Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence     of memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 86. (CVE-2021-23979)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence
    of memory corruption and we presume that with enough effort some of these could have been exploited to run
    arbitrary code. This vulnerability affects Firefox < 87. (CVE-2021-23988)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the
    frame was reported in the violation report; as opposed to the original frame URI. This could be used to
    leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <
    78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need
    to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible,
    user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types
    of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was
    fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <
    78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in
    multithreaded wasm code. This vulnerability affects Firefox < 86. (CVE-2021-23970)

  - When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's
    Referrer-Policy. This would have potentially resulted in more information than intended by the original
    origin being provided to the destination of the redirect. This vulnerability affects Firefox < 86.
    (CVE-2021-23971)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4756-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information, conduct cross-site scripting (XSS) attacks, bypass HTTP auth phishing warnings, or     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 86.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-07 advisory.

  - Mozilla developers Tyson Smith, Lars T Hansen, Valentin Gosu, and Sebastian Hengst reported memory safety     bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-23979)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If thats not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in     multithreaded wasm code. (CVE-2021-23970)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. (CVE-2021-23968)

  - The DOMParser API did not properly process <code><noscript></code> elements for escaping. This could     be used as an mXSS vector to bypass an HTML Sanitizer. (CVE-2021-23974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 86.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-07 advisory.

  - Mozilla developers Tyson Smith, Lars T Hansen, Valentin Gosu, and Sebastian Hengst reported memory safety     bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-23979)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If thats not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in     multithreaded wasm code. (CVE-2021-23970)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. (CVE-2021-23968)

  - The DOMParser API did not properly process <code><noscript></code> elements for escaping. This could     be used as an mXSS vector to bypass an HTML Sanitizer. (CVE-2021-23974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250184	Linux Distros Unpatched Vulnerability : CVE-2021-23979	Nessus	Misc.	high
426036	Alpine: multiple librewolf packages: security update to 87.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426036	Alpine: multiple librewolf packages: security update to 87.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404379	Alpine: multiple firefox packages: security update to 87.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404379	Alpine: multiple firefox packages: security update to 87.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
147994	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4756-1)	Nessus	Ubuntu Local Security Checks	high
146780	Mozilla Firefox < 86.0	Nessus	Windows	high
146779	Mozilla Firefox < 86.0	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2021-23979

high

Tenable Plugins

high

high

high

high

high

high

high

high