Detections
Analytics

Alpine: firefox-esr: security update to 60.7.0-r2 (deprecated)

high Tenable Self-Hosted Container Security Plugin ID 400575

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop.
 This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw.
 This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
 (CVE-2019-11707)

See Also

https://git.alpinelinux.org/aports/commit/?id=66e8be8d84c0caf89824ce4a6557089f227bef68

https://git.alpinelinux.org/aports/commit/?id=b0a973cfdcabb4c04fb01d3f044a8e4b1b14781a

Plugin Details

Severity: High

ID: 400575

Version: Revision 1.22

Type: Local

Published: 8/16/2023

Updated: 1/17/2024

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.11

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-11707

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/19/2019

Vulnerability Publication Date: 6/18/2019

CISA Known Exploited Vulnerability Due Dates: 6/13/2022

Reference Information

CVE: CVE-2019-11707

BID: 108810