遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2020: 3559 公告中提及的多個弱點影響。

  - Mozilla：nsJPEGEncoder: : emptyOutputBuffer 中存在整數溢位 (CVE-2020-12422)

  - Mozilla：可能已有遭入侵的內容處理程序繞過 WebRTC 權限提示 (CVE-2020-12424)

  - Mozilla：Date.parse() 中存在超出邊界讀取 (CVE-2020-12425)

  - Mozilla：使用物件或內嵌標籤繞過 X-Frame-Options (CVE-2020-15648)

  - Mozilla：允許快顯時可繞過 iframe 沙箱 (CVE-2020-15653)

  - Mozilla：自訂游標可重疊使用者介面 (CVE-2020-15654)

  - Mozilla：IonMonkey 中存在特殊引數的類型混淆 (CVE-2020-15656)

  - Mozilla：儲存至磁碟時可覆寫檔案類型 (CVE-2020-15658)

  - Mozilla：攻擊者引發的延伸模組安裝提示 (CVE-2020-15664)

  - Mozilla：中止作業時存在釋放後使用 (CVE-2020-15669)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 8 主機上安裝的套件受到 CESA-2020: 3557 公告中提及的多個弱點影響。

  - Mozilla：nsJPEGEncoder: : emptyOutputBuffer 中存在整數溢位 (CVE-2020-12422)

  - Mozilla：可能已有遭入侵的內容處理程序繞過 WebRTC 權限提示 (CVE-2020-12424)

  - Mozilla：Date.parse() 中存在超出邊界讀取 (CVE-2020-12425)

  - Mozilla：使用物件或內嵌標籤繞過 X-Frame-Options (CVE-2020-15648)

  - Mozilla：允許快顯時可繞過 iframe 沙箱 (CVE-2020-15653)

  - Mozilla：自訂游標可重疊使用者介面 (CVE-2020-15654)

  - Mozilla：IonMonkey 中存在特殊引數的類型混淆 (CVE-2020-15656)

  - Mozilla：儲存至磁碟時可覆寫檔案類型 (CVE-2020-15658)

  - Mozilla：攻擊者引發的延伸模組安裝提示 (CVE-2020-15664)

  - Mozilla：中止作業時存在釋放後使用 (CVE-2020-15669)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Oracle Linux 8 主機上有一個套件受到 ELSA-2020-3557 公告中提及的多個弱點影響。

  - 在非標準組態中，JavaScript 建立的 JPEG 影像可造成內部變數溢位，進而導致超出邊界寫入、記憶體損毀，以及可能遭惡意利用的當機。
    此弱點會影響 Firefox < 78。(CVE-2020-12422)

  - 建構 WebRTC 的權限提示時，從內容處理程序提供 URI。此 URI 不受信任，且可能為先前被授予權限的來源的 URI；繞過提示。此弱點會影響 Firefox < 78。(CVE-2020-12424)

  - 處理 Date.parse() 中連字號字元時發生混淆，因此可能發生一位元組超出邊界讀取，進而可能導致資訊洩漏。此弱點會影響 Firefox < 78。
    (CVE-2020-12425)

  - 使用物件或內嵌標籤時，可以為其他網站加入框架，即使這些網站不允許使用 X-Frame-Options 標頭的框架。此弱點會影響Thunderbird < 78 和 Firefox < 78.0.2。
    (CVE-2020-15648)

  - 使用 noopener 連結時，可繞過含有 allow-popups 旗標的 iframe 沙箱元素。這可能會導致仰賴沙箱組態的網站出現允許快顯和主控任意內容的安全性問題。此弱點會影響 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15653)

  - 在無限迴圈中時，指定使用 CSS 自訂游標的網站可讓使用者看起來像是在與使用者介面互動，但實際上並沒有。這可導致可感知的損毀狀態，尤其是在與現有瀏覽器對話方塊和警告的互動無法運作時。此弱點會影響 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15654)

