Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.7.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-06 advisory.

  - In the Angle graphics library, depth pitch computations did not take into account the block size and     simply multiplied the row pitch with the pixel height.  This caused the load functions to use a very high     depth pitch, reading past the end of the user-supplied buffer. Note: This issue only affected Windows     operating systems. Other operating systems are unaffected. (CVE-2020-16048)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 85.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-06 advisory.

  - In the Angle graphics library, depth pitch computations did not take into account the block size and     simply multiplied the row pitch with the pixel height.  This caused the load functions to use a very high     depth pitch, reading past the end of the user-supplied buffer. Note: This issue only affected Windows     operating systems. Other operating systems are unaffected. (CVE-2020-16048)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 85.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-06 advisory.

  - In the Angle graphics library, depth pitch computations did not take into account the block size and     simply multiplied the row pitch with the pixel height.  This caused the load functions to use a very high     depth pitch, reading past the end of the user-supplied buffer. Note: This issue only affected Windows     operating systems. Other operating systems are unaffected. (CVE-2020-16048)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 78.7.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-06 advisory.

  - In the Angle graphics library, depth pitch computations did not take into account the block size and     simply multiplied the row pitch with the pixel height.  This caused the load functions to use a very high     depth pitch, reading past the end of the user-supplied buffer. Note: This issue only affected Windows     operating systems. Other operating systems are unaffected. (CVE-2020-16048)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
275673	Mozilla Firefox ESR < 78.7.1	Nessus	MacOS X Local Security Checks	Local	medium
275663	Mozilla Firefox < 85.0.1	Nessus	MacOS X Local Security Checks	Local	medium
146425	Mozilla Firefox < 85.0.1	Nessus	Windows	Local	medium
146424	Mozilla Firefox ESR < 78.7.1	Nessus	Windows	Local	medium

Detections

Analytics

CVE-2020-16048

medium

Tenable Plugins

medium

medium

medium

medium