An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483. This vulnerability affects Firefox < 102.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3396-1 advisory.

    Mozilla Firefox was updated to 102.3.0esr ESR (bsc#1200793, bsc#1201758, bsc#1202645, bsc#1203477):

    - CVE-2022-40959: Fixed bypassing FeaturePolicy restrictions on transient pages.
    - CVE-2022-40960: Fixed data-race when parsing non-UTF-8 URLs in threads.
    - CVE-2022-40958: Fixed bypassing secure context restriction for cookies with __Host and __Secure prefix.
    - CVE-2022-40956: Fixed content-security-policy base-uri bypass.
    - CVE-2022-40957: Fixed incoherent instruction cache when building WASM on ARM64.
    - CVE-2022-40962: Fixed memory safety bugs.
    - CVE-2022-38472: Fixed a potential address bar spoofing via XSLT error handling.
    - CVE-2022-38473: Fixed an issue where cross-origin XSLT documents could inherit the parent's permissions.
    - CVE-2022-38478: Fixed various memory safety issues.
    - CVE-2022-38476: Fixed data race and potential use-after-free in PK11_ChangePW.
    - CVE-2022-38477: Fixed memory safety bugs.
    - CVE-2022-36319: Fixed mouse position spoofing with CSS transforms.
    - CVE-2022-36318: Fixed directory indexes for bundled resources reflected URL parameters.
    - CVE-2022-36314: Fixed unexpected network loads when opening local .lnk files.
    - CVE-2022-2505: Fixed memory safety bugs.
    - CVE-2022-34479: Fixed vulnerabilty where a popup window could be resized in a way to overlay the address     bar with web content.
    - CVE-2022-34470: Fixed use-after-free in nsSHistory.
    - CVE-2022-34468: Fixed bypass of CSP sandbox header without `allow-scripts` via retargeted javascript:
    URI.
    - CVE-2022-34482: Fixed drag and drop of malicious image that could have led to malicious executable and     potential code execution.
    - CVE-2022-34483: Fixed drag and drop of malicious image that could have led to malicious executable and     potential code execution.
    - CVE-2022-34476: Fixed vulnerability where ASN.1 parser could have been tricked into accepting malformed     ASN.1.
    - CVE-2022-34481: Fixed potential integer overflow in ReplaceElementsAt
    - CVE-2022-34474: Fixed vulnerability where sandboxed iframes could redirect to external schemes.
    - CVE-2022-34469: Fixed TLS certificate errors on HSTS-protected domains which could be bypassed by the     user on Firefox for Android.
    - CVE-2022-34471: Fixed vulnerability where a compromised server could trick a browser into an addon     downgrade.
    - CVE-2022-34472: Fixed vulnerability where an unavailable PAC file resulted in OCSP requests being     blocked.
    - CVE-2022-34478: Fixed vulnerability where Microsoft protocols can be attacked if a user accepts a     prompt.
    - CVE-2022-2200: Fixed vulnerability where undesired attributes could be set as part of prototype     pollution.
    - CVE-2022-34480: Fixed free of uninitialized pointer in lg_init.
    - CVE-2022-34477: Fixed vulnerability in MediaError message property leaking information on cross-origin     same-site pages.
    - CVE-2022-34475: Fixed vulnerability where the HTML Sanitizer could have been bypassed via same-origin     script via use tags.
    - CVE-2022-34473: Fixed vulnerability where the HTML Sanitizer could have been bypassed via use tags.
    - CVE-2022-34484: Fixed memory safety bugs.
    - CVE-2022-34485: Fixed memory safety bugs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3273-1 advisory.

    Mozilla Firefox was updated to 102.2.0esr ESR:

    * Fixed: Various stability, functionality, and security fixes.

    - MFSA 2022-34 (bsc#1202645)

      * CVE-2022-38472 (bmo#1769155)         Address bar spoofing via XSLT error handling
      * CVE-2022-38473 (bmo#1771685)         Cross-origin XSLT Documents would have inherited the parent's         permissions
      * CVE-2022-38476 (bmo#1760998)         Data race and potential use-after-free in PK11_ChangePW
      * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,         bmo#1773363)         Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
      * CVE-2022-38478 (bmo#1770630, bmo#1776658)         Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,         and Firefox ESR 91.13

    Firefox Extended Support Release 102.1 ESR

      * Fixed: Various stability, functionality, and security fixes.