  - 涉及 Javascript 引數物件的 JIT 最佳化可混淆之後的最佳化。已針對此風險在程式碼中採取多種預防措施，因此，此錯誤的嚴重性僅評為中等。此弱點會影響 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。
    (CVE-2020-15656)

  - 下載檔案的程式碼未正確處理特殊字元，導致攻擊者能夠截斷結尾位置較早的檔案，進而導致下載的檔案類型與對話方塊中顯示的不同。此弱點會影響 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15658)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 78.0.2。因此，该应用程序受到 mfsa2020-28 公告中提及的漏洞的影响。

  - 使用对象或嵌入标签可框架其他网站即使其不允许使用 X-Frame-Options 标头框架。注意：此问题正等待一项 CVE 分配，并将在有分配时更新。 (MFSA-2020-0003)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Oracle Linux 7 主机上安装的程序包受到 ELSA-2020-4080 公告中提及的多个漏洞的影响。

  - 在非标准配置中，由 JavaScript 创建的 JPEG 图像可造成内部变量溢出，从而导致越界写入、内存损坏和潜在可利用的崩溃。
    此漏洞会影响 Firefox < 78。(CVE-2020-12422)

  - 构造 WebRTC 的权限提示时，内容进程提供会提供 URI。此 URI 不受信任，并且可能是之前被授予权限的源的 URI；绕过提示。此漏洞会影响 Firefox < 78。(CVE-2020-12424)

  - 处理 Date.parse() 中连字符时发生混淆，因此可能发生一字节越界读取，从而导致潜在的信息泄露。此漏洞会影响 Firefox < 78。
    (CVE-2020-12425)

  - 使用 object 或 embed 标签，可以在其他网站嵌入内容，即使这些网站禁止使用 X-Frame-Options 标头进行嵌入操作。此漏洞会影响 Thunderbird < 78 和 Firefox < 78.0.2。
    (CVE-2020-15648)

  - 使用 noopener 链接时，可能绕过带有 allow-popups 标记的 iframe 沙盒元素。这可能会导致依赖沙盒配置（允许弹出窗口和托管任意内容）的网站出现安全问题。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15653)

  - 当进入死循环时，使用 CSS 指定自定义光标的网站可让其看起来像用户在与用户界面进行交互，而实际上并非如此。这可能会导致可感知的中断状态，尤其是在与现有浏览器对话框和警告的交互不起作用时。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15654)

  - 涉及 Javascript 参数对象的 JIT 优化可能会混淆后续优化。此风险已通过代码中的各种预防措施得以缓解，因此，该缺陷的严重性等级仅为中等。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。
    (CVE-2020-15656)

  - 下载文件的代码未正确处理特殊字符，导致攻击者能够截断以较早位置结尾的文件，进而导致下载的文件类型与对话框中显示的不同。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15658)

  - Mozilla 开发人员报告 Firefox 80 和 Firefox ESR 78.2 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Firefox < 81、Thunderbird < 78.3 和 Firefox ESR < 78.3。(CVE-2020-15673)

  - Firefox 有时会为 DOM 审查器决定删除的 SVG 元素运行 onload 处理程序，从而导致在将攻击者控制的数据粘贴到可编辑内容的元素后执行 JavaScript。此漏洞会影响 Firefox < 81、Thunderbird < 78.3 和 Firefox ESR < 78.3。
    (CVE-2020-15676)

  - 通过利用网站上的开放重定向漏洞，攻击者可以伪造下载文件对话框中显示的站点，以显示原始站点（遭受开放重定向的站点），而不是实际下载文件的站点。此漏洞会影响 Firefox < 81、Thunderbird < 78.3 和 Firefox ESR < 78.3。(CVE-2020-15677)

