A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that object remained. This resulted in a potentially exploitable condition when the reference to that object was later reused. This vulnerability affects Firefox < 115.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we
    presume that with enough effort some of these could have been exploited to run arbitrary code. This
    vulnerability affects Firefox < 115. (CVE-2023-37212)

  - When Firefox is configured to block storage of all cookies, it was still possible to store data in
    localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites
    storing tracking data without permission. This vulnerability affects Firefox < 115. (CVE-2023-3482)

  - An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.
    This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. (CVE-2023-37201)

  - Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to
    be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115,
    Firefox ESR < 102.13, and Thunderbird < 102.13. (CVE-2023-37202)

  - Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed
    an attacker to trick end-users into creating a shortcut to local system files. This could have been
    leveraged to execute arbitrary code. This vulnerability affects Firefox < 115. (CVE-2023-37203)

The remote host is affected by the vulnerability described in GLSA-202401-10 (Mozilla Firefox: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of firefox installed on the remote host is prior to 115.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-017 advisory.

    A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an     inopportune time.  This could have lead to memory corruption or a potentially exploitable crash.*Note*:
    This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the     original advisory. The fix was included in the original release of Firefox 106. This vulnerability affects     Firefox < 106. (CVE-2022-46884)

    When Firefox is configured to block storage of all cookies, it was still possible to store data in     localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites     storing tracking data without permission. This vulnerability affects Firefox < 115. (CVE-2023-3482)

    Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed     an attacker to trick end-users into creating a shortcut to local system files.  This could have been     leveraged to execute arbitrary code. This vulnerability affects Firefox < 115. (CVE-2023-37203)

    A website could have obscured the fullscreen notification by using an option element by introducing lag     via an expensive computational function. This could have led to user confusion and possible spoofing     attacks. This vulnerability affects Firefox < 115. (CVE-2023-37204)

    The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability     affects Firefox < 115. (CVE-2023-37205)

    Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting     sensitive data to a malicious website. This vulnerability affects Firefox < 115. (CVE-2023-37206)

    A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object     was freed and a reference to that object remained.  This resulted in a potentially exploitable condition     when the reference to that object was later reused. This vulnerability affects Firefox < 115.
    (CVE-2023-37209)

    A website could prevent a user from exiting full-screen mode via alert and prompt calls.  This could lead     to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.
    (CVE-2023-37210)

    Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Firefox < 115. (CVE-2023-37212)

    The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service     (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length     affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data     for each parse attempt (e.g., millions of bytes). (CVE-2023-43669)

    A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-     of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability     affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5168)

    A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-     of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability     affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5169)

    During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects     Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5171)

    Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and     Thunderbird < 115.3. (CVE-2023-5176)

    The Mozilla Foundation Security Advisory describes this flaw as:

    It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an insufficient activation-delay. (CVE-2023-5721)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led     to a crash. (CVE-2023-5724)

    The Mozilla Foundation Security Advisory describes this flaw as:

    A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be     leveraged to collect sensitive user data. (CVE-2023-5725)

    The Mozilla Foundation Security Advisory describes this flaw as:

    During garbage collection extra operations were performed on a object that should not be. This could have     led to a potentially exploitable crash. (CVE-2023-5728)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5730)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An attacker could have created a malicious link using bidirectional characters to spoof the location in     the address bar when visited. (CVE-2023-5732)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2886-1 advisory.

    Changes in MozillaFirefox and MozillaFirefox-branding-SLE:

    This update provides Firefox Extended Support Release 115.0 ESR

    * New:

