The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:5014 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 (CVE-2021-4129)

  - Mozilla: URL leakage when navigating while executing asynchronous function (CVE-2021-43536)

  - Mozilla: Heap buffer overflow when using structured clone (CVE-2021-43537)

  - Mozilla: Missing fullscreen and pointer lock notification when requesting both (CVE-2021-43538)

  - Mozilla: GC rooting failure when calling wasm instance methods (CVE-2021-43539)

  - Mozilla: External protocol handler parameters were unescaped (CVE-2021-43541)

  - Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler     (CVE-2021-43542)

  - Mozilla: Bypass of CSP sandbox directive when embedding (CVE-2021-43543)

  - Mozilla: Denial of Service when using the Location API in a loop (CVE-2021-43545)

  - Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed (CVE-2021-43546)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : firefox (RHSA-2021:5014)

critical Nessus Plugin ID 155954

Version 1.10