Alpine: multiple librewolf packages: security update to 77.0-r0

high Tenable Cloud Security Plugin ID 426035

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence
of memory corruption and we presume that with enough effort some of these could have been exploited to run
arbitrary code. This vulnerability affects Firefox < 77. (CVE-2020-12411)

- NSS has shown timing differences when performing DSA signatures, which was exploitable and could
eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox
ESR < 68.9. (CVE-2020-12399)

- When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a
potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox
ESR < 68.9. (CVE-2020-12405)

- Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting
in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This
vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12406)

- Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions
leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but
not observable from web content. This vulnerability affects Firefox < 77. (CVE-2020-12407)

Plugin Details

Severity: High

ID: 426035

Version: Revision 1.6

Type: Local

Family: Alpine Linux Local Security Checks

Published: 5/16/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-12411

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 6/2/2020

Reference Information

CVE: CVE-2020-12399, CVE-2020-12405, CVE-2020-12406, CVE-2020-12407, CVE-2020-12408, CVE-2020-12409, CVE-2020-12411

Detections

Analytics