      - Required fields are now highlighted in PDF forms.
      - Improved performance on high-refresh rate monitors (120Hz+).
      - Buttons in the Tabs toolbar can now be reached with Tab,         Shift+Tab, and Arrow keys. View this article for additional         details.
      - Windows' 'Make text bigger' accessibility setting now         affects all the UI and content pages, rather than only         applying to system font sizes.
      - Non-breaking spaces are now preservedpreventing automatic         line breakswhen copying text from a form control.
      - Fixed WebGL performance issues on NVIDIA binary drivers via         DMA-Buf on Linux.
      - Fixed an issue in which Firefox startup could be         significantly slowed down by the processing of Web content         local storage. This had the greatest impact on users with         platter hard drives and significant local storage.
      - Removed a configuration option to allow SHA-1 signatures in         certificates: SHA-1 signatures in certificateslong since         determined to no longer be secure enoughare now not         supported.
      - Highlight color is preserved correctly after typing `Enter`         in the mail composer of Yahoo Mail and Outlook.
        After bypassing the https only error page navigating back         would take you to the error page that was previously         dismissed. Back now takes you to the previous site that was         visited.
      - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in         plain text contexts, such as input and text area.
      - Added an option to print only the current page from the         print preview dialog.
      - Swipe to navigate (two fingers on a touchpad swiped left or         right to perform history back or forward) on Windows is now         enabled.
      - Stability on Windows is significantly improved as Firefox         handles low-memory situations much better.
      - Touchpad scrolling on macOS was made more accessible by         reducing unintended diagonal scrolling opposite of the         intended scroll axis.
      - Firefox is less likely to run out of memory on Linux and         performs more efficiently for the rest of the system when         memory runs low.
      - It is now possible to edit PDFs: including writing text,         drawing, and adding signatures.
      - Setting Firefox as your default browser now also makes it         the default PDF application on Windows systems.
      - Swipe-to-navigate (two fingers on a touchpad swiped left or         right to perform history back or forward) now works for Linux         users on Wayland.
      - Text Recognition in images allows users on macOS 10.15 and         higher to extract text from the selected image (such as a         meme or screenshot).
      - Firefox View helps you get back to content you previously         discovered. A pinned tab allows you to find and open recently         closed tabs on your current device and access tabs from other         devices (via our Tab Pickup feature).
      - Import maps, which allow web pages to control the behavior         of JavaScript imports, are now enabled by default.
      - Processes used for background tabs now use efficiency mode         on Windows 11 to limit resource use.
      - The shift+esc keyboard shortcut now opens the Process         Manager, offering a way to quickly identify processes that         are using too many resources.
      - Firefox now supports properly color correcting images         tagged with ICCv4 profiles.
      - Support for non-English characters when saving and printing         PDF forms.
      - The bookmarks toolbar's default 'Only show on New Tab'         state works correctly for blank new tabs. As before, you can         change the bookmark toolbar's behavior using the toolbar         context menu.
      - Manifest Version 3 (MV3) extension support is now enabled         by default (MV2 remains enabled/supported). This major update         also ushers an exciting user interface change in the form of         the new extensions button.
      - The Arbitrary Code Guard exploit protection has been         enabled in the media playback utility processes, improving         security for Windows users.
      - The native HTML date picker for date and datetime inputs         can now be used with a keyboard alone, improving its         accessibility for screen reader users. Users with limited         mobility can also now use common keyboard shortcuts to         navigate the calendar grid and month selection spinners.
      - Firefox builds in the Spanish from Spain (es-ES) and         Spanish from Argentina (es-AR) locales now come with a built-         in dictionary for the Firefox spellchecker.
      - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls         the page instead of zooming. This avoids accidental zooming         and matches the behavior of other web browsers on macOS.
      - It's now possible to import bookmarks, history and         passwords not only from Edge, Chrome or Safari but also from         Opera, Opera GX, and Vivaldi.
      - GPU sandboxing has been enabled on Windows.
      - On Windows, third-party modules can now be blocked from         injecting themselves into Firefox, which can be helpful if         they are causing crashes or other undesirable behavior.
      - Date, time, and datetime-local input fields can now be         cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on         macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and         Linux.
      - GPU-accelerated Canvas2D is enabled by default on macOS and         Linux.
      - WebGL performance improvement on Windows, MacOS and Linux.
      - Enables overlay of hardware-decoded video with non-Intel         GPUs on Windows 10/11, improving video playback performance         and video scaling quality.
      - Windows native notifications are now enabled.
      - Firefox Relay users can now opt-in to create Relay email         masks directly from the Firefox credential manager. You must         be signed in with your Firefox Account.
      - Weve added two new locales: Silhe Friulian (fur) and         Sardinian (sc).
      - Right-clicking on password fields now shows an option to         reveal the password.
      - Private windows and ETP set to strict will now include         email tracking protection. This will make it harder for email         trackers to learn the browsing habits of Firefox users. You         can check the Tracking Content in the sub-panel on the shield         icon panel.
      - The deprecated U2F Javascript API is now disabled by         default. The U2F protocol remains usable through the WebAuthn         API. The U2F API can be re-enabled using the         `security.webauth.u2f` preference.
      - Say hello to enhanced Picture-in-Picture! Rewind, check         video duration, and effortlessly switch to full-screen mode         on the web's most popular video websites.
      - Firefox's address bar is already a great place to search         for what you're looking for. Now you'll always be able to see         your web search terms and refine them while viewing your         search's results - no additional scrolling needed! Also, a         new result menu has been added making it easier to remove         history results and dismiss sponsored Firefox Suggest         entries.
      - Private windows now protect users even better by blocking         third-party cookies and storage of content trackers.
      - Passwords automatically generated by Firefox now include         special characters, giving users more secure passwords by         default.
      - Firefox 115 introduces a redesigned accessibility engine         which significantly improves the speed, responsiveness, and         stability of Firefox when used with:

        - Screen readers, as well as certain other accessibility           software;
        - East Asian input methods;
        - Enterprise single sign-on software; and
        - Other applications which use accessibility frameworks to           access information.