    - MFSA 2022-30 (bsc#1201758)

      * CVE-2022-36319 (bmo#1737722)         Mouse Position spoofing with CSS transforms
      * CVE-2022-36318 (bmo#1771774)         Directory indexes for bundled resources reflected URL         parameters
      * CVE-2022-36314 (bmo#1773894)         Opening local <code>.lnk</code> files could cause unexpected         network loads
      * CVE-2022-2505 (bmo#1769739, bmo#1772824)         Memory safety bugs fixed in Firefox 103 and 102.1

    - Firefox Extended Support Release 102.0.1 ESR

      * Fixed: Fixed bookmark shortcut creation by dragging to         Windows File Explorer and dropping partially broken         (bmo#1774683)
      * Fixed: Fixed bookmarks sidebar flashing white when opened in         dark mode (bmo#1776157)
      * Fixed: Fixed multilingual spell checking not working with         content in both English and a non-Latin alphabet         (bmo#1773802)
      * Fixed: Developer tools:  Fixed an issue where the console         output keep getting scrolled to the bottom when the last         visible message is an evaluation result (bmo#1776262)
      * Fixed: Fixed *Delete cookies and site data when Firefox is         closed* checkbox getting disabled on startup (bmo#1777419)
      * Fixed: Various stability fixes

    Firefox 102.0 ESR:

    * New:

      - We now provide more secure connections: Firefox can         now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc         headers.
      - For added viewing pleasure, full-range color levels are now         supported for video playback on many systems.
      - Find it easier now! Mac users can now access the macOS         share options from the Firefox File menu.
      - Voil?! Support for images containing ICC v4 profiles is         enabled on macOS.
      - Firefox now supports the new AVIF image format, which is         based on the modern and royalty-free AV1 video codec. It         offers significant bandwidth savings for sites compared to         existing image formats. It also supports transparency and         other advanced features.
      - Firefox PDF viewer now supports filling more forms (e.g.,         XFA-based forms, used by multiple governments and banks).
        Learn more.
      - When available system memory is critically low, Firefox on         Windows will automatically unload tabs based on their last         access time, memory usage, and other attributes. This helps         to reduce Firefox out-of-memory crashes. Forgot something?         Switching to an unloaded tab automatically reloads it.
      - To prevent session loss for macOS users who are running         Firefox from a mounted .dmg file, theyll now be prompted to         finish installation. Bear in mind, this permission prompt         only appears the first time these users run Firefox on their         computer.
      - For your safety, Firefox now blocks downloads that rely on         insecure connections, protecting against potentially         malicious or unsafe downloads. Learn more and see where to         find downloads in Firefox.
      - Improved web compatibility for privacy protections with         SmartBlock 3.0: In Private Browsing and Strict Tracking         Protection, Firefox goes to great lengths to protect your web         browsing activity from trackers. As part of this, the built-         in content blocking will automatically block third-party         scripts, images, and other content from being loaded from         cross-site tracking companies reported by Disconnect. Learn         more.
      - Introducing a new referrer tracking protection in Strict         Tracking Protection and Private Browsing. This feature         prevents sites from unknowingly leaking private information         to trackers. Learn more.
      - Introducing Firefox Suggest, a feature that provides         website suggestions as you type into the address bar. Learn         more about this faster way to navigate the web and locale-         specific features.
      - Firefox macOS now uses Apple's low-power mode for         fullscreen video on sites such as YouTube and Twitch. This         meaningfully extends battery life in long viewing sessions.
        Now your kids can find out what the fox says on a loop         without you ever missing a beat
      - With this release, power users can use about:unloads to         release system resources by manually unloading tabs without         closing them.
      - On Windows, there will now be fewer interruptions because         Firefox wont prompt you for updates. Instead, a background         agent will download and install updates even if Firefox is         closed.
      - On Linux, weve improved WebGL performance and reduced         power consumption for many users.
      - To better protect all Firefox users against side-channel         attacks, such as Spectre, we introduced Site Isolation.
      - Firefox no longer warns you by default when you exit the         browser or close a window using a menu, button, or three-key         command. This should cut back on unwelcome notifications,         which is always nicehowever, if you prefer a bit of notice,         youll still have full control over the quit/close modal         behavior. All warnings can be managed within Firefox         Settings. No worries! More details here.
      - Firefox supports the new Snap Layouts menus when running on         Windows 11.
      - RLBoxa new technology that hardens Firefox against         potential security vulnerabilities in third-party         librariesis now enabled on all platforms.
      - Weve reduced CPU usage on macOS in Firefox and         WindowServer during event processing.
      - Weve also reduced the power usage of software decoded         video on macOS, especially in fullscreen. This includes         streaming sites such as Netflix and Amazon Prime Video.
      - You can now move the Picture-in-Picture toggle button to         the opposite side of the video. Simply look for the new         context menu option Move Picture-in-Picture Toggle to Left         (Right) Side.
      - Weve made significant improvements in noise suppression         and auto-gain-control, as well as slight improvements in         echo-cancellation to provide you with a better overall         experience.
      - Weve also significantly reduced main-thread load.
      - When printing, you can now choose to print only the         odd/even pages.
      - Firefox now supports and displays the new style of         scrollbars on Windows 11.
      - Firefox has a new optimized download flow. Instead of         prompting every time, files will download automatically.
        However, they can still be opened from the downloads panel         with just one click. Easy! More information
      - Firefox no longer asks what to do for each file by default.
        You wont be prompted to choose a helper application or save         to disk before downloading a file unless you have changed         your download action setting for that type of file.
     -  Any files you download will be immediately saved on your         disk. Depending on the current configuration, theyll be         saved in your preferred download folder, or youll be asked         to select a location for each download. Windows and Linux         users will find their downloaded files in the destination         folder. Theyll no longer be put in the Temp folder.
      - Firefox allows users to choose from a number of built-in         search engines to set as their default. In this release, some         users who had previously configured a default engine might         notice their default search engine has changed since Mozilla         was unable to secure formal permission to continue including         certain search engines in Firefox.
      - You can now toggle Narrate in ReaderMode with the keyboard         shortcut 'n.'
      - You can find added support for searchwith or without         diacriticsin the PDF viewer.
      - The Linux sandbox has been strengthened: processes exposed         to web content no longer have access to the X Window system         (X11).
      - Firefox now supports credit card autofill and capture in         Germany, France, and the United Kingdom.
      - We now support captions/subtitles display on YouTube, Prime         Video, and Netflix videos you watch in Picture-in-Picture.
        Just turn on the subtitles on the in-page video player, and         they will appear in PiP.
      - Picture-in-Picture now also supports video captions on         websites that use Web Video Text Track (WebVTT) format (e.g.,         Coursera.org, Canadian Broadcasting Corporation, and many         more).
      - On the first run after install, Firefox detects when its         language does not match the operating system language and         offers the user a choice between the two languages.
      - Firefox spell checking now checks spelling in multiple         languages. To enable additional languages, select them in the         text fields context menu.
      - HDR video is now supported in Firefox on Macstarting with         YouTube! Firefox users on macOS 11+ (with HDR-compatible         screens) can enjoy higher-fidelity video content. No need to         manually flip any preferences to turn HDR video support         onjust make sure battery preferences are NOT set to         optimize video streaming while on battery.
      - Hardware-accelerated AV1 video decoding is enabled on         Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2         Excluding Navi 24, GeForce 30). Installing the AV1 Video         Extension from the Microsoft Store may also be required.
      - Video overlay is enabled on Windows for Intel GPUs,         reducing power usage during video playback.
      - Improved fairness between painting and handling other         events. This noticeably improves the performance of the         volume slider on Twitch.
      - Scrollbars on Linux and Windows 11 won't take space by         default. On Linux, users can change this in Settings. On         Windows, Firefox follows the system setting (System Settings         > Accessibility > Visual Effects > Always show scrollbars).
      - Firefox now ignores less restricted referrer         policiesincluding unsafe-url, no-referrer-when-downgrade,         and origin-when-cross-originfor cross-site         subresource/iframe requests to prevent privacy leaks from the         referrer.
      - Reading is now easier with the prefers-contrast media         query, which allows sites to detect if the user has requested         that web content is presented with a higher (or lower)         contrast.
      - All non-configured MIME types can now be assigned a custom         action upon download completion.
      - Firefox now allows users to use as many microphones as they         want, at the same time, during video conferencing. The most         exciting benefit is that you can easily switch your         microphones at any time (if your conferencing service         provider enables this flexibility).
      - Print preview has been updated.

