le

Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Red Hat Enterprise Linux Server - AUS 7.2 x86_64

Red Hat Enterprise Linux Server - Extended Update Support 7.2 x86_64

Red Hat Enterprise Linux Server 5 i386

Red Hat Enterprise Linux Server 5 x86_64

Red Hat Enterprise Linux Server 6 i386

Red Hat Enterprise Linux Server 6 x86_64

Red Hat Enterprise Linux Server 7 x86_64

Red Hat Enterprise Linux Workstation 5 i386

Red Hat Enterprise Linux Workstation 5 x86_64

Red Hat Enterprise Linux Workstation 6 i386

Red Hat Enterprise Linux Workstation 6 x86_64

Red Hat Enterprise Linux Workstation 7 x86_64

Mozilla Foundation

Mozilla Firefox 47.0 未満

Mozilla Firefox ESR 45.2 未満の 45.x

Debian

Debian GNU/Linux 8.0

Canonical

Ubuntu 12.04 LTS

Ubuntu 14.04 LTS

Ubuntu 15.10

Ubuntu 16.04 LTS

SUSE

SUSE Linux Enterprise Desktop 12

SUSE Linux Enterprise Desktop 12-SP1

SUSE Linux Enterprise Server 12

SUSE Linux Enterprise Server 12-SP1

SUSE Linux Enterprise Software Development Kit 12

SUSE Linux Enterprise Software Development Kit 12-SP1

SUSE Package Hub for SUSE Linux Enterprise 12

openSUSE project

openSUSE 13.1

openSUSE 13.2

openSUSE Leap 42.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-2818	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2818
National Vulnerability Database (NVD)
2	CVE-2016-2818	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2818

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3600	https://www.debian.org/security/2016/dsa-3600
Mozilla Bugzilla
2	Bug 1234147	https://bugzilla.mozilla.org/show_bug.cgi?id=1234147
3	Bug 1256493	https://bugzilla.mozilla.org/show_bug.cgi?id=1256493
4	Bug 1256739	https://bugzilla.mozilla.org/show_bug.cgi?id=1256739
5	Bug 1256968	https://bugzilla.mozilla.org/show_bug.cgi?id=1256968
6	Bug 1261230	https://bugzilla.mozilla.org/show_bug.cgi?id=1261230
7	Bug 1261752	https://bugzilla.mozilla.org/show_bug.cgi?id=1261752
8	Bug 1263384	https://bugzilla.mozilla.org/show_bug.cgi?id=1263384
9	Bug 1264575	https://bugzilla.mozilla.org/show_bug.cgi?id=1264575
10	Bug 1265577	https://bugzilla.mozilla.org/show_bug.cgi?id=1265577
11	Bug 1267130	https://bugzilla.mozilla.org/show_bug.cgi?id=1267130
12	Bug 1269729	https://bugzilla.mozilla.org/show_bug.cgi?id=1269729
13	Bug 1273202	https://bugzilla.mozilla.org/show_bug.cgi?id=1273202
14	Bug 1273701	https://bugzilla.mozilla.org/show_bug.cgi?id=1273701
Mozilla Foundation Security Advisory
15	MFSA2016-49	http://www.mozilla.org/security/announce/2016/mfsa2016-49.html
Mozilla Foundation セキュリティアドバイザリ
16	MFSA2016-49	http://www.mozilla-japan.org/security/announce/2016/mfsa2016-49.html
opensuse-security-announce
17	openSUSE-SU-2016:1552	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html
18	openSUSE-SU-2016:1557	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html
19	openSUSE-SU-2016:1767	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html
20	openSUSE-SU-2016:1769	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html
21	openSUSE-SU-2016:1778	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html
22	SUSE-SU-2016:1691	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
Oracle Technology Network
23	Oracle Linux Bulletin - April 2016	http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
24	Oracle Linux Bulletin - July 2016	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Red Hat Security Advisory
25	RHSA-2016:1217	https://access.redhat.com/errata/RHSA-2016:1217
26	RHSA-2016:1392	https://access.redhat.com/errata/RHSA-2016:1392
Ubuntu Security Notice
27	USN-2993-1	http://www.ubuntu.com/usn/USN-2993-1/

