Alpine: multiple firefox-esr packages: security update to 78.10.0-r0

high Tenable Cloud Security Plugin ID 404439

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed
port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR <
78.10, Thunderbird < 78.10, and Firefox < 88. (CVE-2021-29946)

- Further techniques that built on the slipstream research combined with a malicious webpage could have
exposed both an internal network's hosts as well as services running on the user's local machine. This
vulnerability affects Firefox < 85. (CVE-2021-23961)

- A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound
write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
(CVE-2021-23994)

- When Responsive Design Mode was enabled, it used references to objects that were previously freed. We
presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability
affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. (CVE-2021-23995)

- Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon
from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
(CVE-2021-23998)

Plugin Details

Severity: High

ID: 404439

Version: Revision 1.27

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-29946

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/26/2021

Reference Information

CVE: CVE-2021-23961, CVE-2021-23994, CVE-2021-23995, CVE-2021-23998, CVE-2021-23999, CVE-2021-24002, CVE-2021-29945, CVE-2021-29946

Detections

Analytics