The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification. This might allow for the authentication key to be determined in some instances. This vulnerability affects Firefox < 56.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade thunderbirdUpgrade libxulUpgrade firefoxUpgrade linux-seamonkeyUpgrade seamonkeyUpgrade firefox-esrUpgrade linux-thunderbirdUpgrade linux-firefox | Sep 29, 2017 | Sep 29, 2017 |
| Mfsa2017 21 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 56.0 | Jul 12, 2018 | Jun 11, 2018 |
| Suse | — | Upgrade MozillaFirefox-translations-commonUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-other | May 20, 2018 | Sep 28, 2017 |
| Ubuntu | — | Upgrade firefox | Oct 3, 2017 | Sep 28, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub