When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must
    ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted
    in WebGL, resulting in a use-after-free and a potentially exploitable crash. This vulnerability affects
    Firefox < 84. (CVE-2020-26972)

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain
    potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow
    on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR <
    78.6. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This
    could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6,
    and Firefox ESR < 78.6. (CVE-2020-26973)

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory.

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must     ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted     in WebGL, resulting in a use-after-free and a potentially exploitable crash. (CVE-2020-26972)

  - When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory     to be read. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. (CVE-2020-26973)

  - When <code>flex-basis</code> was used on a table wrapper, a <code>StyleGenericFlexBasis</code> object     could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-26974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory.

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must     ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted     in WebGL, resulting in a use-after-free and a potentially exploitable crash. (CVE-2020-26972)

  - When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory     to be read. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. (CVE-2020-26973)

  - When <code>flex-basis</code> was used on a table wrapper, a <code>StyleGenericFlexBasis</code> object     could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-26974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
426760	Alpine: multiple librewolf packages: security update to 84.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426760	Alpine: multiple librewolf packages: security update to 84.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404376	Alpine: multiple firefox packages: security update to 84.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404376	Alpine: multiple firefox packages: security update to 84.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
144283	Mozilla Firefox < 84.0	Nessus	MacOS X Local Security Checks	critical
144282	Mozilla Firefox < 84.0	Nessus	Windows	critical

Detections

Analytics

CVE-2020-26975

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical