A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another app) and the default browser is Firefox for Android. This could allow an attacker to spoof which page is actually loaded and in use. Note: this issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 59.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 59.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-06 advisory.

  - A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during     editor operations. This results in a potentially exploitable crash. (CVE-2018-5128)

  - A buffer overflow can occur when manipulating the SVG <code>animatedPathSegList</code> through script.
    This results in a potentially exploitable crash. (CVE-2018-5127)

  - A lack of parameter validation on IPC messages results in a potential out-of-bounds write through     malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the     parent process. (CVE-2018-5129)

  - When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a     potentially exploitable crash is triggered. (CVE-2018-5130)

  - Under certain circumstances the <code>fetch()</code> API can return transient local copies of resources     that were sent with a <code>no-store</code> or <code>no-cache</code> cache header instead of downloading a     copy from the network as it should. This can result in previously stored, locally cached data of a website     being accessible to users if they share a common profile while browsing. (CVE-2018-5131)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Mozilla Firefox earlier than 59 are unpatched for the following vulnerabilities :

 - An overflow condition exists that is triggered when handling SVG animatedPathSegList attributes. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in 'dom/html/nsTextEditorState.cpp' that is triggered when handling elements, events, and selection ranges during editor operations. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as local copies of resources that were sent with a no-store or no-cache header may be returned by the 'fetch()' API. This allows a local attacker to gain access to potentially sensitive information.
 - An out-of-bounds write flaw exists that is triggered when handling plane widths and stride constraints in IPC messages. This may allow a context-dependent attacker to bypass sandbox restrictions.
 - A flaw exists in the 'JsepTrack::NegotiateCodecs()' function in 'media/webrtc/signaling/src/jsep/JsepTrack.cpp' that is triggered when handling RTP payload types in WebRTC connections. With specially crafted packets, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'runFindOperation()' function in 'browser/components/extensions/ext-find.js' that that is triggered as it permits using the Find API for WebExtensions to access privileged pages in open tabs. By tricking a user into installing a malicious web extension, a context-dependent attacker can gain access to potentially sensitive information.
 - A flaw exists that is triggered as input to the ''app.support'.baseURL' preference is not properly sanitized. This may allow a local attacker to create specially crafted script code that is executed in user's browser session within the context of the preferences tab.
 - A flaw exists in 'netwerk/protocol/viewsource/nsViewSourceHandler.cpp' that is triggered when handling view-source: URLs. By tricking a user into installing a malicious web extension, a context-dependent attacker can bypass content restrictions and view local 'file:' URL content or content stored in 'about:cache'.
 - A flaw exists that is triggered when handling access restrictions for web extensions. By tricking a user into installing a malicious web extension, a context-dependent attacker can inject script code into pages from other web extensions or unprivileged 'about:' pages.
 - A flaw exists in 'dom/workers/RuntimeService.cpp' that is triggered as a shared worker created from a data: URL can be shared by another tab with a different origin. This may allow a context-dependent attacker to bypass the same-origin policy.
 - A flaw exists in the 'nsChromeRegistry::Canonify()' function in 'chrome/nsChromeRegistry.cpp' that is triggered as access to a legacy extension's 'non-contentaccessible' resource is not properly restricted. With a specially crafted web page, a context-dependent attacker to gain unauthorized access.
 - A flaw exists in the 'ActionBarPresenter::updateCustomView()' function in 'customtabs/ActionBarPresenter.java' that is triggered when handling overly long domain names in an Android Custom Tab. This allows a context-dependent attacker to spoof the address bar.
 - A flaw exists in the 'nsMozIconURI::SetSpec()' function in 'image/decoders/icon/nsIconURI.cpp' that is triggered as access to moz-images is not properly restricted when using the 'moz-icon:' protocol. With a specially crafted web page, a context-dependent attacker can gain information about application associations for certain MIME types.
 - A flaw exists in the 'SendNotificationEventRunnable::WorkerRun()' function in 'dom/workers/ServiceWorkerPrivate.cpp' related to the Notifications Push API. This may allow a context-dependent attacker to open new tabs and display unwanted content from arbitrary URLs.
 - A flaw exists that is due to the in the Media Capture and Streams API not properly displaying the originating domain when requested via 'data:' or 'blob:' URLs. This may result in user confusion about which site is asking for this permission.
 - A flaw exists in the 'stripUnsafeProtocolOnPaste()' function in 'content/browser.js' that allows a cross-site scripting (Self-XSS) attack. This flaw exists exists because the application does not properly sanitize input to the address bar. This may allow a context-dependent attacker to create a specially crafted 'javascript:' URL containing an embedded tab character that executes arbitrary script code in their own browser.
 - An unspecified flaw exists that is triggered as certain input is not properly validated when handling typed arrays. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the AccessiblCaret (Copy & Paste) feature that is triggered when handling flushing of pending notifications. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'jit/CacheIR.cpp' that is triggered when attaching argument stubs. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSCompartment::getOrCreateIterResultTemplateObject()' function in 'jsiter.cpp' that is triggered when updating type information of iter result object templates. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A signednes flaw exists in the StoreBuffer class that may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MediaPipelineTransmit::SetDescription()' function in 'mediapipeline/MediaPipeline.cpp' that is triggered when handling media descriptions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsHTMLDocument::Open()' function in 'dom/html/nsHTMLDocument.cpp' that is triggered when handling unload events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCSSFrameConstructor::ContentRemoved()' function in 'layout/base/nsCSSFrameConstructor.cpp' that is triggered when handling frames for content nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'internal_ClearHistogramById()' function in 'toolkit/components/telemetry/TelemetryHistogram.cpp' that is triggered when handling expired histograms. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CanAttachAddElement()' function in 'jit/CacheIR.cpp' that is triggered when handling shadowing indexed properties. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'mozglue/android/NSSBridge.cpp' that is triggered as certain input is not properly validated when decoding base64 data. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when handling HTTP/2 streams. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'EventStateManager::NotifyMouseOver()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouseover events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readHeader()' function in 'vm/StructuredClone.cpp' that is triggered when handling structured clone data. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'jit::MakeMRegExpHoistable()' function in 'jit/IonAnalysis.cpp' that is triggered when optimization for regular expressions. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'JSObject::setFlags()' function in 'vm/Shape.cpp' that is triggered when checking for dictionary mode. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'vpx_codec_enc_init_multi_ver()' function in 'vpx_encoder.c' that is triggered when handling memory during early exits. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is related to document renderer handling. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An arithmetic flaw exists in the 'nsTextFrame::GetRenderedText()' function in 'layout/generic/nsTextFrame.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the EditorBase destructor in 'editor/libeditor/EditorBase.cpp' that is triggered when unlinking cycle collectors. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in 'vp9/encoder/x86/vp9_quantize_ssse3_x86_64.asm' that is triggered when handling memory 'pointers.This' may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsDocumentEncoder::SerializeToStringRecursive()' function in 'dom/base/nsDocumentEncoder.cpp' that is triggered when serializing DOM nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in the 'vorbis_book_decodevs_add()', 'vorbis_book_decodev_add()', and 'vorbis_book_decodevv_add()' functions in 'codebook.c' that is triggered when decoding codebooks from Vorbis audio data. This may allow a context-dependent attacker to corrupt memory and execute arbitrary code.