      - Firefox 115 now supports AV1 Image Format files containing         animations (AVIS), improving support for AVIF images across         the web.
      - The Windows GPU sandbox first shipped in the Firefox 110         release has been tightened to enhance the security benefits         it provides.
      - A 13-year-old feature request was fulfilled and Firefox now         supports files being drag-and-dropped directly from Microsoft         Outlook. A special thanks to volunteer contributor Marco         Spiess for helping to get this across the finish line!
      - Users on macOS can now access the Services sub-menu         directly from Firefox context menus.
      - On Windows, the elastic overscroll effect has been enabled         by default. When two-finger scrolling on the touchpad or         scrolling on the touchscreen, you will now see a bouncing         animation when scrolling past the edge of a scroll container.
      - Firefox is now available in the Tajik (tg) language.
      - Added UI to manage the DNS over HTTPS exception list.
      - Bookmarks can now be searched from the Bookmarks menu. The         Bookmarks menu is accessible by adding the Bookmarks menu         button to the toolbar.
      - Restrict searches to your local browsing history by         selecting Search history from the History, Library or         Application menu buttons.
      - Mac users can now capture video from their cameras in all         supported native resolutions. This enables resolutions higher         than 1280x720.
      - It is now possible to reorder the extensions listed in the         extensions panel.
      - Users on macOS, Linux, and Windows 7 can now use FIDO2 /         WebAuthn authenticators over USB. Some advanced features,         such as fully passwordless logins, require a PIN to be set on         the authenticator.
      - Pocket Recommended content can now be seen in France,         Italy, and Spain.
      - DNS over HTTPS settings are now part of the Privacy &         Security section of the Settings page and allow the user to         choose from all the supported modes.
      - Migrating from another browser? Now you can bring over         payment methods you've saved in Chrome-based browsers to         Firefox.
      - Hardware video decoding enabled for Intel GPUs on Linux.
      - The Tab Manager dropdown now features close buttons, so you         can close tabs more quickly.
      - Windows Magnifier now follows the text cursor correctly         when the Firefox title bar is visible.
      - Undo and redo are now available in Password fields.
        [1]:https://support.mozilla.org/kb/access-toolbar-functions-         using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
        *_ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w         [2]:https://support.mozilla.org/kb/how-set-tab-pickup-firefox-view         [3]:https://support.mozilla.org/kb/task-manager-tabs-or-extensions-are-slowing-firefox         [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-signing-available-november-21-on-firefox-     nightly/         [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/         [6]:https://support.mozilla.org/kb/unified-extensions         [7]:https://support.mozilla.org/kb/import-data-another-browser         [8]:https://support.mozilla.org/kb/identify-problems-third-party-modules-firefox-windows         [9]:https://support.mozilla.org/kb/how-generate-secure-password-firefox         [10]:https://blog.mozilla.org/accessibility/firefox-113-accessibility-performance/

    * Fixed: Various security fixes. MFSA 2023-22 (bsc#1212438)

      * CVE-2023-3482 (bmo#1839464)         Block all cookies bypass for localstorage
      * CVE-2023-37201 (bmo#1826002)         Use-after-free in WebRTC certificate generation
      * CVE-2023-37202 (bmo#1834711)         Potential use-after-free from compartment mismatch in         SpiderMonkey
      * CVE-2023-37203 (bmo#291640)         Drag and Drop API may provide access to local system files
      * CVE-2023-37204 (bmo#1832195)         Fullscreen notification obscured via option element
      * CVE-2023-37205 (bmo#1704420)         URL spoofing in address bar using RTL characters
      * CVE-2023-37206 (bmo#1813299)         Insufficient validation of symlinks in the FileSystem API
      * CVE-2023-37207 (bmo#1816287)         Fullscreen notification obscured
      * CVE-2023-37208 (bmo#1837675)         Lack of warning when opening Diagcab files
      * CVE-2023-37209 (bmo#1837993)         Use-after-free in `NotifyOnHistoryReload`
      * CVE-2023-37210 (bmo#1821886)         Full-screen mode exit prevention
      * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,         bmo#1836550, bmo#1837450)         Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,         and Thunderbird 102.13
      * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,         bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,         bmo#1838587)         Memory safety bugs fixed in Firefox 115
    - Fixed potential SIGILL on older CPUs (bsc#1212101)

    * Fixed: Various security fixes and other quality

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2849-1 advisory.

    Changes in MozillaFirefox and MozillaFirefox-branding-SLE:

    This update provides Firefox Extended Support Release 115.0 ESR

    * New:

