Detections
Analytics
Mozilla Firefox ESR < 52.5.2 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 700333
Synopsis
The remote host has a web browser installed that is vulnerable to multiple attack vectors.Description
Versions of Mozilla Firefox ESR earlier than 52.5.2 are unpatched for the following vulnerabilities :- A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode. (CVE-2017-7843)
- An overflow condition exists that is triggered as certain input is not properly validated when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code. (CVE-2017-7845)
Solution
Upgrade to Firefox ESR version 52.5.2 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2017-28
Plugin Details
Severity: High
ID: 700333
Family: Web Clients
Published: 8/21/2018
Updated: 11/6/2019
Nessus ID: 105212
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:firefox_esr
Patch Publication Date: 12/7/2017
Vulnerability Publication Date: 12/7/2017
Reference Information
CVE: CVE-2017-7843, CVE-2017-7845