A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to     leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related     vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects     Firefox ESR < 78.9 and Firefox < 87. (CVE-2021-29955)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory.

  - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2021-23988)

  - A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to     leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related     vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.) (CVE-2021-29955)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - The Mozilla Maintenance Service granted SERVICESTART access to <code>BUILTIN|Users</code> which, in a     domain network, grants normal remote users access to start or stop the service. This could be used to     prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also     exposed attack surface in the maintenance service. Note: This issue only affected Windows operating     systems older than Win 10 build 1709. Other operating systems are unaffected. (CVE-2021-29951)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory.

  - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2021-23988)

  - A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to     leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related     vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.) (CVE-2021-29955)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - The Mozilla Maintenance Service granted SERVICESTART access to <code>BUILTIN|Users</code> which, in a     domain network, grants normal remote users access to start or stop the service. This could be used to     prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also     exposed attack surface in the maintenance service. Note: This issue only affected Windows operating     systems older than Win 10 build 1709. Other operating systems are unaffected. (CVE-2021-29951)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-11 advisory.

  - Mozilla developers and community members Alexis Beingessner, Tyson Smith, Julien Wajsberg, and Matthew     Gregan reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2021-23987)

  - An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be     exploited. (CVE-2021-4127)

  - A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to     leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related     vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.) (CVE-2021-29955)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 78.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-11 advisory.

  - Mozilla developers and community members Alexis Beingessner, Tyson Smith, Julien Wajsberg, and Matthew     Gregan reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2021-23987)

  - An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be     exploited. (CVE-2021-4127)

  - A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to     leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related     vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.) (CVE-2021-29955)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
243629	Linux Distros Unpatched Vulnerability : CVE-2021-29955	Nessus	Misc.	medium
148015	Mozilla Firefox < 87.0	Nessus	MacOS X Local Security Checks	high
148014	Mozilla Firefox < 87.0	Nessus	Windows	high
148013	Mozilla Firefox ESR < 78.9	Nessus	MacOS X Local Security Checks	critical
148012	Mozilla Firefox ESR < 78.9	Nessus	Windows	critical

Detections

Analytics

CVE-2021-29955

medium

Tenable Plugins

medium

high

high

critical

critical