  - 在滚动过程中递归图形层时，迭代器可能会无效，从而导致潜在的释放后使用。出现这一问题的原因在于函数 APZCTreeManager: : ComputeClippedCompositionBounds 并未遵循迭代器无效规则。此漏洞会影响版本低于 81 的 Firefox、版本低于 78.3 的 Thunderbird 和版本低于 78.3 的 Firefox ESR。(CVE-2020-15678)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程 CentOS Linux 7 主机上安装的一个程序包受到 RHSA-2020:4080 公告中提及的多个漏洞影响。

  - 在非标准配置中，由 JavaScript 创建的 JPEG 图像可造成内部变量溢出，从而导致越界写入、内存损坏和潜在可利用的崩溃。
    此漏洞会影响 Firefox < 78。(CVE-2020-12422)

  - 构造 WebRTC 的权限提示时，内容进程提供会提供 URI。此 URI 不受信任，并且可能是之前被授予权限的源的 URI；绕过提示。此漏洞会影响 Firefox < 78。(CVE-2020-12424)

  - 处理 Date.parse() 中连字符时发生混淆，因此可能发生一字节越界读取，从而导致潜在的信息泄露。此漏洞会影响 Firefox < 78。
    (CVE-2020-12425)

  - 使用 object 或 embed 标签，可以在其他网站嵌入内容，即使这些网站禁止使用 X-Frame-Options 标头进行嵌入操作。此漏洞会影响 Thunderbird < 78 和 Firefox < 78.0.2。
    (CVE-2020-15648)

  - 使用 noopener 链接时，可能绕过带有 allow-popups 标记的 iframe 沙盒元素。这可能会导致依赖沙盒配置（允许弹出窗口和托管任意内容）的网站出现安全问题。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15653)

  - 当进入死循环时，使用 CSS 指定自定义光标的网站可让其看起来像用户在与用户界面进行交互，而实际上并非如此。这可能会导致可感知的中断状态，尤其是在与现有浏览器对话框和警告的交互不起作用时。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15654)

  - 涉及 Javascript 参数对象的 JIT 优化可能会混淆后续优化。此风险已通过代码中的各种预防措施得以缓解，因此，该缺陷的严重性等级仅为中等。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。
    (CVE-2020-15656)

  - 下载文件的代码未正确处理特殊字符，导致攻击者能够截断以较早位置结尾的文件，进而导致下载的文件类型与对话框中显示的不同。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15658)

  - Mozilla 开发人员报告 Firefox 80 和 Firefox ESR 78.2 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Firefox < 81、Thunderbird < 78.3 和 Firefox ESR < 78.3。(CVE-2020-15673)

  - Firefox 有时会为 DOM 审查器决定删除的 SVG 元素运行 onload 处理程序，从而导致在将攻击者控制的数据粘贴到可编辑内容的元素后执行 JavaScript。此漏洞会影响 Firefox < 81、Thunderbird < 78.3 和 Firefox ESR < 78.3。
    (CVE-2020-15676)

  - 通过利用网站上的开放重定向漏洞，攻击者可以伪造下载文件对话框中显示的站点，以显示原始站点（遭受开放重定向的站点），而不是实际下载文件的站点。此漏洞会影响 Firefox < 81、Thunderbird < 78.3 和 Firefox ESR < 78.3。(CVE-2020-15677)

  - 在滚动过程中递归图形层时，迭代器可能会无效，从而导致潜在的释放后使用。发生这种情况的原因是，函数 APZCTreeManager::ComputeClippedCompositionBounds 未遵守迭代器无效规则。此漏洞会影响 Firefox < 81、Thunderbird < 78.3 和 Firefox ESR < 78.3。(CVE-2020-15678)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 CentOS Linux 8 主机上安装的程序包受到 CESA-2020: 3557 公告中涉及的多个漏洞的影响。

  - Mozilla：nsJPEGEncoder: : emptyOutputBuffer 中存在整数溢出 (CVE-2020-12422)