The version of Firefox installed on the remote Windows host is prior to 59.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-06 advisory.

  - A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during     editor operations. This results in a potentially exploitable crash. (CVE-2018-5128)

  - A buffer overflow can occur when manipulating the SVG <code>animatedPathSegList</code> through script.
    This results in a potentially exploitable crash. (CVE-2018-5127)

  - A lack of parameter validation on IPC messages results in a potential out-of-bounds write through     malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the     parent process. (CVE-2018-5129)

  - When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a     potentially exploitable crash is triggered. (CVE-2018-5130)

  - Under certain circumstances the <code>fetch()</code> API can return transient local copies of resources     that were sent with a <code>no-store</code> or <code>no-cache</code> cache header instead of downloading a     copy from the network as it should. This can result in previously stored, locally cached data of a website     being accessible to users if they share a common profile while browsing. (CVE-2018-5131)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 59. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

Mozilla Foundation reports :

CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList

CVE-2018-5128: Use-after-free manipulating editor selection ranges

CVE-2018-5129: Out-of-bounds write with malformed IPC messages

CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption

CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources

CVE-2018-5132: WebExtension Find API can search privileged pages

CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized

CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions

CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts

CVE-2018-5136: Same-origin policy violation with data: URL shared workers

CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources

CVE-2018-5138: Android Custom Tab address spoofing through long domain names

CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol

CVE-2018-5141: DOS attack through notifications Push API

CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs

CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar

CVE-2018-5126: Memory safety bugs fixed in Firefox 59

CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7

ID	Name	Product	Family	Type	Severity
275660	Mozilla Firefox < 59.0	Nessus	MacOS X Local Security Checks	Local	critical
700328	Mozilla Firefox < 59 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
108377	Mozilla Firefox < 59.0	Nessus	Windows	Local	critical
108375	Mozilla Firefox < 59 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	critical
108315	FreeBSD : mozilla -- multiple vulnerabilities (c71cdc95-3c18-45b7-866a-af28b59aabb5)	Nessus	FreeBSD Local Security Checks	Local	critical

Detections

Analytics

CVE-2018-5138

medium

Tenable Plugins

critical

high

critical

critical

critical