A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-     of-bounds write, leading to a potentially exploitable crash in a privileged process. *This bug only     affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox <     118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5168)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of firefox installed on the remote host is prior to 115.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-017 advisory.

    A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an     inopportune time.  This could have lead to memory corruption or a potentially exploitable crash.*Note*:
    This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the     original advisory. The fix was included in the original release of Firefox 106. This vulnerability affects     Firefox < 106. (CVE-2022-46884)

    When Firefox is configured to block storage of all cookies, it was still possible to store data in     localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites     storing tracking data without permission. This vulnerability affects Firefox < 115. (CVE-2023-3482)

    Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed     an attacker to trick end-users into creating a shortcut to local system files.  This could have been     leveraged to execute arbitrary code. This vulnerability affects Firefox < 115. (CVE-2023-37203)

    A website could have obscured the fullscreen notification by using an option element by introducing lag     via an expensive computational function. This could have led to user confusion and possible spoofing     attacks. This vulnerability affects Firefox < 115. (CVE-2023-37204)

    The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability     affects Firefox < 115. (CVE-2023-37205)

    Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting     sensitive data to a malicious website. This vulnerability affects Firefox < 115. (CVE-2023-37206)

    A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object     was freed and a reference to that object remained.  This resulted in a potentially exploitable condition     when the reference to that object was later reused. This vulnerability affects Firefox < 115.
    (CVE-2023-37209)

    A website could prevent a user from exiting full-screen mode via alert and prompt calls.  This could lead     to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.
    (CVE-2023-37210)

    Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Firefox < 115. (CVE-2023-37212)

    The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service     (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length     affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data     for each parse attempt (e.g., millions of bytes). (CVE-2023-43669)

    A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-     of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability     affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5168)

    A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-     of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability     affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5169)

    During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects     Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5171)

    Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and     Thunderbird < 115.3. (CVE-2023-5176)

    The Mozilla Foundation Security Advisory describes this flaw as:

    It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an insufficient activation-delay. (CVE-2023-5721)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led     to a crash. (CVE-2023-5724)

    The Mozilla Foundation Security Advisory describes this flaw as:

    A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be     leveraged to collect sensitive user data. (CVE-2023-5725)

    The Mozilla Foundation Security Advisory describes this flaw as:

    During garbage collection extra operations were performed on a object that should not be. This could have     led to a potentially exploitable crash. (CVE-2023-5728)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5730)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An attacker could have created a malicious link using bidirectional characters to spoof the location in     the address bar when visited. (CVE-2023-5732)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a0ac4fe21c advisory.

    - Updated to latest upstream (118.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-
    of-bounds write, leading to a potentially exploitable crash in a privileged process. *This bug only
    affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox <
    118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-
    of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability
    affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing
    an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects
    Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5171)

  - If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently
    freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. *This bug only
    affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other
    operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and
    Thunderbird < 115.3. (CVE-2023-5174)

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs
    showed evidence of memory corruption and we presume that with enough effort some of these could have been
    exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and
    Thunderbird < 115.3. (CVE-2023-5176)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4016-1 advisory.

    Security fixes:
    - CVE-2023-5217: Fixed a heap buffer overflow in libvpx. (bsc#1215814)
    - CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1. (bsc#1215575)
    - CVE-2023-5169: Out-of-bounds write in PathOps. (bsc#1215575)
    - CVE-2023-5171: Use-after-free in Ion Compiler. (bsc#1215575)
    - CVE-2023-5174: Double-free in process spawning on Windows. (bsc#1215575)
    - CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3.
    (bsc#1215575)

    Other fixes:

    - Mozilla Thunderbird 115.3.1
      * fixed: In Unified Folders view, some folders had incorrect         unified folder parent (bmo#1852525)
      * fixed: 'Edit message as new' did not restore encrypted         subject from selected message (bmo#1788534)
      * fixed: Importing some CalDAV calendars with yearly recurrence         events caused Thunderbird to freeze (bmo#1850732)
      * fixed: Security fixes       MFSA 2023-44 (bsc#1215814)
      * CVE-2023-5217 (bmo#1855550)         Heap buffer overflow in libvpx
    - Mozilla Thunderbird 115.3
      * fixed: Thunderbird could not import profiles with hostname         ending in dot ('.') (bmo#1825374)
      * fixed: Message header was occasionally missing in message         preview (bmo#1840943)
      * fixed: Setting an existing folder's type flag did not add         descendant folders to the Unified Folders view (bmo#1848904)
      * fixed: Thunderbird did not always delete all temporary mail         files, sometimes preventing messages from being sent         (bmo#673703)
      * fixed: Status bar in Message Compose window could not be         hidden (bmo#1806860)
      * fixed: Message header was intermittently missing from message         preview (bmo#1840943)
      * fixed: OAuth2 did not work on some profiles created in         Thunderbird 102.6.1 or earlier (bmo#1814823)
      * fixed: In Vertical View, decrypted subject lines were         displayed as ellipsis ('...') in message list (bmo#1831764)
      * fixed: Condensed address preference         (mail.showCondensedAddresses) did not show condensed         addresses in message list (bmo#1831280)
      * fixed: Spam folder could not be assigned non-ASCII names with         IMAP UTF-8 enabled (bmo#1816332)
      * fixed: Message header was not displayed until images finished         loading, causing noticeable delay for messages containing         large images (bmo#1851871)
      * fixed: Large SVG favicons did not display on RSS feeds         (bmo#1853895)
      * fixed: Context menu items did not display a hover background         color (bmo#1852732)
      * fixed: Security fixes       MFSA 2023-43 (bsc#1215575)
      * CVE-2023-5168 (bmo#1846683)         Out-of-bounds write in FilterNodeD2D1
      * CVE-2023-5169 (bmo#1846685)         Out-of-bounds write in PathOps
      * CVE-2023-5171 (bmo#1851599)         Use-after-free in Ion Compiler
      * CVE-2023-5174 (bmo#1848454)         Double-free in process spawning on Windows
      * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,         bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,         bmo#1851195)         Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,         and Thunderbird 115.3
    - Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build       with newer binutils (bsc#1215309)
    - Fix i586 build by reducing debug info to -g1. (bsc#1210168)
    - Mozilla Thunderbird 115.2.3
      * changed: Card view and vertical layout are now default for         new profiles (bmo#1849000)
      * fixed: Go - Folder menu was disabled (bmo#1849919)
      * fixed: 'Tools' menu was blank when opened from compose window         on macOS (bmo#1848155)
      * fixed: Deleting an attachment from a message on an IMAP         server corrupted the local copy when configured with 'mark as         deleted' (bmo#1135434)
      * fixed: Manually entered passwords were not remembered for         OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
      * fixed: Quick Filter's 'Keep filters applied' did not persist         after restarting Thunderbird (bmo#1846880,bmo#1849221)
      * fixed: Top-level Quick Filter settings did not persist after         restart (bmo#1849249)
      * fixed: Notifications for new messages with non-ASCII         characters in the subject were garbled (bmo#1842384)
      * fixed: 'Mark Thread As Read' did not work when some messages         in thread were already read (bmo#1850850)
      * fixed: New Groups tab in NNTP subscribe dialog id not work as         expected (bmo#1848366)
      * fixed: Negative values were allowed in 'Share for files         larger than' field (bmo#1850281)
      * fixed: Thunderbird sometimes crashed when deleting a parent         folder with subfolders (bmo#1851293)
      * fixed: 'Send Message Error' appeared intermittently while         Thunderbird was idle (bmo#1801668)
      * fixed: Focused but not selected messages were missing visual         indication of focus in card view (bmo#1844263)
      * fixed: Notification dot did not disappear from taskbar icon         on Windows after messages had already been read (bmo#1824889)
      * fixed: Multiple selected messages could not be opened         simultaneously if selection included more than 19 messages         (bmo#1851563)
      * fixed: Email replies received via BCC incorrectly populated         From field with default identity (bmo#1851512)
      * fixed: User was not always notified of message send failures         in outbox (bmo#1851542)
      * fixed: Tag dialog did not close properly after editing tag         (bmo#1852414)
      * fixed: Newsgroup field in compose window did not autocomplete         with suggested newsgroup names (bmo#1670457)
      * fixed: Canceling newsgroup messages did not check if sender         matched user's own identity (bmo#1823274)
      * fixed: Event dialog with several invitees expanded beyond         screen height (bmo#1848261)
      * fixed: Message check boxes were partially obstructed in         message list (bmo#1850760)
      * unresolved: Some folders missing from Unified Folders ()