Change Log

No	Changed Details	Date of change
0	[2016年06月17日] 掲載 [2016年08月29日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：レッドハット (RHSA-2016:1392) を追加ベンダ情報：レッドハット (RHSA-2016:1217) を追加ベンダ情報：Canonical (USN-2993-1) を追加ベンダ情報：Debian (DSA-3600) を追加ベンダ情報：openSUSE project (SUSE-SU-2016:1691) を追加ベンダ情報：openSUSE project (openSUSE-SU-2016:1557) を追加ベンダ情報：openSUSE project (openSUSE-SU-2016:1552) を追加ベンダ情報：openSUSE project (openSUSE-SU-2016:1769) を追加ベンダ情報：openSUSE project (openSUSE-SU-2016:1767) を追加ベンダ情報：openSUSE project (openSUSE-SU-2016:1778) を追加 [2016年11月21日] ベンダ情報：オラクル (Oracle Linux Bulletin - April 2016) を追加ベンダ情報：オラクル (Oracle Linux Bulletin - July 2016) を追加ベンダ情報：Mozilla Foundation (Bug 1234147) を追加ベンダ情報：Mozilla Foundation (Bug 1256493) を追加ベンダ情報：Mozilla Foundation (Bug 1256739) を追加ベンダ情報：Mozilla Foundation (Bug 1256968) を追加ベンダ情報：Mozilla Foundation (Bug 1261230) を追加ベンダ情報：Mozilla Foundation (Bug 1261752) を追加ベンダ情報：Mozilla Foundation (Bug 1263384) を追加ベンダ情報：Mozilla Foundation (Bug 1264575) を追加ベンダ情報：Mozilla Foundation (Bug 1265577) を追加ベンダ情報：Mozilla Foundation (Bug 1267130) を追加ベンダ情報：Mozilla Foundation (Bug 1269729) を追加ベンダ情報：Mozilla Foundation (Bug 1273202) を追加ベンダ情報：Mozilla Foundation (Bug 1273701) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-2818

Summary	Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Publication Date	June 13, 2016, 7:59 p.m.
Registration Date	Jan. 26, 2021, 2:09 p.m.
Last Update	Nov. 21, 2024, 11:48 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:mozilla:firefox:45.1.1:::::::*
cpe:2.3:a:mozilla:firefox:45.1.0:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:mozilla:firefox::::::::			46.0.1