      * Fixed: Various security fixes.

    - MFSA 2022-24 (bsc#1200793)

      * CVE-2022-34479 (bmo#1745595)         A popup window could be resized in a way to overlay the         address bar with web content
      * CVE-2022-34470 (bmo#1765951)         Use-after-free in nsSHistory
      * CVE-2022-34468 (bmo#1768537)         CSP sandbox header without `allow-scripts` can be bypassed         via retargeted javascript: URI
      * CVE-2022-34482 (bmo#845880)         Drag and drop of malicious image could have led to malicious         executable and potential code execution
      * CVE-2022-34483 (bmo#1335845)         Drag and drop of malicious image could have led to malicious         executable and potential code execution
      * CVE-2022-34476 (bmo#1387919)         ASN.1 parser could have been tricked into accepting malformed         ASN.1
      * CVE-2022-34481 (bmo#1483699, bmo#1497246)         Potential integer overflow in ReplaceElementsAt
      * CVE-2022-34474 (bmo#1677138)         Sandboxed iframes could redirect to external schemes
      * CVE-2022-34469 (bmo#1721220)         TLS certificate errors on HSTS-protected domains could be         bypassed by the user on Firefox for Android
      * CVE-2022-34471 (bmo#1766047)         Compromised server could trick a browser into an addon         downgrade
      * CVE-2022-34472 (bmo#1770123)         Unavailable PAC file resulted in OCSP requests being blocked
      * CVE-2022-34478 (bmo#1773717)         Microsoft protocols can be attacked if a user accepts a         prompt
      * CVE-2022-2200 (bmo#1771381)         Undesired attributes could be set as part of prototype         pollution
      * CVE-2022-34480 (bmo#1454072)         Free of uninitialized pointer in lg_init
      * CVE-2022-34477 (bmo#1731614)         MediaError message property leaked information on cross-         origin same-site pages
      * CVE-2022-34475 (bmo#1757210)         HTML Sanitizer could have been bypassed via same-origin         script via use tags
      * CVE-2022-34473 (bmo#1770888)         HTML Sanitizer could have been bypassed via use tags
      * CVE-2022-34484 (bmo#1763634, bmo#1772651)         Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
      * CVE-2022-34485 (bmo#1768409, bmo#1768578)         Memory safety bugs fixed in Firefox 102

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3272-1 advisory.

