Detections
Analytics
Alpine: multiple firefox packages: security update to 82.0.2-r0 (deprecated)
high Tenable Cloud Security Plugin ID 400320
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in
an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR <
78.4.1, and Thunderbird < 78.4.2. (CVE-2020-26950)
See Also
https://git.alpinelinux.org/aports/commit/?id=63836830f25f967c7a2cab4e1549963b0b2a23f0
https://git.alpinelinux.org/aports/commit/?id=8a2b0be744d94cc2c451f9801fa957d036bf7d60
Plugin Details
Severity: High
ID: 400320
Version: Revision 1.24
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.67
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2020-26950
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/10/2020
Vulnerability Publication Date: 11/9/2020
Exploitable With
Metasploit (Firefox MCallGetProperty Write Side Effects Use After Free Exploit)
Reference Information
CVE: CVE-2020-26950
IAVA: 2020-A-0531-S