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7a4026e363 advisory.

    - Updated to latest upstream (118.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3899-1 advisory.

    Update to Firefox Extended Support Release 115.3.0 ESR (MFSA 2023-42, bsc#1215575):

    Security fixes:

    - CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 (bmo#1846683).
    - CVE-2023-5169: Out-of-bounds write in PathOps (bmo#1846685).
    - CVE-2023-5171: Use-after-free in Ion Compiler (bmo#1851599).
    - CVE-2023-5174: Double-free in process spawning on Windows (bmo#1848454).
    - CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195).

    Other fixes:

      - Fix broken build with newer binutils (bsc#1215309)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3898-1 advisory.

    Update to Firefox Extended Support Release 115.3.0 ESR (MFSA 2023-42, bsc#1215575):

    Security fixes:

    - CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 (bmo#1846683).
    - CVE-2023-5169: Out-of-bounds write in PathOps (bmo#1846685).
    - CVE-2023-5171: Use-after-free in Ion Compiler (bmo#1851599).
    - CVE-2023-5174: Double-free in process spawning on Windows (bmo#1848454).
    - CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195).

    Other fixes:

      - Fix broken build with newer binutils (bsc#1215309)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3837-1 advisory.

    Update to Firefox Extended Support Release 115.3.0 ESR (MFSA 2023-42, bsc#1215575):

    Security fixes:

    - CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 (bmo#1846683).
    - CVE-2023-5169: Out-of-bounds write in PathOps (bmo#1846685).
    - CVE-2023-5171: Use-after-free in Ion Compiler (bmo#1851599).
    - CVE-2023-5174: Double-free in process spawning on Windows (bmo#1848454).
    - CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195).

    Other fixes:

      - Fix broken build with newer binutils (bsc#1215309)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-587dc80bb1 advisory.

    - Updated to latest upstream (118.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of mozilla-firefox installed on the remote host is prior to 115.3.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-269-01 advisory.

  - A compromised content process could have provided malicious data to <code>FilterNodeD2D1</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a <code>PathRecording</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash.  (CVE-2023-5171)

  - If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently     freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only     affects Firefox on Windows when run in non-standard configurations (such as using <code>runas</code>).
    Other operating systems are unaffected.  (CVE-2023-5174)

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code.  (CVE-2023-5176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 115.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-43 advisory.

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5176)

  - A compromised content process could have provided malicious data to <code>FilterNodeD2D1</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This bug     only affects Firefox on Windows. Other operating systems are unaffected. (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a <code>PathRecording</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. (CVE-2023-5171)

  - If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently     freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only     affects Firefox on Windows when run in non-standard configurations (such as using <code>runas</code>).
    Other operating systems are unaffected. (CVE-2023-5174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 115.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-43 advisory.

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5176)

  - A compromised content process could have provided malicious data to <code>FilterNodeD2D1</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This bug     only affects Firefox on Windows. Other operating systems are unaffected. (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a <code>PathRecording</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. (CVE-2023-5171)

  - If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently     freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only     affects Firefox on Windows when run in non-standard configurations (such as using <code>runas</code>).
    Other operating systems are unaffected. (CVE-2023-5174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-42 advisory.

