The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects     Firefox ESR < 68.8 and Firefox < 76. (CVE-2020-12389)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR
    68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some
    of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,
    Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to
    memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,
    Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This
    resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,
    and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox
    escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects
    Firefox ESR < 68.8 and Firefox < 76. (CVE-2020-12388, CVE-2020-12389)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14359-1 advisory.

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,     and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects     Firefox ESR < 68.8 and Firefox < 76. (CVE-2020-12388, CVE-2020-12389)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. This vulnerability     affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request,     which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command     into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this     issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12393)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

Update to version 68.8.0 ESR (bsc#1171186) :

CVE-2020-12387: Use-after-free during worker shutdown

CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens

CVE-2020-12389: Sandbox escape with improperly separated process types

CVE-2020-6831: Buffer overflow in SCTP chunk input validation

CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'

CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox fixes the following issues :

Update to version 68.8.0 ESR (bsc#1171186) :

  - CVE-2020-12387: Use-after-free during worker shutdown

  - CVE-2020-12388: Sandbox escape with improperly guarded     Access Tokens

  - CVE-2020-12389: Sandbox escape with improperly separated     process types

  - CVE-2020-6831: Buffer overflow in SCTP chunk input     validation

  - CVE-2020-12392: Arbitrary local file access with 'Copy     as cURL'

  - CVE-2020-12393: Devtools' 'Copy as cURL' feature did not     fully escape website-controlled data, potentially     leading to command injection

  - CVE-2020-12395: Memory safety bugs fixed in Firefox 76     and Firefox ESR 68.8

This update was imported from the SUSE:SLE-15:Update update project.

The version of Firefox installed on the remote Windows host is prior to 76.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-16 advisory.

  - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported memory safety bugs present in Firefox 75 and Firefox     ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2020-12395)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. Note: this issue only affects Firefox on Windows operating systems. (CVE-2020-12388,     CVE-2020-12389)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. (CVE-2020-12387)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. (CVE-2020-6831)

  - Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks     (CVE-2020-12390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 76.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-16 advisory.

  - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported memory safety bugs present in Firefox 75 and Firefox     ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2020-12395)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. Note: this issue only affects Firefox on Windows operating systems. (CVE-2020-12388,     CVE-2020-12389)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. (CVE-2020-12387)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. (CVE-2020-6831)

  - Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks     (CVE-2020-12390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New mozilla-firefox packages are available for Slackware 14.2 and
-current to fix security issues.

The version of Firefox ESR installed on the remote Windows host is prior to 68.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-17 advisory.

  - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported memory safety bugs present in Firefox 75 and Firefox     ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2020-12395)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. Note: this issue only affects Firefox on Windows operating systems. (CVE-2020-12388,     CVE-2020-12389)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. (CVE-2020-12387)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. (CVE-2020-6831)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. (CVE-2020-12392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-17 advisory.

  - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported memory safety bugs present in Firefox 75 and Firefox     ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2020-12395)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. Note: this issue only affects Firefox on Windows operating systems. (CVE-2020-12388,     CVE-2020-12389)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. (CVE-2020-12387)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. (CVE-2020-6831)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. (CVE-2020-12392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
248241	Linux Distros Unpatched Vulnerability : CVE-2020-12389	Nessus	Misc.	critical
426034	Alpine: multiple librewolf packages: security update to 76.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426034	Alpine: multiple librewolf packages: security update to 76.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405620	Alpine: mozjs68: security update to 68.8.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405620	Alpine: mozjs68: security update to 68.8.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404435	Alpine: multiple firefox-esr packages: security update to 68.8.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404435	Alpine: multiple firefox-esr packages: security update to 68.8.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404367	Alpine: multiple firefox packages: security update to 76.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404367	Alpine: multiple firefox packages: security update to 76.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
150555	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2020:14359-1)	Nessus	SuSE Local Security Checks	critical
136654	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:1218-1)	Nessus	SuSE Local Security Checks	critical
136649	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:1209-1)	Nessus	SuSE Local Security Checks	critical
136450	openSUSE Security Update : MozillaFirefox (openSUSE-2020-621)	Nessus	SuSE Local Security Checks	critical
136404	Mozilla Firefox < 76.0	Nessus	Windows	critical
136403	Mozilla Firefox < 76.0	Nessus	MacOS X Local Security Checks	critical
136392	Slackware 14.2 / current : mozilla-firefox (SSA:2020-126-01)	Nessus	Slackware Local Security Checks	critical
136357	Mozilla Firefox ESR < 68.8	Nessus	Windows	critical
136356	Mozilla Firefox ESR < 68.8	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2020-12389

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical