The version of Firefox ESR installed on the remote Windows host is prior to 115.23. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-30 advisory.

  - Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained     with other vulnerabilities, could be used to escalate privileges. This bug only affects Firefox for macOS.
    Other versions of Firefox are unaffected. (CVE-2025-4082)

  - Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-     level updater by manipulating the file-locking behavior. By injecting code into the user-privileged     process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths     controlled by a non-privileged user and enabling privilege escalation. (CVE-2025-2817)

  - A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which     could allow content to execute in the top-level document's process instead of the intended frame,     potentially enabling a sandbox escape. (CVE-2025-4083)

  - Due to insufficient escaping of the ampersand character in the copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    This bug only affects Firefox for Windows. Other versions of Firefox are unaffected. (CVE-2025-4084)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Mozilla Firefox ESR < 115.23

high Nessus Plugin ID 234930

Version 1.1