When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface. This vulnerability affects Firefox < 89.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which     allowed an attacker to paint over the user interface. This vulnerability affects Firefox < 89.
    (CVE-2021-29961)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these
    bugs showed evidence of memory corruption and we presume that with enough effort some of these could have
    been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and
    Firefox ESR < 78.11. (CVE-2021-29967)

  - When a user has already allowed a website to access microphone and camera, disabling camera sharing would
    not fully prevent the website from re-enabling it without an additional prompt. This was only possible if
    the website kept recording with the microphone until re-enabling the camera. This vulnerability affects
    Firefox < 89. (CVE-2021-29959)

  - Firefox used to cache the last filename used for printing a file. When generating a filename for printing,
    Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead
    to the title of a website visited during private browsing mode being stored on disk. This vulnerability
    affects Firefox < 89. (CVE-2021-29960)

  - When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which
    allowed an attacker to paint over the user interface. This vulnerability affects Firefox < 89.
    (CVE-2021-29961)

  - Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This
    bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects
    Firefox < 89. (CVE-2021-29962)

The remote host is affected by the vulnerability described in GLSA-202107-09 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4978-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, re-enable     camera devices without an additional permission prompt, spoof the browser UI, or execute arbitrary code.
    (CVE-2021-29959, CVE-2021-29961, CVE-2021-29966, CVE-2021-29967)

    It was discovered that filenames printed from private browsing mode were incorrectly retained in     preferences. A local attacker could potentially exploit this to obtain sensitive information.
    (CVE-2021-29960)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 89.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-23 advisory.

  - Mozilla developers Christian Holler, Anny Gakhokidze, Alexandru Michis, Gabriele Svelto reported memory     safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code. (CVE-2021-29967)

  - A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in     password manager to suggest passwords for the currently active website instead of the website that     triggered the dialog.  This bug only affects Firefox for Android. Other operating systems are unaffected.
    (CVE-2021-29965)

  - Firefox used to cache the last filename used for printing a file. When generating a filename for printing,     Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead     to the title of a website visited during private browsing mode being stored on disk. (CVE-2021-29960)

  - When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping     which allowed an attacker to paint over the user interface. (CVE-2021-29961)

  - Address bar search suggestions in private browsing mode were re-using session data from normal mode.  This     bug only affects Firefox for Android. Other operating systems are unaffected. (CVE-2021-29963)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 89.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-23 advisory.

  - Mozilla developers Christian Holler, Anny Gakhokidze, Alexandru Michis, Gabriele Svelto reported memory     safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code. (CVE-2021-29967)

  - A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in     password manager to suggest passwords for the currently active website instead of the website that     triggered the dialog.  This bug only affects Firefox for Android. Other operating systems are unaffected.
    (CVE-2021-29965)

  - Firefox used to cache the last filename used for printing a file. When generating a filename for printing,     Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead     to the title of a website visited during private browsing mode being stored on disk. (CVE-2021-29960)

  - When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping     which allowed an attacker to paint over the user interface. (CVE-2021-29961)

  - Address bar search suggestions in private browsing mode were re-using session data from normal mode.  This     bug only affects Firefox for Android. Other operating systems are unaffected. (CVE-2021-29963)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250021	Linux Distros Unpatched Vulnerability : CVE-2021-29961	Nessus	Misc.	medium
426895	Alpine: multiple librewolf packages: security update to 89.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426895	Alpine: multiple librewolf packages: security update to 89.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404382	Alpine: multiple firefox packages: security update to 89.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404382	Alpine: multiple firefox packages: security update to 89.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
157041	GLSA-202107-09 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
150152	Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4978-1)	Nessus	Ubuntu Local Security Checks	high
150120	Mozilla Firefox < 89.0	Nessus	MacOS X Local Security Checks	high
150119	Mozilla Firefox < 89.0	Nessus	Windows	high

Detections

Analytics

CVE-2021-29961

medium

Tenable Plugins

medium

high

high

high

high

high

high

high

high