A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results is a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. This vulnerability affects Firefox < 65.

Versions of Mozilla Firefox prior to 65.0 are unpatched for the following vulnerabilities as referenced in the mfsa2019-01 advisory:

 - A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. (CVE-2018-18500)
 - Mozilla developers and community members Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, and Christian Holler reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2018-18501)
 - Mozilla developers and community members Arthur Iakab, Christoph Diehl, Christian Holler, Kalel, Emilio Cobos lvarez, Cristina Coroiu, Noemi Erli, Natalia Csoregi, Julian Seward, Gary Kwong, Tyson Smith, Yaron Tausky, and Ronald Crane reported memory safety bugs present in Firefox 64. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2018-18502)
 - When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situations. (CVE-2018-18503)
 - A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results in a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. (CVE-2018-18504)
 - An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. (CVE-2018-18505)
 - When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. (CVE-2018-18506)

The version of Firefox installed on the remote Windows host is prior to 65.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-01 advisory.

  - A use-after-free vulnerability can occur while parsing     an HTML5 stream in concert with custom HTML elements.
    This results in the stream parser object being freed     while still in use, leading to a potentially exploitable     crash. (CVE-2018-18500)

  - When JavaScript is used to create and manipulate an     audio buffer, a potentially exploitable crash may occur     because of a compartment mismatch in some situations.
    (CVE-2018-18503)

  - A crash and out-of-bounds read can occur when the buffer     of a texture client is freed while it is still in use     during graphic operations. This results in a potentially     exploitable crash and the possibility of reading from     the memory of the freed buffers. (CVE-2018-18504)

  - An earlier fix for an Inter-process Communication (IPC)     vulnerability, CVE-2011-3079, added authentication to     communication between IPC endpoints and server parents     during IPC process creation. This authentication is     insufficient for channels created after the IPC process     is started, leading to the authentication not being     correctly applied to later channels. This could allow     for a sandbox escape through IPC channels due to lack of     message validation in the listener process.
    (CVE-2018-18505)

  - When proxy auto-detection is enabled, if a web server     serves a Proxy Auto-Configuration (PAC) file or if a PAC     file is loaded locally, this PAC file can specify that     requests to the localhost are to be sent through the     proxy to another server. This behavior is disallowed by     default when a proxy is manually configured, but when     enabled could allow for attacks on services and tools     that bind to the localhost for networked behavior if     they are accessed through browsing. (CVE-2018-18506)

  - Mozilla developers and community members Arthur Iakab,     Christoph Diehl, Christian Holler, Kalel, Emilio Cobos     lvarez, Cristina Coroiu, Noemi Erli, Natalia Csoregi,     Julian Seward, Gary Kwong, Tyson Smith, Yaron Tausky,     and Ronald Crane reported memory safety bugs present in     Firefox 64. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort that     some of these could be exploited to run arbitrary code.
    (CVE-2018-18502)

  - Mozilla developers and community members Alex Gaynor,     Christoph Diehl, Steven Crane, Jason Kratzer, Gary     Kwong, and Christian Holler reported memory safety bugs     present in Firefox 64 and Firefox ESR 60.4. Some of     these bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could     be exploited to run arbitrary code. (CVE-2018-18501)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 65.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-01 advisory.

  - A use-after-free vulnerability can occur while parsing     an HTML5 stream in concert with custom HTML elements.
    This results in the stream parser object being freed     while still in use, leading to a potentially exploitable     crash. (CVE-2018-18500)

  - When JavaScript is used to create and manipulate an     audio buffer, a potentially exploitable crash may occur     because of a compartment mismatch in some situations.
    (CVE-2018-18503)

  - A crash and out-of-bounds read can occur when the buffer     of a texture client is freed while it is still in use     during graphic operations. This results in a potentially     exploitable crash and the possibility of reading from     the memory of the freed buffers. (CVE-2018-18504)

  - An earlier fix for an Inter-process Communication (IPC)     vulnerability, CVE-2011-3079, added authentication to     communication between IPC endpoints and server parents     during IPC process creation. This authentication is     insufficient for channels created after the IPC process     is started, leading to the authentication not being     correctly applied to later channels. This could allow     for a sandbox escape through IPC channels due to lack of     message validation in the listener process.
    (CVE-2018-18505)

  - When proxy auto-detection is enabled, if a web server     serves a Proxy Auto-Configuration (PAC) file or if a PAC     file is loaded locally, this PAC file can specify that     requests to the localhost are to be sent through the     proxy to another server. This behavior is disallowed by     default when a proxy is manually configured, but when     enabled could allow for attacks on services and tools     that bind to the localhost for networked behavior if     they are accessed through browsing. (CVE-2018-18506)

  - Mozilla developers and community members Arthur Iakab,     Christoph Diehl, Christian Holler, Kalel, Emilio Cobos     lvarez, Cristina Coroiu, Noemi Erli, Natalia Csoregi,     Julian Seward, Gary Kwong, Tyson Smith, Yaron Tausky,     and Ronald Crane reported memory safety bugs present in     Firefox 64. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort that     some of these could be exploited to run arbitrary code.
    (CVE-2018-18502)

  - Mozilla developers and community members Alex Gaynor,     Christoph Diehl, Steven Crane, Jason Kratzer, Gary     Kwong, and Christian Holler reported memory safety bugs     present in Firefox 64 and Firefox ESR 60.4. Some of     these bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could     be exploited to run arbitrary code. (CVE-2018-18501)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3874-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, gain additional     privileges by escaping the sandbox, or execute arbitrary code. (CVE-2018-18500, CVE-2018-18501,     CVE-2018-18502, CVE-2018-18503, CVE-2018-18504, CVE-2018-18505)

    It was discovered that Firefox allowed PAC files to specify that requests to localhost are sent through     the proxy to another server. If proxy auto-detection is enabled, an attacker could potentially exploit     this to conduct attacks on local services and tools. (CVE-2018-18506)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Foundation reports :

CVE-2018-18500: Use-after-free parsing HTML5 stream

CVE-2018-18503: Memory corruption with Audio Buffer

CVE-2018-18504: Memory corruption and out-of-bounds read of texture client buffer

CVE-2018-18505: Privilege escalation through IPC channel messages

CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied

CVE-2018-18502: Memory safety bugs fixed in Firefox 65

CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5

ID	Name	Product	Family	Severity
700399	Mozilla Firefox < 65.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
121512	Mozilla Firefox < 65.0	Nessus	Windows	critical
121511	Mozilla Firefox < 65.0	Nessus	MacOS X Local Security Checks	critical
121507	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-3874-1)	Nessus	Ubuntu Local Security Checks	critical
121447	FreeBSD : mozilla -- multiple vulnerabilities (b1f7d52f-fc42-48e8-8403-87d4c9d26229)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-18504

critical

Tenable Plugins

critical

critical

critical

critical

critical