      - Required fields are now highlighted in PDF forms.
      - Improved performance on high-refresh rate monitors (120Hz+).
      - Buttons in the Tabs toolbar can now be reached with Tab,         Shift+Tab, and Arrow keys. View this article for additional         details.
      - Windows' 'Make text bigger' accessibility setting now         affects all the UI and content pages, rather than only         applying to system font sizes.
      - Non-breaking spaces are now preservedpreventing automatic         line breakswhen copying text from a form control.
      - Fixed WebGL performance issues on NVIDIA binary drivers via         DMA-Buf on Linux.
      - Fixed an issue in which Firefox startup could be         significantly slowed down by the processing of Web content         local storage. This had the greatest impact on users with         platter hard drives and significant local storage.
      - Removed a configuration option to allow SHA-1 signatures in         certificates: SHA-1 signatures in certificateslong since         determined to no longer be secure enoughare now not         supported.
      - Highlight color is preserved correctly after typing `Enter`         in the mail composer of Yahoo Mail and Outlook.
        After bypassing the https only error page navigating back         would take you to the error page that was previously         dismissed. Back now takes you to the previous site that was         visited.
      - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in         plain text contexts, such as input and text area.
      - Added an option to print only the current page from the         print preview dialog.
      - Swipe to navigate (two fingers on a touchpad swiped left or         right to perform history back or forward) on Windows is now         enabled.
      - Stability on Windows is significantly improved as Firefox         handles low-memory situations much better.
      - Touchpad scrolling on macOS was made more accessible by         reducing unintended diagonal scrolling opposite of the         intended scroll axis.
      - Firefox is less likely to run out of memory on Linux and         performs more efficiently for the rest of the system when         memory runs low.
      - It is now possible to edit PDFs: including writing text,         drawing, and adding signatures.
      - Setting Firefox as your default browser now also makes it         the default PDF application on Windows systems.
      - Swipe-to-navigate (two fingers on a touchpad swiped left or         right to perform history back or forward) now works for Linux         users on Wayland.
      - Text Recognition in images allows users on macOS 10.15 and         higher to extract text from the selected image (such as a         meme or screenshot).
      - Firefox View helps you get back to content you previously         discovered. A pinned tab allows you to find and open recently         closed tabs on your current device and access tabs from other         devices (via our Tab Pickup feature).
      - Import maps, which allow web pages to control the behavior         of JavaScript imports, are now enabled by default.
      - Processes used for background tabs now use efficiency mode         on Windows 11 to limit resource use.
      - The shift+esc keyboard shortcut now opens the Process         Manager, offering a way to quickly identify processes that         are using too many resources.
      - Firefox now supports properly color correcting images         tagged with ICCv4 profiles.
      - Support for non-English characters when saving and printing         PDF forms.
      - The bookmarks toolbar's default 'Only show on New Tab'         state works correctly for blank new tabs. As before, you can         change the bookmark toolbar's behavior using the toolbar         context menu.
      - Manifest Version 3 (MV3) extension support is now enabled         by default (MV2 remains enabled/supported). This major update         also ushers an exciting user interface change in the form of         the new extensions button.
      - The Arbitrary Code Guard exploit protection has been         enabled in the media playback utility processes, improving         security for Windows users.
      - The native HTML date picker for date and datetime inputs         can now be used with a keyboard alone, improving its         accessibility for screen reader users. Users with limited         mobility can also now use common keyboard shortcuts to         navigate the calendar grid and month selection spinners.
      - Firefox builds in the Spanish from Spain (es-ES) and         Spanish from Argentina (es-AR) locales now come with a built-         in dictionary for the Firefox spellchecker.
      - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls         the page instead of zooming. This avoids accidental zooming         and matches the behavior of other web browsers on macOS.
      - It's now possible to import bookmarks, history and         passwords not only from Edge, Chrome or Safari but also from         Opera, Opera GX, and Vivaldi.
      - GPU sandboxing has been enabled on Windows.
      - On Windows, third-party modules can now be blocked from         injecting themselves into Firefox, which can be helpful if         they are causing crashes or other undesirable behavior.
      - Date, time, and datetime-local input fields can now be         cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on         macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and         Linux.
      - GPU-accelerated Canvas2D is enabled by default on macOS and         Linux.
      - WebGL performance improvement on Windows, MacOS and Linux.
      - Enables overlay of hardware-decoded video with non-Intel         GPUs on Windows 10/11, improving video playback performance         and video scaling quality.
      - Windows native notifications are now enabled.
      - Firefox Relay users can now opt-in to create Relay email         masks directly from the Firefox credential manager. You must         be signed in with your Firefox Account.
      - Weve added two new locales: Silhe Friulian (fur) and         Sardinian (sc).
      - Right-clicking on password fields now shows an option to         reveal the password.
      - Private windows and ETP set to strict will now include         email tracking protection. This will make it harder for email         trackers to learn the browsing habits of Firefox users. You         can check the Tracking Content in the sub-panel on the shield         icon panel.
      - The deprecated U2F Javascript API is now disabled by         default. The U2F protocol remains usable through the WebAuthn         API. The U2F API can be re-enabled using the         `security.webauth.u2f` preference.
      - Say hello to enhanced Picture-in-Picture! Rewind, check         video duration, and effortlessly switch to full-screen mode         on the web's most popular video websites.
      - Firefox's address bar is already a great place to search         for what you're looking for. Now you'll always be able to see         your web search terms and refine them while viewing your         search's results - no additional scrolling needed! Also, a         new result menu has been added making it easier to remove         history results and dismiss sponsored Firefox Suggest         entries.
      - Private windows now protect users even better by blocking         third-party cookies and storage of content trackers.
      - Passwords automatically generated by Firefox now include         special characters, giving users more secure passwords by         default.
      - Firefox 115 introduces a redesigned accessibility engine         which significantly improves the speed, responsiveness, and         stability of Firefox when used with:

        - Screen readers, as well as certain other accessibility           software;
        - East Asian input methods;
        - Enterprise single sign-on software; and
        - Other applications which use accessibility frameworks to           access information.

