Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy. Note: This attack only affects Firefox for Android. Other operating systems are not affected. This vulnerability affects Firefox < 54.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 54.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-15 advisory.

  - A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer     overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2     version 1.3.10. (CVE-2017-7778)

  - A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS     layout when attempting to use a node in the tree that no longer exists. This results in a potentially     exploitable crash. (CVE-2017-5472)

  - A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This     results in a potentially exploitable crash. (CVE-2017-7749)

  - A use-after-free vulnerability during video control operations when a <code><track></code> element     holds a reference to an older window if that window has been replaced in the DOM. This results in a     potentially exploitable crash. (CVE-2017-7750)

  - A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable     crash. (CVE-2017-7751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 54.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-15 advisory.

  - A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer     overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2     version 1.3.10. (CVE-2017-7778)

  - A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS     layout when attempting to use a node in the tree that no longer exists. This results in a potentially     exploitable crash. (CVE-2017-5472)

  - A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This     results in a potentially exploitable crash. (CVE-2017-7749)

  - A use-after-free vulnerability during video control operations when a <code><track></code> element     holds a reference to an older window if that window has been replaced in the DOM. This results in a     potentially exploitable crash. (CVE-2017-7750)

  - A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable     crash. (CVE-2017-7751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Foundation reports :

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
275614	Mozilla Firefox < 54.0	Nessus	MacOS X Local Security Checks	critical
100810	Mozilla Firefox < 54.0	Nessus	Windows	critical
100775	FreeBSD : mozilla -- multiple vulnerabilities (6cec1b0a-da15-467d-8691-1dea392d4c8d)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-7759

high

Tenable Plugins

critical

critical

critical