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:::::::*
cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:sp1::::::
cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:sp1::::::
cpe:2.3:a:novell:suse_package_hub_for_suse_linux_enterprise:12:::::::*
cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:::::::*
cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:sp1::::::
cpe:2.3:o:opensuse:leap:42.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*
cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html	Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html	Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html	Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html	Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html	Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html	Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html	Third Party Advisory
9	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html	Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html	Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html	Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html	Third Party Advisory
13	http://www.debian.org/security/2016/dsa-3600	Third Party Advisory
14	http://www.debian.org/security/2016/dsa-3600	Third Party Advisory
15	http://www.debian.org/security/2016/dsa-3647
16	http://www.debian.org/security/2016/dsa-3647
17	http://www.mozilla.org/security/announce/2016/mfsa2016-49.html	Vendor Advisory
18	http://www.mozilla.org/security/announce/2016/mfsa2016-49.html	Vendor Advisory
19	http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
20	http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
21	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
22	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
23	http://www.securityfocus.com/bid/91075
24	http://www.securityfocus.com/bid/91075
25	http://www.securitytracker.com/id/1036057	Third Party Advisory VDB Entry
26	http://www.securitytracker.com/id/1036057	Third Party Advisory VDB Entry
27	http://www.ubuntu.com/usn/USN-2993-1	Third Party Advisory
28	http://www.ubuntu.com/usn/USN-2993-1	Third Party Advisory
29	http://www.ubuntu.com/usn/USN-3023-1
30	http://www.ubuntu.com/usn/USN-3023-1
31	https://access.redhat.com/errata/RHSA-2016:1217	Third Party Advisory
32	https://access.redhat.com/errata/RHSA-2016:1217	Third Party Advisory
33	https://access.redhat.com/errata/RHSA-2016:1392	Third Party Advisory
34	https://access.redhat.com/errata/RHSA-2016:1392	Third Party Advisory
35	https://bugzilla.mozilla.org/show_bug.cgi?id=1234147	Issue Tracking Permissions Required
36	https://bugzilla.mozilla.org/show_bug.cgi?id=1234147	Issue Tracking Permissions Required
37	https://bugzilla.mozilla.org/show_bug.cgi?id=1256493	Issue Tracking Permissions Required
38	https://bugzilla.mozilla.org/show_bug.cgi?id=1256493	Issue Tracking Permissions Required
39	https://bugzilla.mozilla.org/show_bug.cgi?id=1256739	Issue Tracking Permissions Required
40	https://bugzilla.mozilla.org/show_bug.cgi?id=1256739	Issue Tracking Permissions Required
41	https://bugzilla.mozilla.org/show_bug.cgi?id=1256968	Issue Tracking Permissions Required
42	https://bugzilla.mozilla.org/show_bug.cgi?id=1256968	Issue Tracking Permissions Required
43	https://bugzilla.mozilla.org/show_bug.cgi?id=1261230	Issue Tracking Permissions Required
44	https://bugzilla.mozilla.org/show_bug.cgi?id=1261230	Issue Tracking Permissions Required
45	https://bugzilla.mozilla.org/show_bug.cgi?id=1261752	Issue Tracking Permissions Required
46	https://bugzilla.mozilla.org/show_bug.cgi?id=1261752	Issue Tracking Permissions Required
47	https://bugzilla.mozilla.org/show_bug.cgi?id=1263384	Issue Tracking Permissions Required
48	https://bugzilla.mozilla.org/show_bug.cgi?id=1263384	Issue Tracking Permissions Required
49	https://bugzilla.mozilla.org/show_bug.cgi?id=1264575	Issue Tracking Permissions Required
50	https://bugzilla.mozilla.org/show_bug.cgi?id=1264575	Issue Tracking Permissions Required
51	https://bugzilla.mozilla.org/show_bug.cgi?id=1265577	Issue Tracking Permissions Required
52	https://bugzilla.mozilla.org/show_bug.cgi?id=1265577	Issue Tracking Permissions Required
53	https://bugzilla.mozilla.org/show_bug.cgi?id=1267130	Issue Tracking Permissions Required
54	https://bugzilla.mozilla.org/show_bug.cgi?id=1267130	Issue Tracking Permissions Required
55	https://bugzilla.mozilla.org/show_bug.cgi?id=1269729	Issue Tracking Permissions Required
56	https://bugzilla.mozilla.org/show_bug.cgi?id=1269729	Issue Tracking Permissions Required
57	https://bugzilla.mozilla.org/show_bug.cgi?id=1273202	Issue Tracking Permissions Required
58	https://bugzilla.mozilla.org/show_bug.cgi?id=1273202	Issue Tracking Permissions Required
59	https://bugzilla.mozilla.org/show_bug.cgi?id=1273701	Issue Tracking Permissions Required
60	https://bugzilla.mozilla.org/show_bug.cgi?id=1273701	Issue Tracking Permissions Required

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:::::::*
cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:sp1::::::
cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:sp1::::::
cpe:2.3:a:novell:suse_package_hub_for_suse_linux_enterprise:12:::::::*
cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:::::::*
cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:sp1::::::
cpe:2.3:o:opensuse:leap:42.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*
cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:::::::*