Detections
Analytics
Alpine: firefox-esr: security update to 60.7.0-r2 (deprecated)
high Tenable Cloud Security Plugin ID 400575
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop.
This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw.
This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
(CVE-2019-11707)
See Also
https://git.alpinelinux.org/aports/commit/?id=66e8be8d84c0caf89824ce4a6557089f227bef68
https://git.alpinelinux.org/aports/commit/?id=b0a973cfdcabb4c04fb01d3f044a8e4b1b14781a
Plugin Details
Severity: High
ID: 400575
Version: Revision 1.22
Type: Local
Published: 8/16/2023
Updated: 1/17/2024
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.7
Percentile: 99.11
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2019-11707
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/19/2019
Vulnerability Publication Date: 6/18/2019
CISA Known Exploited Vulnerability Due Dates: 6/13/2022
Reference Information
CVE: CVE-2019-11707
BID: 108810