      - Firefox 115 now supports AV1 Image Format files containing         animations (AVIS), improving support for AVIF images across         the web.
      - The Windows GPU sandbox first shipped in the Firefox 110         release has been tightened to enhance the security benefits         it provides.
      - A 13-year-old feature request was fulfilled and Firefox now         supports files being drag-and-dropped directly from Microsoft         Outlook. A special thanks to volunteer contributor Marco         Spiess for helping to get this across the finish line!
      - Users on macOS can now access the Services sub-menu         directly from Firefox context menus.
      - On Windows, the elastic overscroll effect has been enabled         by default. When two-finger scrolling on the touchpad or         scrolling on the touchscreen, you will now see a bouncing         animation when scrolling past the edge of a scroll container.
      - Firefox is now available in the Tajik (tg) language.
      - Added UI to manage the DNS over HTTPS exception list.
      - Bookmarks can now be searched from the Bookmarks menu. The         Bookmarks menu is accessible by adding the Bookmarks menu         button to the toolbar.
      - Restrict searches to your local browsing history by         selecting Search history from the History, Library or         Application menu buttons.
      - Mac users can now capture video from their cameras in all         supported native resolutions. This enables resolutions higher         than 1280x720.
      - It is now possible to reorder the extensions listed in the         extensions panel.
      - Users on macOS, Linux, and Windows 7 can now use FIDO2 /         WebAuthn authenticators over USB. Some advanced features,         such as fully passwordless logins, require a PIN to be set on         the authenticator.
      - Pocket Recommended content can now be seen in France,         Italy, and Spain.
      - DNS over HTTPS settings are now part of the Privacy &         Security section of the Settings page and allow the user to         choose from all the supported modes.
      - Migrating from another browser? Now you can bring over         payment methods you've saved in Chrome-based browsers to         Firefox.
      - Hardware video decoding enabled for Intel GPUs on Linux.
      - The Tab Manager dropdown now features close buttons, so you         can close tabs more quickly.
      - Windows Magnifier now follows the text cursor correctly         when the Firefox title bar is visible.
      - Undo and redo are now available in Password fields.
        [1]:https://support.mozilla.org/kb/access-toolbar-functions-         using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
        *_ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w         [2]:https://support.mozilla.org/kb/how-set-tab-pickup-firefox-view         [3]:https://support.mozilla.org/kb/task-manager-tabs-or-extensions-are-slowing-firefox         [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-signing-available-november-21-on-firefox-     nightly/         [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/         [6]:https://support.mozilla.org/kb/unified-extensions         [7]:https://support.mozilla.org/kb/import-data-another-browser         [8]:https://support.mozilla.org/kb/identify-problems-third-party-modules-firefox-windows         [9]:https://support.mozilla.org/kb/how-generate-secure-password-firefox         [10]:https://blog.mozilla.org/accessibility/firefox-113-accessibility-performance/

    * Fixed: Various security fixes. MFSA 2023-22 (bsc#1212438)

      * CVE-2023-3482 (bmo#1839464)         Block all cookies bypass for localstorage
      * CVE-2023-37201 (bmo#1826002)         Use-after-free in WebRTC certificate generation
      * CVE-2023-37202 (bmo#1834711)         Potential use-after-free from compartment mismatch in         SpiderMonkey
      * CVE-2023-37203 (bmo#291640)         Drag and Drop API may provide access to local system files
      * CVE-2023-37204 (bmo#1832195)         Fullscreen notification obscured via option element
      * CVE-2023-37205 (bmo#1704420)         URL spoofing in address bar using RTL characters
      * CVE-2023-37206 (bmo#1813299)         Insufficient validation of symlinks in the FileSystem API
      * CVE-2023-37207 (bmo#1816287)         Fullscreen notification obscured
      * CVE-2023-37208 (bmo#1837675)         Lack of warning when opening Diagcab files
      * CVE-2023-37209 (bmo#1837993)         Use-after-free in `NotifyOnHistoryReload`
      * CVE-2023-37210 (bmo#1821886)         Full-screen mode exit prevention
      * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,         bmo#1836550, bmo#1837450)         Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,         and Thunderbird 102.13
      * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,         bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,         bmo#1838587)         Memory safety bugs fixed in Firefox 115
    - Fixed potential SIGILL on older CPUs (bsc#1212101)

    * Fixed: Various  security  fixes and other quality

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2850-1 advisory.