  - Mozilla：WebRTC 权限提示可能已由受破坏的内容进程绕过 (CVE-2020-12424)

  - Mozilla：Date.parse() 中的越界读取 (CVE-2020-12425)

  - Mozilla：使用对象或嵌入标签的 X-Frame-Options 绕过 (CVE-2020-15648)

  - Mozilla：允许弹出窗口时绕过 iframe 沙盒 (CVE-2020-15653)

  - Mozilla：自定义光标可覆盖用户界面 (CVE-2020-15654)

  - Mozilla：IonMonkey 中特殊参数的类型混淆 (CVE-2020-15656)

  - Mozilla：保存到磁盘时替代文件类型 (CVE-2020-15658)

  - Mozilla：攻击者引起的扩展安装提示 (CVE-2020-15664)

  - Mozilla：中止操作时的释放后使用 (CVE-2020-15669)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 3559 公告中提及的多个漏洞的影响。

  - Mozilla：nsJPEGEncoder: : emptyOutputBuffer 中存在整数溢出 (CVE-2020-12422)

  - Mozilla：WebRTC 权限提示可能已由受破坏的内容进程绕过 (CVE-2020-12424)

  - Mozilla：Date.parse() 中的越界读取 (CVE-2020-12425)

  - Mozilla：使用对象或嵌入标签的 X-Frame-Options 绕过 (CVE-2020-15648)

  - Mozilla：允许弹出窗口时绕过 iframe 沙盒 (CVE-2020-15653)

  - Mozilla：自定义光标可覆盖用户界面 (CVE-2020-15654)

  - Mozilla：IonMonkey 中特殊参数的类型混淆 (CVE-2020-15656)

  - Mozilla：保存到磁盘时替代文件类型 (CVE-2020-15658)

  - Mozilla：攻击者引起的扩展安装提示 (CVE-2020-15664)

  - Mozilla：中止操作时的释放后使用 (CVE-2020-15669)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Oracle Linux 8 主机上安装的程序包受到 ELSA-2020-3557 公告中提及的多个漏洞的影响。

  - 在非标准配置中，由 JavaScript 创建的 JPEG 图像可造成内部变量溢出，从而导致越界写入、内存损坏和潜在可利用的崩溃。
    此漏洞会影响 Firefox < 78。(CVE-2020-12422)

  - 构造 WebRTC 的权限提示时，内容进程提供会提供 URI。此 URI 不受信任，并且可能是之前被授予权限的源的 URI；绕过提示。此漏洞会影响 Firefox < 78。(CVE-2020-12424)

  - 处理 Date.parse() 中连字符时发生混淆，因此可能发生一字节越界读取，从而导致潜在的信息泄露。此漏洞会影响 Firefox < 78。
    (CVE-2020-12425)

  - 使用 object 或 embed 标签，可以在其他网站嵌入内容，即使这些网站禁止使用 X-Frame-Options 标头进行嵌入操作。此漏洞会影响 Thunderbird < 78 和 Firefox < 78.0.2。
    (CVE-2020-15648)

  - 使用 noopener 链接时，可能绕过带有 allow-popups 标记的 iframe 沙盒元素。这可能会导致依赖沙盒配置（允许弹出窗口和托管任意内容）的网站出现安全问题。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15653)

  - 当进入死循环时，使用 CSS 指定自定义光标的网站可让其看起来像用户在与用户界面进行交互，而实际上并非如此。这可能会导致可感知的中断状态，尤其是在与现有浏览器对话框和警告的交互不起作用时。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15654)

  - 涉及 Javascript 参数对象的 JIT 优化可能会混淆后续优化。此风险已通过代码中的各种预防措施得以缓解，因此，该缺陷的严重性等级仅为中等。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。
    (CVE-2020-15656)

