If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.<br>*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox
    96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with
    enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects
    Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22764)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This
    vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2021-4140)

  - Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera,
    Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of
    these bugs showed evidence of memory corruption and we presume that with enough effort some of these could
    have been exploited to run arbitrary code. This vulnerability affects Firefox < 97. (CVE-2022-0511)

  - If Firefox was installed to a world-writable directory, a local privilege escalation could occur when
    Firefox searched the current directory for system libraries. However the install directory is not world-
    writable by default.<br>*This bug only affects Firefox for Windows in a non-default installation. Other
    operating systems are unaffected.*. This vulnerability affects Firefox < 96. (CVE-2022-22736)

  - Constructing audio sinks could have lead to a race condition when playing audio files and closing windows.
    This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability
    affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22737)

The version of Firefox installed on the remote Windows host is prior to 96.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-01 advisory.

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. (CVE-2022-22763)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Firefox for Windows. Other operating     systems are unaffected. (CVE-2022-22746)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

  - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 96.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-01 advisory.

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. (CVE-2022-22763)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Firefox for Windows. Other operating     systems are unaffected. (CVE-2022-22746)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

  - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
426763	Alpine: multiple librewolf packages: security update to 97.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
426763	Alpine: multiple librewolf packages: security update to 97.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
404388	Alpine: multiple firefox packages: security update to 97.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
404388	Alpine: multiple firefox packages: security update to 97.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
156606	Mozilla Firefox < 96.0	Nessus	Windows	Local	critical
156605	Mozilla Firefox < 96.0	Nessus	MacOS X Local Security Checks	Local	critical

Detections

Analytics

CVE-2022-22736

high

Tenable Plugins

critical

critical

critical

critical

critical

critical