    Changes in MozillaFirefox and MozillaFirefox-branding-SLE:

    This update provides Firefox Extended Support Release 115.0 ESR

    * New:

      - Required fields are now highlighted in PDF forms.
      - Improved performance on high-refresh rate monitors (120Hz+).
      - Buttons in the Tabs toolbar can now be reached with Tab,         Shift+Tab, and Arrow keys. View this article for additional         details.
      - Windows' 'Make text bigger' accessibility setting now         affects all the UI and content pages, rather than only         applying to system font sizes.
      - Non-breaking spaces are now preservedpreventing automatic         line breakswhen copying text from a form control.
      - Fixed WebGL performance issues on NVIDIA binary drivers via         DMA-Buf on Linux.
      - Fixed an issue in which Firefox startup could be         significantly slowed down by the processing of Web content         local storage. This had the greatest impact on users with         platter hard drives and significant local storage.
      - Removed a configuration option to allow SHA-1 signatures in         certificates: SHA-1 signatures in certificateslong since         determined to no longer be secure enoughare now not         supported.
      - Highlight color is preserved correctly after typing `Enter`         in the mail composer of Yahoo Mail and Outlook.
        After bypassing the https only error page navigating back         would take you to the error page that was previously         dismissed. Back now takes you to the previous site that was         visited.
      - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in         plain text contexts, such as input and text area.
      - Added an option to print only the current page from the         print preview dialog.
      - Swipe to navigate (two fingers on a touchpad swiped left or         right to perform history back or forward) on Windows is now         enabled.
      - Stability on Windows is significantly improved as Firefox         handles low-memory situations much better.
      - Touchpad scrolling on macOS was made more accessible by         reducing unintended diagonal scrolling opposite of the         intended scroll axis.
      - Firefox is less likely to run out of memory on Linux and         performs more efficiently for the rest of the system when         memory runs low.
      - It is now possible to edit PDFs: including writing text,         drawing, and adding signatures.
      - Setting Firefox as your default browser now also makes it         the default PDF application on Windows systems.
      - Swipe-to-navigate (two fingers on a touchpad swiped left or         right to perform history back or forward) now works for Linux         users on Wayland.
      - Text Recognition in images allows users on macOS 10.15 and         higher to extract text from the selected image (such as a         meme or screenshot).
      - Firefox View helps you get back to content you previously         discovered. A pinned tab allows you to find and open recently         closed tabs on your current device and access tabs from other         devices (via our Tab Pickup feature).
      - Import maps, which allow web pages to control the behavior         of JavaScript imports, are now enabled by default.
      - Processes used for background tabs now use efficiency mode         on Windows 11 to limit resource use.
      - The shift+esc keyboard shortcut now opens the Process         Manager, offering a way to quickly identify processes that         are using too many resources.
      - Firefox now supports properly color correcting images         tagged with ICCv4 profiles.
      - Support for non-English characters when saving and printing         PDF forms.
      - The bookmarks toolbar's default 'Only show on New Tab'         state works correctly for blank new tabs. As before, you can         change the bookmark toolbar's behavior using the toolbar         context menu.
      - Manifest Version 3 (MV3) extension support is now enabled         by default (MV2 remains enabled/supported). This major update         also ushers an exciting user interface change in the form of         the new extensions button.
      - The Arbitrary Code Guard exploit protection has been         enabled in the media playback utility processes, improving         security for Windows users.
      - The native HTML date picker for date and datetime inputs         can now be used with a keyboard alone, improving its         accessibility for screen reader users. Users with limited         mobility can also now use common keyboard shortcuts to         navigate the calendar grid and month selection spinners.
      - Firefox builds in the Spanish from Spain (es-ES) and         Spanish from Argentina (es-AR) locales now come with a built-         in dictionary for the Firefox spellchecker.
      - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls         the page instead of zooming. This avoids accidental zooming         and matches the behavior of other web browsers on macOS.
      - It's now possible to import bookmarks, history and         passwords not only from Edge, Chrome or Safari but also from         Opera, Opera GX, and Vivaldi.
      - GPU sandboxing has been enabled on Windows.
      - On Windows, third-party modules can now be blocked from         injecting themselves into Firefox, which can be helpful if         they are causing crashes or other undesirable behavior.
      - Date, time, and datetime-local input fields can now be         cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on         macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and         Linux.
      - GPU-accelerated Canvas2D is enabled by default on macOS and         Linux.
      - WebGL performance improvement on Windows, MacOS and Linux.
      - Enables overlay of hardware-decoded video with non-Intel         GPUs on Windows 10/11, improving video playback performance         and video scaling quality.
      - Windows native notifications are now enabled.
      - Firefox Relay users can now opt-in to create Relay email         masks directly from the Firefox credential manager. You must         be signed in with your Firefox Account.
      - Weve added two new locales: Silhe Friulian (fur) and         Sardinian (sc).
      - Right-clicking on password fields now shows an option to         reveal the password.
      - Private windows and ETP set to strict will now include         email tracking protection. This will make it harder for email         trackers to learn the browsing habits of Firefox users. You         can check the Tracking Content in the sub-panel on the shield         icon panel.
      - The deprecated U2F Javascript API is now disabled by         default. The U2F protocol remains usable through the WebAuthn         API. The U2F API can be re-enabled using the         `security.webauth.u2f` preference.
      - Say hello to enhanced Picture-in-Picture! Rewind, check         video duration, and effortlessly switch to full-screen mode         on the web's most popular video websites.
      - Firefox's address bar is already a great place to search         for what you're looking for. Now you'll always be able to see         your web search terms and refine them while viewing your         search's results - no additional scrolling needed! Also, a         new result menu has been added making it easier to remove         history results and dismiss sponsored Firefox Suggest         entries.
      - Private windows now protect users even better by blocking         third-party cookies and storage of content trackers.
      - Passwords automatically generated by Firefox now include         special characters, giving users more secure passwords by         default.
      - Firefox 115 introduces a redesigned accessibility engine         which significantly improves the speed, responsiveness, and         stability of Firefox when used with:

