When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from     arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain     fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note:
    This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability     affects Firefox < 83. (CVE-2020-26954)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence
    of memory corruption and we presume that with enough effort some of these could have been exploited to run
    arbitrary code. This vulnerability affects Firefox < 83. (CVE-2020-26969)

  - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote
    attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and
    a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox <
    83. (CVE-2020-26952)

  - It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus
    making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects
    Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26953)

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 83.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-50 advisory.

  - Mozilla developers Tyson Smith, Aaron Klotz, David Major and Jason Kratzer reported memory safety bugs     present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2020-26969)

  - In Freetype, if PNG images were embedded into fonts, the <code>LoadSBitPng</code> function contained an     integer overflow that led to a heap buffer overflow, memory corruption, and an exploitable crash. Note:
    While Project Zero did discover instances of this vulnerability being exploited in the wild against     Chrome, in Firefox this vulnerability is only triggerable if a rarely-used, hidden preference is toggled,     and only affected Linux and Android operating systems. Other operating systems are unaffected; and Linux     and Android are unaffected in the default configuration. (CVE-2020-15999)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. (CVE-2020-26951)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and     a potentially exploitable crash when handling out-of-memory errors. (CVE-2020-26952)

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     <code>drawImage</code> function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks. (CVE-2020-16012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 83.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-50 advisory.

  - Mozilla developers Tyson Smith, Aaron Klotz, David Major and Jason Kratzer reported memory safety bugs     present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2020-26969)

  - In Freetype, if PNG images were embedded into fonts, the <code>LoadSBitPng</code> function contained an     integer overflow that led to a heap buffer overflow, memory corruption, and an exploitable crash. Note:
    While Project Zero did discover instances of this vulnerability being exploited in the wild against     Chrome, in Firefox this vulnerability is only triggerable if a rarely-used, hidden preference is toggled,     and only affected Linux and Android operating systems. Other operating systems are unaffected; and Linux     and Android are unaffected in the default configuration. (CVE-2020-15999)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. (CVE-2020-26951)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and     a potentially exploitable crash when handling out-of-memory errors. (CVE-2020-26952)

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     <code>drawImage</code> function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks. (CVE-2020-16012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
248600	Linux Distros Unpatched Vulnerability : CVE-2020-26954	Nessus	Misc.	Local	medium
426894	Alpine: multiple librewolf packages: security update to 83.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
426894	Alpine: multiple librewolf packages: security update to 83.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
404375	Alpine: multiple firefox packages: security update to 83.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
404375	Alpine: multiple firefox packages: security update to 83.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
142911	Mozilla Firefox < 83.0	Nessus	MacOS X Local Security Checks	Local	critical
142910	Mozilla Firefox < 83.0	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2020-26954

medium

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical