Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR
    78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some
    of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox
    ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. (CVE-2020-15659)

  - Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (CVE-2020-6463)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a
    privileged network position to potentially exploit heap corruption via a crafted SCTP stream.
    (CVE-2020-6514)

  - Given an installed malicious file picker application, an attacker was able to steal and upload local files
    of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for
    Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
    (CVE-2020-15649)

  - Given an installed malicious file picker application, an attacker was able to overwrite local files and
    thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected
    Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR <
    68.11. (CVE-2020-15650)

The version of Firefox ESR installed on the remote Windows host is prior to 68.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-31 advisory.

  - Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and     Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code. (CVE-2020-15659)

  - Crafted media files could lead to a race in texture caches, resulting in a use-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-6463)

  - By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a     cross-origin redirect. This applied only to content that can be parsed as script. (CVE-2020-15652)

  - WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value     is often transmitted to the peer, which allows bypassing ASLR. (CVE-2020-6514)

  - Given an installed malicious file picker application, an attacker was able to overwrite local files and     thus overwrite Firefox settings (but not access the previous profile).  Note: This issue only affected     Firefox for Android. Other operating systems are unaffected. (CVE-2020-15650)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-31 advisory.

  - Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and     Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code. (CVE-2020-15659)

  - Crafted media files could lead to a race in texture caches, resulting in a use-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-6463)

  - By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a     cross-origin redirect. This applied only to content that can be parsed as script. (CVE-2020-15652)

  - WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value     is often transmitted to the peer, which allows bypassing ASLR. (CVE-2020-6514)

  - Given an installed malicious file picker application, an attacker was able to overwrite local files and     thus overwrite Firefox settings (but not access the previous profile).  Note: This issue only affected     Firefox for Android. Other operating systems are unaffected. (CVE-2020-15650)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
405617	Alpine: mozjs68: security update to 68.11.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405617	Alpine: mozjs68: security update to 68.11.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404427	Alpine: multiple firefox-esr packages: security update to 68.11.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404427	Alpine: multiple firefox-esr packages: security update to 68.11.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
139063	Mozilla Firefox ESR < 68.11	Nessus	Windows	high
139062	Mozilla Firefox ESR < 68.11	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2020-15649

medium

Tenable Plugins

high

high

high

high

high

high