        - Screen readers, as well as certain other accessibility           software;
        - East Asian input methods;
        - Enterprise single sign-on software; and
        - Other applications which use accessibility frameworks to           access information.

      - Firefox 115 now supports AV1 Image Format files containing         animations (AVIS), improving support for AVIF images across         the web.
      - The Windows GPU sandbox first shipped in the Firefox 110         release has been tightened to enhance the security benefits         it provides.
      - A 13-year-old feature request was fulfilled and Firefox now         supports files being drag-and-dropped directly from Microsoft         Outlook. A special thanks to volunteer contributor Marco         Spiess for helping to get this across the finish line!
      - Users on macOS can now access the Services sub-menu         directly from Firefox context menus.
      - On Windows, the elastic overscroll effect has been enabled         by default. When two-finger scrolling on the touchpad or         scrolling on the touchscreen, you will now see a bouncing         animation when scrolling past the edge of a scroll container.
      - Firefox is now available in the Tajik (tg) language.
      - Added UI to manage the DNS over HTTPS exception list.
      - Bookmarks can now be searched from the Bookmarks menu. The         Bookmarks menu is accessible by adding the Bookmarks menu         button to the toolbar.
      - Restrict searches to your local browsing history by         selecting Search history from the History, Library or         Application menu buttons.
      - Mac users can now capture video from their cameras in all         supported native resolutions. This enables resolutions higher         than 1280x720.
      - It is now possible to reorder the extensions listed in the         extensions panel.
      - Users on macOS, Linux, and Windows 7 can now use FIDO2 /         WebAuthn authenticators over USB. Some advanced features,         such as fully passwordless logins, require a PIN to be set on         the authenticator.
      - Pocket Recommended content can now be seen in France,         Italy, and Spain.
      - DNS over HTTPS settings are now part of the Privacy &         Security section of the Settings page and allow the user to         choose from all the supported modes.
      - Migrating from another browser? Now you can bring over         payment methods you've saved in Chrome-based browsers to         Firefox.
      - Hardware video decoding enabled for Intel GPUs on Linux.
      - The Tab Manager dropdown now features close buttons, so you         can close tabs more quickly.
      - Windows Magnifier now follows the text cursor correctly         when the Firefox title bar is visible.
      - Undo and redo are now available in Password fields.
        [1]:https://support.mozilla.org/kb/access-toolbar-functions-         using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
        *_ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w         [2]:https://support.mozilla.org/kb/how-set-tab-pickup-firefox-view         [3]:https://support.mozilla.org/kb/task-manager-tabs-or-extensions-are-slowing-firefox         [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-signing-available-november-21-on-firefox-     nightly/         [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/         [6]:https://support.mozilla.org/kb/unified-extensions         [7]:https://support.mozilla.org/kb/import-data-another-browser         [8]:https://support.mozilla.org/kb/identify-problems-third-party-modules-firefox-windows         [9]:https://support.mozilla.org/kb/how-generate-secure-password-firefox         [10]:https://blog.mozilla.org/accessibility/firefox-113-accessibility-performance/

    * Fixed: Various security fixes. MFSA 2023-22 (bsc#1212438)