    Mozilla Firefox was updated to 102.2.0esr ESR:

    * Fixed: Various stability, functionality, and security fixes.

    - MFSA 2022-34 (bsc#1202645)

      * CVE-2022-38472 (bmo#1769155)         Address bar spoofing via XSLT error handling
      * CVE-2022-38473 (bmo#1771685)         Cross-origin XSLT Documents would have inherited the parent's         permissions
      * CVE-2022-38476 (bmo#1760998)         Data race and potential use-after-free in PK11_ChangePW
      * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,         bmo#1773363)         Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
      * CVE-2022-38478 (bmo#1770630, bmo#1776658)         Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,         and Firefox ESR 91.13

    Firefox Extended Support Release 102.1 ESR

      * Fixed: Various stability, functionality, and security fixes.

    - MFSA 2022-30 (bsc#1201758)

      * CVE-2022-36319 (bmo#1737722)         Mouse Position spoofing with CSS transforms
      * CVE-2022-36318 (bmo#1771774)         Directory indexes for bundled resources reflected URL         parameters
      * CVE-2022-36314 (bmo#1773894)         Opening local <code>.lnk</code> files could cause unexpected         network loads
      * CVE-2022-2505 (bmo#1769739, bmo#1772824)         Memory safety bugs fixed in Firefox 103 and 102.1

    - Firefox Extended Support Release 102.0.1 ESR

      * Fixed: Fixed bookmark shortcut creation by dragging to         Windows File Explorer and dropping partially broken         (bmo#1774683)
      * Fixed: Fixed bookmarks sidebar flashing white when opened in         dark mode (bmo#1776157)
      * Fixed: Fixed multilingual spell checking not working with         content in both English and a non-Latin alphabet         (bmo#1773802)
      * Fixed: Developer tools:  Fixed an issue where the console         output keep getting scrolled to the bottom when the last         visible message is an evaluation result (bmo#1776262)
      * Fixed: Fixed *Delete cookies and site data when Firefox is         closed* checkbox getting disabled on startup (bmo#1777419)
      * Fixed: Various stability fixes

    Firefox 102.0 ESR:

    * New:

