By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could     have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability     affects Firefox < 87. (CVE-2021-23983)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence
    of memory corruption and we presume that with enough effort some of these could have been exploited to run
    arbitrary code. This vulnerability affects Firefox < 87. (CVE-2021-23988)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the
    frame was reported in the violation report; as opposed to the original frame URI. This could be used to
    leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <
    78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need
    to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible,
    user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types
    of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was
    fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <
    78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in
    multithreaded wasm code. This vulnerability affects Firefox < 86. (CVE-2021-23970)

  - When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's
    Referrer-Policy. This would have potentially resulted in more information than intended by the original
    origin being provided to the destination of the redirect. This vulnerability affects Firefox < 86.
    (CVE-2021-23971)

The remote host is affected by the vulnerability described in GLSA-202104-10 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4893-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information, or execute arbitrary code. (CVE-2021-23981, CVE-2021-23982, CVE-2021-23983,     CVE-2021-23987, CVE-2021-23988)

    It was discovered that extensions could open popup windows with control of the window title in some     circumstances. If a user were tricked into installing a specially crafted extension, an attacker could     potentially exploit this to spook a website and trick the user into providing credentials.
    (CVE-2021-23984)

    It was discovered that the DevTools remote debugging feature could be enabled without an indication to the     user. If a local attacker could modify the browser configuration, a remote attacker could potentially     exploit this to obtain sensitive information. (CVE-2021-23985)

    It was discovered that extensions could read the response of cross origin requests in some circumstances.
    If a user were tricked into installing a specially crafted extension, an attacker could potentially     exploit this to obtain sensitive information. (CVE-2021-23986)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory.

  - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2021-23988)

  - A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to     leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related     vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.) (CVE-2021-29955)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - The Mozilla Maintenance Service granted SERVICESTART access to <code>BUILTIN|Users</code> which, in a     domain network, grants normal remote users access to start or stop the service. This could be used to     prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also     exposed attack surface in the maintenance service. Note: This issue only affected Windows operating     systems older than Win 10 build 1709. Other operating systems are unaffected. (CVE-2021-29951)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory.

  - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2021-23988)

  - A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to     leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related     vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.) (CVE-2021-29955)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - The Mozilla Maintenance Service granted SERVICESTART access to <code>BUILTIN|Users</code> which, in a     domain network, grants normal remote users access to start or stop the service. This could be used to     prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also     exposed attack surface in the maintenance service. Note: This issue only affected Windows operating     systems older than Win 10 build 1709. Other operating systems are unaffected. (CVE-2021-29951)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250128	Linux Distros Unpatched Vulnerability : CVE-2021-23983	Nessus	Misc.	medium
426036	Alpine: multiple librewolf packages: security update to 87.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426036	Alpine: multiple librewolf packages: security update to 87.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404379	Alpine: multiple firefox packages: security update to 87.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404379	Alpine: multiple firefox packages: security update to 87.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
149233	GLSA-202104-10 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
148135	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4893-1)	Nessus	Ubuntu Local Security Checks	high
148015	Mozilla Firefox < 87.0	Nessus	MacOS X Local Security Checks	high
148014	Mozilla Firefox < 87.0	Nessus	Windows	high

Detections

Analytics

CVE-2021-23983

medium

Tenable Plugins

medium

high

high

high

high

high

high

high

high