There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must
    ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted
    in WebGL, resulting in a use-after-free and a potentially exploitable crash. This vulnerability affects
    Firefox < 84. (CVE-2020-26972)

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain
    potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow
    on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR <
    78.6. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This
    could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6,
    and Firefox ESR < 78.6. (CVE-2020-26973)

The version of Firefox installed on the remote Windows host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory.

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must     ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted     in WebGL, resulting in a use-after-free and a potentially exploitable crash. (CVE-2020-26972)

  - When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory     to be read. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. (CVE-2020-26973)

  - When <code>flex-basis</code> was used on a table wrapper, a <code>StyleGenericFlexBasis</code> object     could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-26974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory.

  - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must     ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted     in WebGL, resulting in a use-after-free and a potentially exploitable crash. (CVE-2020-26972)

  - When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory     to be read. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. (CVE-2020-26973)

  - When <code>flex-basis</code> was used on a table wrapper, a <code>StyleGenericFlexBasis</code> object     could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-26974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
426760	Alpine: multiple librewolf packages: security update to 84.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	5/16/2025	7/2/2026	critical
426760	Alpine: multiple librewolf packages: security update to 84.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	5/16/2025	7/2/2026	critical
404376	Alpine: multiple firefox packages: security update to 84.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	critical
404376	Alpine: multiple firefox packages: security update to 84.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	critical
144282	Mozilla Firefox < 84.0	Nessus	Windows	12/15/2020	11/18/2025	critical
144283	Mozilla Firefox < 84.0	Nessus	MacOS X Local Security Checks	12/15/2020	11/18/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical