When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from     arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain     fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note:
    This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating     systems are unaffected. This vulnerability affects Firefox < 86. (CVE-2021-23976)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence
    of memory corruption and we presume that with enough effort some of these could have been exploited to run
    arbitrary code. This vulnerability affects Firefox < 87. (CVE-2021-23988)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the
    frame was reported in the violation report; as opposed to the original frame URI. This could be used to
    leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <
    78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need
    to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible,
    user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types
    of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was
    fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <
    78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in
    multithreaded wasm code. This vulnerability affects Firefox < 86. (CVE-2021-23970)

  - When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's
    Referrer-Policy. This would have potentially resulted in more information than intended by the original
    origin being provided to the destination of the redirect. This vulnerability affects Firefox < 86.
    (CVE-2021-23971)

The remote host is affected by the vulnerability described in GLSA-202104-10 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of Firefox installed on the remote Windows host is prior to 86.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-07 advisory.

  - Mozilla developers Tyson Smith, Lars T Hansen, Valentin Gosu, and Sebastian Hengst reported memory safety     bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-23979)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If thats not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in     multithreaded wasm code. (CVE-2021-23970)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. (CVE-2021-23968)

  - The DOMParser API did not properly process <code><noscript></code> elements for escaping. This could     be used as an mXSS vector to bypass an HTML Sanitizer. (CVE-2021-23974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 86.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-07 advisory.

  - Mozilla developers Tyson Smith, Lars T Hansen, Valentin Gosu, and Sebastian Hengst reported memory safety     bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-23979)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If thats not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in     multithreaded wasm code. (CVE-2021-23970)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. (CVE-2021-23968)

  - The DOMParser API did not properly process <code><noscript></code> elements for escaping. This could     be used as an mXSS vector to bypass an HTML Sanitizer. (CVE-2021-23974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
247761	Linux Distros Unpatched Vulnerability : CVE-2021-23976	Nessus	Misc.	high
426036	Alpine: multiple librewolf packages: security update to 87.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426036	Alpine: multiple librewolf packages: security update to 87.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404379	Alpine: multiple firefox packages: security update to 87.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404379	Alpine: multiple firefox packages: security update to 87.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
149233	GLSA-202104-10 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
146780	Mozilla Firefox < 86.0	Nessus	Windows	high
146779	Mozilla Firefox < 86.0	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2021-23976

high

Tenable Plugins

high

high

high

high

high

high

high

high