  - 下载文件的代码未正确处理特殊字符，导致攻击者能够截断以较早位置结尾的文件，进而导致下载的文件类型与对话框中显示的不同。此漏洞会影响 Firefox ESR < 78.1、Firefox < 79 和 Thunderbird < 78.1。(CVE-2020-15658)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程 macOS 或 Mac OS X 主机上安装的 Thunderbird 版本低于 78.0。因此，该应用程序受到 mfsa2020-29 公告中提及的多个漏洞的影响。

  - 清单 URL 中存在 ％2F 时，Firefox 的 AppCache 行为可能会陷入混乱，并允许从子目录提供清单。这可导致 appcache 被用于服务顶级目录的请求。此漏洞会影响 Firefox < 78。(CVE-2020-12415)

  - VideoBroadcaster: : AddOrUpdateSink 的争用条件中可能发生 VideoStreamEncoder 释放，从而导致释放后使用、内存损坏和潜在可利用的崩溃。此漏洞会影响 Firefox < 78。(CVE-2020-12416)

  - 由于对 JavaScript 对象上的 ValueTag 感到困惑，对象可能会通过类型屏障，从而导致内存损坏和潜在可利用的崩溃。*注意：此问题仅影响 ARM64 平台上的 Firefox。*此漏洞会影响 Firefox ESR < 68.10、Firefox < 78 和 Thunderbird < 68.10.0。
    (CVE-2020-12417)

  - 操纵 URL 对象的个别部分可能造成越界读取，从而将进程内存泄漏给恶意 JavaScript。此漏洞会影响 Firefox ESR < 68.10、Firefox < 78 和 Thunderbird < 68.10.0。
    (CVE-2020-12418)

  - 处理在父进程窗口刷新期间发生的回调时，相关窗口可能会终止；导致释放后使用条件。这可能导致内存损坏和潜在的可利用崩溃。此漏洞会影响 Firefox ESR < 68.10、Firefox < 78 和 Thunderbird < 68.10.0。
    (CVE-2020-12419)

  - 尝试连接到 STUN 服务器时，争用条件可能导致指针的释放后使用，从而导致内存损坏和潜在可利用的崩溃。此漏洞会影响 Firefox ESR < 68.10、Firefox < 78 和 Thunderbird < 68.10.0。
    (CVE-2020-12420)

  - 在 RSA 密钥生成期间，bignum 实现使用了二进制扩展欧几里德算法的变体，该变体高度依赖与输入相关的流程。攻击者可利用此漏洞执行基于电磁的边信道攻击，从而记录可导致秘密素数恢复的跟踪。*注意：*未经修改的 Firefox 浏览器在正常操作中不会生成 RSA 密钥，因此不受影响，但构建在其上的产品可能会受到影响。此漏洞会影响 Firefox < 78。
    (CVE-2020-12402)

  - 执行附加组件更新时，以非内建 root 终止的证书链会被拒绝（即使由管理员合法添加）。这可导致附加组件在未通知用户的情况下静默过期。此漏洞会影响 Firefox ESR < 68.10、Firefox < 78 和 Thunderbird < 68.10.0。(CVE-2020-12421)

  - 在非标准配置中，由 JavaScript 创建的 JPEG 图像可造成内部变量溢出，从而导致越界写入、内存损坏和潜在可利用的崩溃。此漏洞会影响 Firefox < 78。(CVE-2020-12422)

  - 操作系统缺少 Windows DLL webauthn.dll 时，如果将恶意 DLL 放置在用户的 ％PATH％ 文件夹中，Firefox 可能会加载 DLL，从而导致任意代码执行。*注意：此问题仅影响 Windows 操作系统；其他操作系统不受影响。*此漏洞会影响 Firefox <78。(CVE-2020-12423)

  - 构造 WebRTC 的权限提示时，内容进程提供会提供 URI。此 URI 不受信任，并且可能是之前被授予权限的源的 URI；绕过提示。
    此漏洞会影响 Firefox < 78。
    (CVE-2020-12424)

