Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence     of memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 84. (CVE-2020-35114)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must
    ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted
    in WebGL, resulting in a use-after-free and a potentially exploitable crash. This vulnerability affects
    Firefox < 84. (CVE-2020-26972)

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain
    potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow
    on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR <
    78.6. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This
    could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6,
    and Firefox ESR < 78.6. (CVE-2020-26973)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4671-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information, bypass the CSS sanitizer, bypass security restrictions, spoof the URL bar, or     execute arbitrary code. (CVE-2020-16042, CVE-2020-26971, CVE-2020-26972, CVE-2020-26793, CVE-2020-26974,     CVE-2020-26976, CVE-2020-26978, CVE-2020-26979, CVE-2020-35113, CVE-2020-35114)

    It was discovered that the proxy.onRequest API did not catch view-source URLs. If a user were tricked in     to installing an extension with the proxy permission and opening View Source, an attacker could     potentially exploit this to obtain sensitive information. (CVE-2020-35111)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory.

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must     ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted     in WebGL, resulting in a use-after-free and a potentially exploitable crash. (CVE-2020-26972)

  - When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory     to be read. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. (CVE-2020-26973)

  - When <code>flex-basis</code> was used on a table wrapper, a <code>StyleGenericFlexBasis</code> object     could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-26974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory.

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must     ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted     in WebGL, resulting in a use-after-free and a potentially exploitable crash. (CVE-2020-26972)

  - When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory     to be read. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. (CVE-2020-26973)

  - When <code>flex-basis</code> was used on a table wrapper, a <code>StyleGenericFlexBasis</code> object     could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-26974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
247216	Linux Distros Unpatched Vulnerability : CVE-2020-35114	Nessus	Misc.	high
426760	Alpine: multiple librewolf packages: security update to 84.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426760	Alpine: multiple librewolf packages: security update to 84.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404376	Alpine: multiple firefox packages: security update to 84.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404376	Alpine: multiple firefox packages: security update to 84.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
144299	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4671-1)	Nessus	Ubuntu Local Security Checks	critical
144283	Mozilla Firefox < 84.0	Nessus	MacOS X Local Security Checks	critical
144282	Mozilla Firefox < 84.0	Nessus	Windows	critical

Detections

Analytics

CVE-2020-35114

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical