The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5726-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked

    into opening a specially crafted website, an attacker could potentially

    exploit these to cause a denial of service, spoof the contents of the addressbar, bypass security     restrictions, cross-site tracing or execute arbitrary code. (CVE-2022-45403, CVE-2022-45404,     CVE-2022-45405, CVE-2022-45406, CVE-2022-45407, CVE-2022-45408, CVE-2022-45409, CVE-2022-45410,     CVE-2022-45411, CVE-2022-45413, CVE-2022-40674, CVE-2022-45418, CVE-2022-45419, CVE-2022-45420,     CVE-2022-45421)

    Armin Ebert discovered that Firefox did not properly manage while resolving file symlink. If a user were     tricked into opening a specially crafted weblink, an attacker could potentially exploit these to cause a     denial of service.

    (CVE-2022-45412)

    Jefferson Scher and Jayateertha Guruprasad discovered that Firefox did not properly sanitize the HTML     download file extension under certain circumstances. If a user were tricked into downloading and executing     malicious content, a remote attacker could execute arbitrary code with the privileges of the user invoking     the programs. (CVE-2022-45415)

    Erik Kraft, Martin Schwarzl, and Andrew McCreight discovered that Firefox incorrectly handled keyboard     events. An attacker could possibly use this issue to perform a timing side-channel attack and possibly     figure out which keys are being pressed. (CVE-2022-45416)

    Kagami discovered that Firefox did not detect Private Browsing Mode correctly. An attacker could possibly     use this issue to obtain sensitive information about Private Browsing Mode. (CVE-2022-45417)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5726-1)

critical Nessus Plugin ID 167744

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.10 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.9 Oct 25, 2023, 5:17 PM CVSSv2 score source (changed from "CVE-2022-40674" to "CVE-2022-45421") CVSSv3 score source (set to "CVE-2022-45406") Plugin Feed: 202310251717
Version 1.8 Jul 11, 2023, 4:01 AM Detection Plugin Feed: 202307110401
Version 1.7 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.7 Jul 11, 2023, 1:48 AM Detection Plugin Feed: 202307110148
Version 1.6 Dec 15, 2022, 4:16 PM IAVM reference Plugin Feed: 202212151616
Version 1.5 Nov 30, 2022, 4:19 PM CVSS metrics ("CVSSv2 score" changed from "7.5" to "10.0") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") Plugin Feed: 202211301619
Version 1.4 Nov 17, 2022, 9:58 PM IAVM reference STIG Severity Plugin Feed: 202211172158
Version 1.3 Nov 17, 2022, 9:49 AM CVE Plugin Feed: 202211170949
Version 1.2 Nov 16, 2022, 11:47 PM New Plugin Feed: 202211162347