  - 处理 Date.parse() 中连字符时发生混淆，因此可能发生一字节越界读取，从而导致潜在的信息泄露。
    此漏洞会影响 Firefox < 78。
    (CVE-2020-12425)

  - Mozilla 开发人员和社区成员报告 Firefox 77 中存在的内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Firefox < 78。(CVE-2020-12426)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has firefox packages installed that are affected by multiple vulnerabilities:

  - In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable     to overflow, resulting in an out of bounds write, memory corruption, and a potentially exploitable crash.
    This vulnerability affects Firefox < 78. (CVE-2020-12422)

  - When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI     was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing     the prompt. This vulnerability affects Firefox < 78. (CVE-2020-12424)

  - Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have     occurred, leading to potential information disclosure. This vulnerability affects Firefox < 78.
    (CVE-2020-12425)

  - Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using     the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.
    (CVE-2020-15648)

  - An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This     could have led to security issues for websites relying on sandbox configurations that allowed popups and     hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird <     78.1. (CVE-2020-15653)

  - When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user     is interacting with the user interface, when they are not. This could lead to a perceived broken state,     especially when interactions with existing browser dialogs and warnings do not work. This vulnerability     affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. (CVE-2020-15654)

  - JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk     was already mitigated by various precautions in the code, resulting in this bug rated at only moderate     severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
    (CVE-2020-15656)

  - The code for downloading files did not properly take care of special characters, which led to an attacker     being able to cut off the file ending at an earlier position, leading to a different file type being     downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and     Thunderbird < 78.1. (CVE-2020-15658)

  - Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and     Firefox ESR < 78.3. (CVE-2020-15673)

  - Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove,     resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable     element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
    (CVE-2020-15676)

  - By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site     displayed in the download file dialog to show the original site (the one suffering from the open redirect)     rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81,     Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15677)

  - When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in     a potential use-after-free. This occurs because the function     APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This     vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15678)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

  - In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in     an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR <     78.4.1, and Thunderbird < 78.4.2. (CVE-2020-26950)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox <     83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26951)

  - It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus     making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26953)

  - In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and     therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird <     78.5. (CVE-2020-26956)

  - Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and     cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a     Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and     Thunderbird < 78.5. (CVE-2020-26958)

  - During browser shutdown, reference decrementing could have occured on a previously freed object, resulting     in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26959)

  - If the Compact() method was called on an nsTArray, the array could have been reallocated without updating     other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26960)

  - When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses     as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through     IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This     vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26961)

  - Some websites have a feature Show Password where clicking a button will change a password field into a     textbook field, revealing the typed password. If, when using a software keyboard that remembers user     input, a user typed their password and used that feature, the type of the password field was changed,     resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed     password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
    (CVE-2020-26965)

  - Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and     Thunderbird < 78.5. (CVE-2020-26968)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR <     78.6. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6,     and Firefox ESR < 78.6. (CVE-2020-26973)

  - When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly     cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially     exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
    (CVE-2020-26974)

  - Using techniques that built on the slipstream research, a malicious webpage could have exposed both an     internal network's hosts as well as services running on the user's local machine. This vulnerability     affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. (CVE-2020-26978)

  - When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback     was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening     View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84,     Thunderbird < 78.6, and Firefox ESR < 78.6. (CVE-2020-35111)

  - Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and     Firefox ESR < 78.6. (CVE-2020-35113)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3555 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 78.2.0 ESR.

    Security Fix(es):

    * Mozilla: Attacker-induced prompt for extension installation (CVE-2020-15664)

    * Mozilla: Use-After-Free when aborting an operation (CVE-2020-15669)

    * Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (CVE-2020-12422)

    * Mozilla: X-Frame-Options bypass using object or embed tags (CVE-2020-15648)

    * Mozilla: Bypassing iframe sandbox when allowing popups (CVE-2020-15653)

    * Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

    * Mozilla: WebRTC permission prompt could have been bypassed by a compromised content process     (CVE-2020-12424)

    * Mozilla: Out of bound read in Date.parse() (CVE-2020-12425)

    * Mozilla: Custom cursor can overlay user interface (CVE-2020-15654)

    * Mozilla: Overriding file type when saving to disk (CVE-2020-15658)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 78.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2020-28 advisory.

  - Using object or embed tags, it was possible to frame     other websites, even if they disallowed framing using     the X-Frame-Options header (CVE-2020-15648).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Mozilla: Memory safety bugs fixed in Firefox 81 and     Firefox ESR 78.3 (CVE-2020-15673)

  - Mozilla: Integer overflow in     nsJPEGEncoder::emptyOutputBuffer (CVE-2020-12422)

  - Mozilla: X-Frame-Options bypass using object or embed     tags (CVE-2020-15648)

  - Mozilla: Bypassing iframe sandbox when allowing popups     (CVE-2020-15653)

  - Mozilla: Type confusion for special arguments in     IonMonkey (CVE-2020-15656)

  - Mozilla: XSS when pasting attacker-controlled data into     a contenteditable element (CVE-2020-15676)

  - Mozilla: Download origin spoofing via redirect     (CVE-2020-15677)

  - Mozilla: When recursing through layers while scrolling,     an iterator may have become invalid, resulting in a     potential use-after-free scenario (CVE-2020-15678)

  - Mozilla: WebRTC permission prompt could have been     bypassed by a compromised content process     (CVE-2020-12424)

  - Mozilla: Out of bound read in Date.parse()     (CVE-2020-12425)

  - Mozilla: Custom cursor can overlay user interface     (CVE-2020-15654)

  - Mozilla: Overriding file type when saving to disk     (CVE-2020-15658)

The version of Thunderbird installed on the remote Windows host is prior to 78.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-29 advisory.

  - When %2F was present in a manifest URL, Firefox's     AppCache behavior may have become confused and allowed a     manifest to be served from a subdirectory. This could     cause the appcache to be used to service requests for     the top level directory. This vulnerability affects     Firefox < 78. (CVE-2020-12415)

  - A VideoStreamEncoder may have been freed in a race     condition with VideoBroadcaster::AddOrUpdateSink,     resulting in a use-after-free, memory corruption, and a     potentially exploitable crash. This vulnerability     affects Firefox < 78. (CVE-2020-12416)

  - Due to confusion about ValueTags on JavaScript Objects,     an object may pass through the type barrier, resulting     in memory corruption and a potentially exploitable     crash. *Note: this issue only affects Firefox on ARM64     platforms.* This vulnerability affects Firefox ESR <     68.10, Firefox < 78, and Thunderbird < 68.10.0.
    (CVE-2020-12417)

  - Manipulating individual parts of a URL object could have     caused an out-of-bounds read, leaking process memory to     malicious JavaScript. This vulnerability affects Firefox     ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
    (CVE-2020-12418)

  - When processing callbacks that occurred during window     flushing in the parent process, the associated window     may die; causing a use-after-free condition. This could     have led to memory corruption and a potentially     exploitable crash. This vulnerability affects Firefox     ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
    (CVE-2020-12419)

  - When trying to connect to a STUN server, a race     condition could have caused a use-after-free of a     pointer, leading to memory corruption and a potentially     exploitable crash. This vulnerability affects Firefox     ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
    (CVE-2020-12420)

  - During RSA key generation, bignum implementations used a     variation of the Binary Extended Euclidean Algorithm     which entailed significantly input-dependent flow. This     allowed an attacker able to perform electromagnetic-     based side channel attacks to record traces leading to     the recovery of the secret primes. *Note:* An unmodified     Firefox browser does not generate RSA keys in normal     operation and is not affected, but products built on top     of it might. This vulnerability affects Firefox < 78.
    (CVE-2020-12402)

  - When performing add-on updates, certificate chains     terminating in non-built-in-roots were rejected (even if     they were legitimately added by an administrator.) This     could have caused add-ons to become out-of-date silently     without notification to the user. This vulnerability     affects Firefox ESR < 68.10, Firefox < 78, and     Thunderbird < 68.10.0. (CVE-2020-12421)

  - In non-standard configurations, a JPEG image created by     JavaScript could have caused an internal variable to     overflow, resulting in an out of bounds write, memory     corruption, and a potentially exploitable crash. This     vulnerability affects Firefox < 78. (CVE-2020-12422)

  - When the Windows DLL webauthn.dll was missing from the     Operating System, and a malicious one was placed in a     folder in the user's %PATH%, Firefox may have loaded the     DLL, leading to arbitrary code execution. *Note: This     issue only affects the Windows operating system; other     operating systems are unaffected.* This vulnerability     affects Firefox < 78. (CVE-2020-12423)

  - When constructing a permission prompt for WebRTC, a URI     was supplied from the content process. This URI was     untrusted, and could have been the URI of an origin that     was previously granted permission; bypassing the prompt.
    This vulnerability affects Firefox < 78.
    (CVE-2020-12424)

  - Due to confusion processing a hyphen character in     Date.parse(), a one-byte out of bounds read could have     occurred, leading to potential information disclosure.
    This vulnerability affects Firefox < 78.
    (CVE-2020-12425)

  - Mozilla developers and community members reported memory     safety bugs present in Firefox 77. Some of these bugs     showed evidence of memory corruption and we presume that     with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability     affects Firefox < 78. (CVE-2020-12426)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
139851	RHEL 8：firefox (RHSA-2020: 3559)	Nessus	Red Hat Local Security Checks	8/26/2020	11/7/2024	high
145857	CentOS 8：firefox (CESA-2020: 3557)	Nessus	CentOS Local Security Checks	2/1/2021	1/24/2024	high
140042	Oracle Linux 8：firefox (ELSA-2020-3557)	Nessus	Oracle Linux Local Security Checks	8/28/2020	10/22/2024	high
138444	Mozilla Firefox < 78.0.2	Nessus	MacOS X Local Security Checks	7/14/2020	5/1/2025	medium
141414	Oracle Linux 7：firefox (ELSA-2020-4080)	Nessus	Oracle Linux Local Security Checks	10/13/2020	10/22/2024	high
208548	CentOS 7: firefox (RHSA-2020:4080)	Nessus	CentOS Local Security Checks	10/9/2024	10/9/2024	high
145857	CentOS 8：firefox (CESA-2020: 3557)	Nessus	CentOS Local Security Checks	2/1/2021	1/24/2024	high
139851	RHEL 8：firefox (RHSA-2020: 3559)	Nessus	Red Hat Local Security Checks	8/26/2020	11/7/2024	high
140042	Oracle Linux 8：firefox (ELSA-2020-3557)	Nessus	Oracle Linux Local Security Checks	8/28/2020	10/22/2024	high
138588	Mozilla Thunderbird < 78.0	Nessus	MacOS X Local Security Checks	7/17/2020	3/1/2024	high
154543	NewStart CGSL CORE 5.05 / MAIN 5.05 : firefox Multiple Vulnerabilities (NS-SA-2021-0154)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	5/9/2022	critical
139811	RHEL 8 : firefox (RHSA-2020:3555)	Nessus	Red Hat Local Security Checks	8/26/2020	11/7/2024	high
138445	Mozilla Firefox < 78.0.2	Nessus	Windows	7/14/2020	10/9/2020	medium
141760	Scientific Linux Security Update : firefox on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	10/21/2020	2/14/2024	high
138589	Mozilla Thunderbird < 78.0	Nessus	Windows	7/17/2020	3/1/2024	high

Detections

Analytics

Plugins Search

high

high

high

medium

high

high

high

high

high

high

critical

high

medium

high

high