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5176)

  - A compromised content process could have provided malicious data to <code>FilterNodeD2D1</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This bug     only affects Firefox on Windows. Other operating systems are unaffected. (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a <code>PathRecording</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. (CVE-2023-5171)

  - If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently     freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only     affects Firefox on Windows when run in non-standard configurations (such as using <code>runas</code>).
    Other operating systems are unaffected. (CVE-2023-5174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-42 advisory.

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5176)

  - A compromised content process could have provided malicious data to <code>FilterNodeD2D1</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This bug     only affects Firefox on Windows. Other operating systems are unaffected. (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a <code>PathRecording</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. (CVE-2023-5171)

  - If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently     freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only     affects Firefox on Windows when run in non-standard configurations (such as using <code>runas</code>).
    Other operating systems are unaffected. (CVE-2023-5174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 118.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-41 advisory.

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5176)

  - A compromised content process could have provided malicious data to <code>FilterNodeD2D1</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This bug     only affects Firefox on Windows. Other operating systems are unaffected. (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a <code>PathRecording</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5169)

  - In canvas rendering, a compromised content process could have caused a surface to change unexpectedly,     leading to a memory leak of a privileged process. This memory leak could be used to effect a sandbox     escape if the correct data was leaked. (CVE-2023-5170)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. (CVE-2023-5171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 118.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-41 advisory.

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5176)

  - A compromised content process could have provided malicious data to <code>FilterNodeD2D1</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This bug     only affects Firefox on Windows. Other operating systems are unaffected. (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a <code>PathRecording</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5169)

  - In canvas rendering, a compromised content process could have caused a surface to change unexpectedly,     leading to a memory leak of a privileged process. This memory leak could be used to effect a sandbox     escape if the correct data was leaked. (CVE-2023-5170)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. (CVE-2023-5171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
249591	Linux Distros Unpatched Vulnerability : CVE-2023-5168	Nessus	Misc.	critical
190759	GLSA-202402-25 : Mozilla Thunderbird: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
185928	Amazon Linux 2 : firefox (ALASFIREFOX-2023-017)	Nessus	Amazon Linux Local Security Checks	critical
185203	Fedora 39 : firefox (2023-a0ac4fe21c)	Nessus	Fedora Local Security Checks	critical
404409	Alpine: multiple firefox-esr packages: security update to 115.3.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404409	Alpine: multiple firefox-esr packages: security update to 115.3.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
182798	SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2023:4016-1)	Nessus	SuSE Local Security Checks	critical
182395	Fedora 37 : firefox (2023-7a4026e363)	Nessus	Fedora Local Security Checks	critical
182389	SUSE SLES15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:3899-1)	Nessus	SuSE Local Security Checks	critical
182387	SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-upstream / etc (SUSE-SU-2023:3898-1)	Nessus	SuSE Local Security Checks	critical
182120	SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:3837-1)	Nessus	SuSE Local Security Checks	critical
182082	Fedora 38 : firefox (2023-587dc80bb1)	Nessus	Fedora Local Security Checks	critical
181901	Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2023-269-01)	Nessus	Slackware Local Security Checks	critical
181882	Mozilla Thunderbird < 115.3	Nessus	MacOS X Local Security Checks	critical
181881	Mozilla Thunderbird < 115.3	Nessus	Windows	critical
181878	Mozilla Firefox ESR < 115.3	Nessus	MacOS X Local Security Checks	critical
181877	Mozilla Firefox ESR < 115.3	Nessus	Windows	critical
181876	Mozilla Firefox < 118.0	Nessus	MacOS X Local Security Checks	critical
181875	Mozilla Firefox < 118.0	Nessus	Windows	critical

Detections

Analytics

CVE-2023-5168

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical