Alpine: firefox-esr: security update to 68.4.2-r1 (deprecated)

high Tenable Cloud Security Plugin ID 400431

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A content process could have modified shared memory relating to crash reporting information, crash itself,
and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable
crash. This vulnerability affects Firefox < 73 and Firefox < ESR68.5. (CVE-2020-6796)

- By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary
application on the user's computer. The attacker is restricted as they are unable to download non-
quarantined files or supply command line arguments to the application, limiting the impact. Note: this
issue only occurs on Mac OSX. Other operating systems are unaffected. This vulnerability affects
Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5. (CVE-2020-6797)

- If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and
execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer
a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email
in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in
browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox
< ESR68.5. (CVE-2020-6798)

- Command line arguments could have been injected during Firefox invocation as a shell handler for certain
unsupported file types. This required Firefox to be configured as the default handler for a given file
type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL
data. In that situation, clicking a link in the third party application could have been used to retrieve
and execute files whose location was supplied through command line arguments. Note: This issue only
affects Windows operating systems and when Firefox is configured as the default handler for non-default
filetypes. Other operating systems are unaffected. This vulnerability affects Firefox < 73 and Firefox <
ESR68.5. (CVE-2020-6799)

- Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR
68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some
of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited
through email in the Thunderbird product because scripting is disabled when reading mail, but are
potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5,
Firefox < 73, and Firefox < ESR68.5. (CVE-2020-6800)

Plugin Details

Severity: High

ID: 400431

Version: Revision 1.23

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-6800

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/11/2020

Vulnerability Publication Date: 2/11/2020

Reference Information

CVE: CVE-2020-6796, CVE-2020-6797, CVE-2020-6798, CVE-2020-6799, CVE-2020-6800

Detections

Analytics