      - We now provide more secure connections: Firefox can         now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc         headers.
      - For added viewing pleasure, full-range color levels are now         supported for video playback on many systems.
      - Find it easier now! Mac users can now access the macOS         share options from the Firefox File menu.
      - Voil?! Support for images containing ICC v4 profiles is         enabled on macOS.
      - Firefox now supports the new AVIF image format, which is         based on the modern and royalty-free AV1 video codec. It         offers significant bandwidth savings for sites compared to         existing image formats. It also supports transparency and         other advanced features.
      - Firefox PDF viewer now supports filling more forms (e.g.,         XFA-based forms, used by multiple governments and banks).
        Learn more.
      - When available system memory is critically low, Firefox on         Windows will automatically unload tabs based on their last         access time, memory usage, and other attributes. This helps         to reduce Firefox out-of-memory crashes. Forgot something?         Switching to an unloaded tab automatically reloads it.
      - To prevent session loss for macOS users who are running         Firefox from a mounted .dmg file, theyll now be prompted to         finish installation. Bear in mind, this permission prompt         only appears the first time these users run Firefox on their         computer.
      - For your safety, Firefox now blocks downloads that rely on         insecure connections, protecting against potentially         malicious or unsafe downloads. Learn more and see where to         find downloads in Firefox.
      - Improved web compatibility for privacy protections with         SmartBlock 3.0: In Private Browsing and Strict Tracking         Protection, Firefox goes to great lengths to protect your web         browsing activity from trackers. As part of this, the built-         in content blocking will automatically block third-party         scripts, images, and other content from being loaded from         cross-site tracking companies reported by Disconnect. Learn         more.
      - Introducing a new referrer tracking protection in Strict         Tracking Protection and Private Browsing. This feature         prevents sites from unknowingly leaking private information         to trackers. Learn more.
      - Introducing Firefox Suggest, a feature that provides         website suggestions as you type into the address bar. Learn         more about this faster way to navigate the web and locale-         specific features.
      - Firefox macOS now uses Apple's low-power mode for         fullscreen video on sites such as YouTube and Twitch. This         meaningfully extends battery life in long viewing sessions.
        Now your kids can find out what the fox says on a loop         without you ever missing a beat
      - With this release, power users can use about:unloads to         release system resources by manually unloading tabs without         closing them.
      - On Windows, there will now be fewer interruptions because         Firefox wont prompt you for updates. Instead, a background         agent will download and install updates even if Firefox is         closed.
      - On Linux, weve improved WebGL performance and reduced         power consumption for many users.
      - To better protect all Firefox users against side-channel         attacks, such as Spectre, we introduced Site Isolation.
      - Firefox no longer warns you by default when you exit the         browser or close a window using a menu, button, or three-key         command. This should cut back on unwelcome notifications,         which is always nicehowever, if you prefer a bit of notice,         youll still have full control over the quit/close modal         behavior. All warnings can be managed within Firefox         Settings. No worries! More details here.
      - Firefox supports the new Snap Layouts menus when running on         Windows 11.
      - RLBoxa new technology that hardens Firefox against         potential security vulnerabilities in third-party         librariesis now enabled on all platforms.
      - Weve reduced CPU usage on macOS in Firefox and         WindowServer during event processing.
      - Weve also reduced the power usage of software decoded         video on macOS, especially in fullscreen. This includes         streaming sites such as Netflix and Amazon Prime Video.
      - You can now move the Picture-in-Picture toggle button to         the opposite side of the video. Simply look for the new         context menu option Move Picture-in-Picture Toggle to Left         (Right) Side.
      - Weve made significant improvements in noise suppression         and auto-gain-control, as well as slight improvements in         echo-cancellation to provide you with a better overall         experience.
      - Weve also significantly reduced main-thread load.
      - When printing, you can now choose to print only the         odd/even pages.
      - Firefox now supports and displays the new style of         scrollbars on Windows 11.
      - Firefox has a new optimized download flow. Instead of         prompting every time, files will download automatically.
        However, they can still be opened from the downloads panel         with just one click. Easy! More information
      - Firefox no longer asks what to do for each file by default.
        You wont be prompted to choose a helper application or save         to disk before downloading a file unless you have changed         your download action setting for that type of file.
     -  Any files you download will be immediately saved on your         disk. Depending on the current configuration, theyll be         saved in your preferred download folder, or youll be asked         to select a location for each download. Windows and Linux         users will find their downloaded files in the destination         folder. Theyll no longer be put in the Temp folder.
      - Firefox allows users to choose from a number of built-in         search engines to set as their default. In this release, some         users who had previously configured a default engine might         notice their default search engine has changed since Mozilla         was unable to secure formal permission to continue including         certain search engines in Firefox.
      - You can now toggle Narrate in ReaderMode with the keyboard         shortcut 'n.'
      - You can find added support for searchwith or without         diacriticsin the PDF viewer.
      - The Linux sandbox has been strengthened: processes exposed         to web content no longer have access to the X Window system         (X11).
      - Firefox now supports credit card autofill and capture in         Germany, France, and the United Kingdom.
      - We now support captions/subtitles display on YouTube, Prime         Video, and Netflix videos you watch in Picture-in-Picture.
        Just turn on the subtitles on the in-page video player, and         they will appear in PiP.
      - Picture-in-Picture now also supports video captions on         websites that use Web Video Text Track (WebVTT) format (e.g.,         Coursera.org, Canadian Broadcasting Corporation, and many         more).
      - On the first run after install, Firefox detects when its         language does not match the operating system language and         offers the user a choice between the two languages.
      - Firefox spell checking now checks spelling in multiple         languages. To enable additional languages, select them in the         text fields context menu.
      - HDR video is now supported in Firefox on Macstarting with         YouTube! Firefox users on macOS 11+ (with HDR-compatible         screens) can enjoy higher-fidelity video content. No need to         manually flip any preferences to turn HDR video support         onjust make sure battery preferences are NOT set to         optimize video streaming while on battery.
      - Hardware-accelerated AV1 video decoding is enabled on         Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2         Excluding Navi 24, GeForce 30). Installing the AV1 Video         Extension from the Microsoft Store may also be required.
      - Video overlay is enabled on Windows for Intel GPUs,         reducing power usage during video playback.
      - Improved fairness between painting and handling other         events. This noticeably improves the performance of the         volume slider on Twitch.
      - Scrollbars on Linux and Windows 11 won't take space by         default. On Linux, users can change this in Settings. On         Windows, Firefox follows the system setting (System Settings         > Accessibility > Visual Effects > Always show scrollbars).
      - Firefox now ignores less restricted referrer         policiesincluding unsafe-url, no-referrer-when-downgrade,         and origin-when-cross-originfor cross-site         subresource/iframe requests to prevent privacy leaks from the         referrer.
      - Reading is now easier with the prefers-contrast media         query, which allows sites to detect if the user has requested         that web content is presented with a higher (or lower)         contrast.
      - All non-configured MIME types can now be assigned a custom         action upon download completion.
      - Firefox now allows users to use as many microphones as they         want, at the same time, during video conferencing. The most         exciting benefit is that you can easily switch your         microphones at any time (if your conferencing service         provider enables this flexibility).
      - Print preview has been updated.

