The remote Ubuntu 18.04 LTS / 20.04 LTS / 21.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5475-1 advisory.

  - Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing     Team reported memory safety bugs present in Firefox 100. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code. This vulnerability affects Firefox < 101. (CVE-2022-31748)

  - Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-1919)

  - A malicious website could have learned the size of a cross-origin resource that supported Range requests.
    This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (CVE-2022-31736)

  - A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox     ESR < 91.10. (CVE-2022-31737)

  - When exiting fullscreen mode, an iframe could have confused the browser about the current state of     fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects     Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (CVE-2022-31738)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5475-1)

critical Nessus Plugin ID 162170

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.12 Oct 16, 2023, 7:25 PM Detection Plugin metadata Plugin Feed: 202310161925
Version 1.11 Jul 11, 2023, 1:48 AM Detection Plugin Feed: 202307110148
Version 1.10 Mar 21, 2023, 7:30 PM Plugin metadata Plugin Feed: 202303211930
Version 1.9 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.8 Jan 6, 2023, 4:14 PM CVSS temporal metrics ("CVSSv3 temporal score" set to "8.5") CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSS metrics ("CVSSv3 score" changed from "8.8" to "9.8") CVSSv2 score source (changed from "CVE-2022-1919" to "CVE-2022-31748") Plugin Feed: 202301061614
Version 1.7 Dec 9, 2022, 2:07 PM CVSS metrics ("CVSSv2 score" changed from "4.3" to "10.0") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2022-31743" to "CVE-2022-1919") CVSSv2 severity (based on CVE-2022-1919, severity increased from "Medium" to "High") Plugin Feed: 202212091407