      * CVE-2023-3482 (bmo#1839464)         Block all cookies bypass for localstorage
      * CVE-2023-37201 (bmo#1826002)         Use-after-free in WebRTC certificate generation
      * CVE-2023-37202 (bmo#1834711)         Potential use-after-free from compartment mismatch in         SpiderMonkey
      * CVE-2023-37203 (bmo#291640)         Drag and Drop API may provide access to local system files
      * CVE-2023-37204 (bmo#1832195)         Fullscreen notification obscured via option element
      * CVE-2023-37205 (bmo#1704420)         URL spoofing in address bar using RTL characters
      * CVE-2023-37206 (bmo#1813299)         Insufficient validation of symlinks in the FileSystem API
      * CVE-2023-37207 (bmo#1816287)         Fullscreen notification obscured
      * CVE-2023-37208 (bmo#1837675)         Lack of warning when opening Diagcab files
      * CVE-2023-37209 (bmo#1837993)         Use-after-free in `NotifyOnHistoryReload`
      * CVE-2023-37210 (bmo#1821886)         Full-screen mode exit prevention
      * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,         bmo#1836550, bmo#1837450)         Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,         and Thunderbird 102.13
      * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,         bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,         bmo#1838587)         Memory safety bugs fixed in Firefox 115
    - Fixed potential SIGILL on older CPUs (bsc#1212101)

    * Fixed: Various  security  fixes and other quality

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5c979c4971 advisory.

    - New upstream update (115.0)
    - Built with PGO

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6201-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information across domains, or execute arbitrary code. (CVE-2023-37201, CVE-2023-37202,     CVE-2023-37205, CVE-2023-37207, CVE-2023-37209, CVE-2023-37210, CVE-2023-37211, CVE-2023-37212)

    Martin Hostettler discovered that Firefox did not properly block storage of all cookies when configured.
    An attacker could potentially exploits this issue to store tracking data without permission in     localstorage. (CVE-2023-3482)

    Paul Nickerson discovered that Firefox did have insufficient validation in the Drag and Drop API. If a     user were tricked into creating a shortcut to local system files, an attacker could execute arbitrary     code. (CVE-2023-37203)

    Irvan Kurniawan discovered that Firefox did not properly manage fullscreen notifications using an option     element having an expensive computational function. An attacker could potentially exploit this issue to     perform spoofing attacks. (CVE-2023-37204)

    Ameen Basha M K discovered that Firefox did not properly validate symlinks in the FileSystem API. If a     user were tricked into uploading a symlinked file to a malicious website, an attacker could obtain     sensitive information. (CVE-2023-37206)

    Puf discovered that Firefox did not properly provide warning when opening Diagcab files. If a user were     tricked into opening a malicicous Diagcab file, an attacker could execute arbitrary code. (CVE-2023-37208)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b9b15ebaad advisory.

    - New upstream update (115.0)
    - Built with PGO

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 115.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-22 advisory.

  - Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2023-37212)

  - When Firefox is configured to block storage of all cookies, it was still possible to store data in     localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites     storing tracking data without permission. (CVE-2023-3482)

  - An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.
    (CVE-2023-37201)

  - Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to     be stored in the main compartment resulting in a use-after-free. (CVE-2023-37202)

  - Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed     an attacker to trick end-users into creating a shortcut to local system files.  This could have been     leveraged to execute arbitrary code. (CVE-2023-37203)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 115.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-22 advisory.

  - Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2023-37212)

  - When Firefox is configured to block storage of all cookies, it was still possible to store data in     localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites     storing tracking data without permission. (CVE-2023-3482)

  - An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.
    (CVE-2023-37201)

  - Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to     be stored in the main compartment resulting in a use-after-free. (CVE-2023-37202)

  - Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed     an attacker to trick end-users into creating a shortcut to local system files.  This could have been     leveraged to execute arbitrary code. (CVE-2023-37203)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
426444	Alpine: multiple firefox-esr packages: security update to 115.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426444	Alpine: multiple firefox-esr packages: security update to 115.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
187727	GLSA-202401-10 : Mozilla Firefox: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
185928	Amazon Linux 2 : firefox (ALASFIREFOX-2023-017)	Nessus	Amazon Linux Local Security Checks	critical
404404	Alpine: multiple firefox-esr packages: security update to 115.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404404	Alpine: multiple firefox-esr packages: security update to 115.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
178597	SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-SLE / etc (SUSE-SU-2023:2886-1)	Nessus	SuSE Local Security Checks	high
178413	SUSE SLES15: MozillaFirefox / MozillaFirefox-branding-SLE / MozillaFirefox-devel / etc (SUSE-SU-2023:2849-1)	Nessus	SuSE Local Security Checks	high
178405	SUSE SLES12: MozillaFirefox / MozillaFirefox-branding-SLE / MozillaFirefox-devel / etc (SUSE-SU-2023:2850-1)	Nessus	SuSE Local Security Checks	high
178021	Fedora 37 : firefox (2023-5c979c4971)	Nessus	Fedora Local Security Checks	high
177998	Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-6201-1)	Nessus	Ubuntu Local Security Checks	high
177986	Fedora 38 : firefox (2023-b9b15ebaad)	Nessus	Fedora Local Security Checks	high
177933	Mozilla Firefox < 115.0	Nessus	MacOS X Local Security Checks	high
177932	Mozilla Firefox < 115.0	Nessus	Windows	high

Detections

Analytics

CVE-2023-37209

high

Tenable Plugins

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high