      * Fixed: Various security fixes.

    - MFSA 2022-24 (bsc#1200793)

      * CVE-2022-34479 (bmo#1745595)         A popup window could be resized in a way to overlay the         address bar with web content
      * CVE-2022-34470 (bmo#1765951)         Use-after-free in nsSHistory
      * CVE-2022-34468 (bmo#1768537)         CSP sandbox header without `allow-scripts` can be bypassed         via retargeted javascript: URI
      * CVE-2022-34482 (bmo#845880)         Drag and drop of malicious image could have led to malicious         executable and potential code execution
      * CVE-2022-34483 (bmo#1335845)         Drag and drop of malicious image could have led to malicious         executable and potential code execution
      * CVE-2022-34476 (bmo#1387919)         ASN.1 parser could have been tricked into accepting malformed         ASN.1
      * CVE-2022-34481 (bmo#1483699, bmo#1497246)         Potential integer overflow in ReplaceElementsAt
      * CVE-2022-34474 (bmo#1677138)         Sandboxed iframes could redirect to external schemes
      * CVE-2022-34469 (bmo#1721220)         TLS certificate errors on HSTS-protected domains could be         bypassed by the user on Firefox for Android
      * CVE-2022-34471 (bmo#1766047)         Compromised server could trick a browser into an addon         downgrade
      * CVE-2022-34472 (bmo#1770123)         Unavailable PAC file resulted in OCSP requests being blocked
      * CVE-2022-34478 (bmo#1773717)         Microsoft protocols can be attacked if a user accepts a         prompt
      * CVE-2022-2200 (bmo#1771381)         Undesired attributes could be set as part of prototype         pollution
      * CVE-2022-34480 (bmo#1454072)         Free of uninitialized pointer in lg_init
      * CVE-2022-34477 (bmo#1731614)         MediaError message property leaked information on cross-         origin same-site pages
      * CVE-2022-34475 (bmo#1757210)         HTML Sanitizer could have been bypassed via same-origin         script via use tags
      * CVE-2022-34473 (bmo#1770888)         HTML Sanitizer could have been bypassed via use tags
      * CVE-2022-34484 (bmo#1763634, bmo#1772651)         Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
      * CVE-2022-34485 (bmo#1768409, bmo#1768578)         Memory safety bugs fixed in Firefox 102

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-08 (Mozilla Firefox: Multiple Vulnerabilities)

  - Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-1919)

  - regex is an implementation of regular expressions for the Rust language. The regex crate features built-in     mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched     by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This     guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in     the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing,     and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial     of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted     regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is     include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade     immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic     regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability.
    Because of this, it us not recommend to deny known problematic regexes. (CVE-2022-24713)

  - Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present     in Firefox 97. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code.  (CVE-2022-0843)

  - After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-     after-free and potentially exploitable crash.  (CVE-2022-1196)

  - Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution     (CVE-2022-1529)

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,     they could have achieved execution of attacker-controlled JavaScript code in a privileged context.
    (CVE-2022-1802)

  - If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes     on a JavaScript object, leading to privileged code execution.  (CVE-2022-2200)

  - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code.  (CVE-2022-2505)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash.  (CVE-2022-26381)

  - While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered     using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to     this text being inferred by the webpage.  (CVE-2022-26382)

  - Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383, CVE-2022-31738)

  - If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not     <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript     execution in violation of the sandbox.  (CVE-2022-26384)

  - In unusual circumstances, an individual thread may outlive the thread's manager during shutdown.  This     could have led to a use-after-free causing a potentially exploitable crash.  (CVE-2022-26385)

  - Previously Thunderbird for macOS and Linux would download temporary files to a user-specific directory in     <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be     affected by other local users.  This behavior was reverted to the original, user-specific directory.  This     bug only affects Thunderbird for macOS and Linux. Other operating systems are unaffected.
    (CVE-2022-26386)

  - When installing an add-on, Thunderbird verified the signature before prompting the user; but while the     user was confirming the prompt, the underlying add-on file could have been modified and Thunderbird would     not have noticed.  (CVE-2022-26387)

  - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw.  (CVE-2022-26485)

  - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape.  We have had reports of attacks in the wild abusing this flaw.  (CVE-2022-26486)

  - If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to     the parent process, an out of bounds write would have occurred leading to memory corruption and a     potentially exploitable crash.  (CVE-2022-28281)

  - By using a link with <code>rel=localization</code> a use-after-free could have been triggered by     destroying an object during JavaScript execution and then referencing the object through a freed pointer,     leading to a potential exploitable crash.  (CVE-2022-28282)

  - The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to     attempt to include local files or other files that should have been inaccessible.  (CVE-2022-28283)

