Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API calls. This vulnerability affects Firefox < 83.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Repeated calls to the history and location interfaces could have been used to hang the browser. This was     addressed by introducing rate-limiting to these API calls. This vulnerability affects Firefox < 83.
    (CVE-2020-26963)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence
    of memory corruption and we presume that with enough effort some of these could have been exploited to run
    arbitrary code. This vulnerability affects Firefox < 83. (CVE-2020-26969)

  - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote
    attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and
    a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox <
    83. (CVE-2020-26952)

  - It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus
    making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects
    Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26953)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4637-2 advisory.

    USN-4637-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubuntu     16.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4637-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information across origins, bypass security restrictions, conduct phishing attacks, conduct     cross-site scripting (XSS) attacks, bypass Content Security Policy (CSP) restrictions, conduct DNS     rebinding attacks, or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 83.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-50 advisory.

  - Mozilla developers Tyson Smith, Aaron Klotz, David Major and Jason Kratzer reported memory safety bugs     present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2020-26969)

  - In Freetype, if PNG images were embedded into fonts, the <code>LoadSBitPng</code> function contained an     integer overflow that led to a heap buffer overflow, memory corruption, and an exploitable crash. Note:
    While Project Zero did discover instances of this vulnerability being exploited in the wild against     Chrome, in Firefox this vulnerability is only triggerable if a rarely-used, hidden preference is toggled,     and only affected Linux and Android operating systems. Other operating systems are unaffected; and Linux     and Android are unaffected in the default configuration. (CVE-2020-15999)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. (CVE-2020-26951)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and     a potentially exploitable crash when handling out-of-memory errors. (CVE-2020-26952)

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     <code>drawImage</code> function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks. (CVE-2020-16012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 83.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-50 advisory.

  - Mozilla developers Tyson Smith, Aaron Klotz, David Major and Jason Kratzer reported memory safety bugs     present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2020-26969)

  - In Freetype, if PNG images were embedded into fonts, the <code>LoadSBitPng</code> function contained an     integer overflow that led to a heap buffer overflow, memory corruption, and an exploitable crash. Note:
    While Project Zero did discover instances of this vulnerability being exploited in the wild against     Chrome, in Firefox this vulnerability is only triggerable if a rarely-used, hidden preference is toggled,     and only affected Linux and Android operating systems. Other operating systems are unaffected; and Linux     and Android are unaffected in the default configuration. (CVE-2020-15999)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. (CVE-2020-26951)

  - Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and     a potentially exploitable crash when handling out-of-memory errors. (CVE-2020-26952)

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     <code>drawImage</code> function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks. (CVE-2020-16012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
248459	Linux Distros Unpatched Vulnerability : CVE-2020-26963	Nessus	Misc.	medium
426894	Alpine: multiple librewolf packages: security update to 83.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426894	Alpine: multiple librewolf packages: security update to 83.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404375	Alpine: multiple firefox packages: security update to 83.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404375	Alpine: multiple firefox packages: security update to 83.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
143127	Ubuntu 16.04 LTS : Firefox vulnerabilities (USN-4637-2)	Nessus	Ubuntu Local Security Checks	high
143121	Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4637-1)	Nessus	Ubuntu Local Security Checks	high
142911	Mozilla Firefox < 83.0	Nessus	MacOS X Local Security Checks	critical
142910	Mozilla Firefox < 83.0	Nessus	Windows	critical

Detections

Analytics

CVE-2020-26963

medium

Tenable Plugins

medium

critical

critical

critical

critical

high

high

critical

critical