  - SVG's <code><use></code> element could have been used to load unexpected content that could have     executed script in certain circumstances. While the specification seems to allow this, other browsers do     not, and web developers relied on this property for script security so gecko's implementation was aligned     with theirs.  (CVE-2022-28284)

  - When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was     used. In conjunction with another vulnerability this could have been used for an out of bounds memory     read.  (CVE-2022-28285)

  - Due to a layout change, iframe contents could have been rendered outside of its border. This could have     led to user confusion or spoofing attacks.  (CVE-2022-28286)

  - In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading     to a crash.  (CVE-2022-28287)

  - Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team     reported memory safety bugs present in Firefox 98. Some of these bugs showed evidence of memory corruption     and we presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2022-28288)

  - Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla     Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence     of memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code.  (CVE-2022-28289)

  - Documents in deeply-nested cross-origin browsing contexts could obtain permissions granted to the top-     level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - When closed or sent to the background, Firefox for Android would not properly record and persist HSTS     settings. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.
    (CVE-2022-29910)

  - An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-     activation</code> could lead to script execution without <code>allow-scripts</code> being present.
    (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which     could enable browser spoofing attacks.  (CVE-2022-29914)

  - The Performance API did not properly hide the fact whether a request cross-origin resource has observed     redirects.  (CVE-2022-29915)

  - Thunderbird would behave slightly differently for already known resources, when loading CSS resources     through resolving CSS variables. This could be used to probe the browser history.  (CVE-2022-29916)

  - Mozilla developers Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs     present in Thunderbird 91.8. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code.  (CVE-2022-29917)

  - Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs     present in Firefox 99. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code.  (CVE-2022-29918)

  - Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)

  - A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a     potentially exploitable crash.  (CVE-2022-31737)

  - On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation     problem, and a potentially exploitable crash.  (CVE-2022-31740)

  - Mozilla: Uninitialized variable leads to invalid memory read (CVE-2022-31741)

  - Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-     origin information (CVE-2022-31742)

  - Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with     other browsers. This could have been used to escape HTML comments on pages that put user-controlled data     in them.  (CVE-2022-31743)

  - An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and     in doing so bypass a page's Content Security Policy.  (CVE-2022-31744)

  - If array shift operations are not used, the Garbage Collector may have become confused about valid     objects.  (CVE-2022-31745)

  - Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory     safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code.  (CVE-2022-31747)

  - Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing     Team reported memory safety bugs present in Firefox 100. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code.  (CVE-2022-31748)

  - An iframe that was not permitted to run scripts could do so if the user clicked on a     <code>javascript:</code> link.  (CVE-2022-34468)

  - When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow     the user to bypass the certificate error.  On Firefox for Android, the user was presented with the option     to bypass the error; this could only have been done by the user explicitly.  This bug only affects Firefox     for Android. Other operating systems are unaffected.  (CVE-2022-34469)

  - Navigations between XML documents may have led to a use-after-free and potentially exploitable crash.
    (CVE-2022-34470)

  - When downloading an update for an addon, the downloaded addon update's version was not verified to match     the version selected from the manifest.  If the manifest had been tampered with on the server, an attacker     could trick the browser into downgrading the addon to a prior version.  (CVE-2022-34471)

  - If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have     been blocked, resulting in incorrect error pages being shown.  (CVE-2022-34472)

  - The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code>     tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes.  (CVE-2022-34473)

  - Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it     received a redirect header to an external protocol the browser would process the redirect and prompt the     user as appropriate.  (CVE-2022-34474)

  - SVG <code><use></code> tags that referenced a same-origin document could have resulted in script     execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the     attacker to reference a same-origin JavaScript file containing the script to be executed.
    (CVE-2022-34475)

  - ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser     accepting malformed ASN.1.  (CVE-2022-34476)

  - The MediaError message property should be consistent to avoid leaking information about cross-origin     resources; however for a same-site cross-origin resource, the message could have leaked information     enabling XS-Leaks attacks.  (CVE-2022-34477)

  - The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to     Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had     known vulnerabilities, exploited in the wild (although we know of none exploited through Thunderbird), so     in this release Thunderbird has blocked these protocols from prompting the user to open them. This bug     only affects Thunderbird on Windows. Other operating systems are unaffected.  (CVE-2022-34478)

  - A malicious website that could create a popup could have resized the popup to overlay the address bar with     its own content, resulting in potential user confusion or spoofing attacks.   This bug only affects     Thunderbird for Linux. Other operating systems are unaffected.  (CVE-2022-34479)

  - Within the <code>lginit()</code> function, if several allocations succeed but then one fails, an     uninitialized pointer would have been freed despite never being allocated.  (CVE-2022-34480)

  - In the <code>nsTArrayImpl::ReplaceElementsAt()</code> function, an integer overflow could have occurred     when the number of elements to replace was too large for the container.  (CVE-2022-34481)

  - An attacker who could have convinced a user to drag and drop an image to a filesystem could have     manipulated the resulting filename to contain an executable extension, and by extension potentially     tricked the user into executing malicious code.  While very similar, this is a separate issue from     CVE-2022-34483.  (CVE-2022-34482)

  - An attacker who could have convinced a user to drag and drop an image to a filesystem could have     manipulated the resulting filename to contain an executable extension, and by extension potentially     tricked the user into executing malicious code.  While very similar, this is a separate issue from     CVE-2022-34482.  (CVE-2022-34483)

  - The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code.  (CVE-2022-34484)

  - Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities     present in Firefox 101. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code.  (CVE-2022-34485)

  - When loading a script with Subresource Integrity, attackers with an injection capability could trigger the     reuse of previously cached entries with incorrect, different integrity metadata.  (CVE-2022-36315)

  - When using the Performance API, an attacker was able to notice subtle differences between     PerformanceEntries and thus learn whether the target URL had been subject to a redirect.  (CVE-2022-36316)

  - When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected.
    (CVE-2022-36318)

  - When combining CSS properties for overflow and transform, the mouse cursor could interact with different     coordinates than displayed.  (CVE-2022-36319)

  - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code.  (CVE-2022-36320)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5504-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the     browser UI, bypass CSP restrictions, bypass sandboxed iframe restrictions, obtain sensitive information,     bypass the HTML sanitizer, or execute arbitrary code. (CVE-2022-2200, CVE-2022-34468, CVE-2022-34470,     CVE-2022-34473, CVE-2022-34474, CVE-2022-34475, CVE-2022-34476, CVE-2022-34477, CVE-2022-34479,     CVE-2022-34480, CVE-2022-34481, CVE-2022-34484, CVE-2022-34485)

    It was discovered that Firefox could be made to save an image with an executable extension in the filename     when dragging and dropping an image in some circumstances. If a user were tricked into dragging and     dropping a specially crafted image, an attacker could potentially exploit this to trick the user into     executing arbitrary code. (CVE-2022-34482, CVE-2022-34483)

    It was discovered that a compromised server could trick Firefox into an addon downgrade in some     circumstances. An attacker could potentially exploit this to trick the browser into downgrading an addon     to a prior version. (CVE-2022-34471)

    It was discovered that an unavailable PAC file caused OCSP requests to be blocked, resulting in incorrect     error pages being displayed. (CVE-2022-34472)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 102.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-24 advisory.

  - Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities     present in Firefox 101. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2022-34485)

  - A malicious website that could create a popup could have resized the popup to overlay the address bar with     its own content, resulting in potential user confusion or spoofing attacks.   This bug only affects     Firefox for Linux. Other operating systems are unaffected. (CVE-2022-34479)

  - Session history navigations may have led to a use-after-free and potentially exploitable crash.
    (CVE-2022-34470)

  - An iframe that was not permitted to run scripts could do so if the user clicked on a     <code>javascript:</code> link. (CVE-2022-34468)

  - An attacker who could have convinced a user to drag and drop an image to a filesystem could have     manipulated the resulting filename to contain an executable extension, and by extension potentially     tricked the user into executing malicious code.  While very similar, this is a separate issue from     CVE-2022-34483. (CVE-2022-34482)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 102.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-24 advisory.

  - Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities     present in Firefox 101. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2022-34485)

  - A malicious website that could create a popup could have resized the popup to overlay the address bar with     its own content, resulting in potential user confusion or spoofing attacks.   This bug only affects     Firefox for Linux. Other operating systems are unaffected. (CVE-2022-34479)

  - Session history navigations may have led to a use-after-free and potentially exploitable crash.
    (CVE-2022-34470)

  - An iframe that was not permitted to run scripts could do so if the user clicked on a     <code>javascript:</code> link. (CVE-2022-34468)

  - An attacker who could have convinced a user to drag and drop an image to a filesystem could have     manipulated the resulting filename to contain an executable extension, and by extension potentially     tricked the user into executing malicious code.  While very similar, this is a separate issue from     CVE-2022-34483. (CVE-2022-34482)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
165487	SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-SLE / etc (SUSE-SU-2022:3396-1)	Nessus	SuSE Local Security Checks	critical
165198	SUSE SLES12: MozillaFirefox / MozillaFirefox-branding-SLE / MozillaFirefox-devel / etc (SUSE-SU-2022:3273-1)	Nessus	SuSE Local Security Checks	critical
165192	SUSE SLES15: MozillaFirefox / MozillaFirefox-branding-SLE / MozillaFirefox-devel / etc (SUSE-SU-2022:3272-1)	Nessus	SuSE Local Security Checks	critical
164149	GLSA-202208-08 : Mozilla Firefox: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
162735	Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5504-1)	Nessus	Ubuntu Local Security Checks	critical
162603	Mozilla Firefox < 102.0	Nessus	MacOS X Local Security Checks	critical
162602	Mozilla Firefox < 102.0	Nessus	Windows	critical

Detections

Analytics

CVE-2022-34482

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical