The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-11 advisory.

  - Mozilla developers and community members Alexis Beingessner, Tyson Smith, Julien Wajsberg, and Matthew     Gregan reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2021-23987)

  - An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be     exploited. (CVE-2021-4127)

  - A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to     leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related     vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.) (CVE-2021-29955)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202104-10 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0993 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 78.9.0.

    Security Fix(es):

    * Mozilla: Texture upload into an unbound backing buffer resulted in an out-of-bound read (CVE-2021-23981)

    * Mozilla: Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9 (CVE-2021-23987)

    * Mozilla: Internal network hosts could have been probed by a malicious webpage (CVE-2021-23982)

    * Mozilla: Malicious extensions could have spoofed popup information (CVE-2021-23984)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0990 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 78.9.0 ESR.

    Security Fix(es):

    * Mozilla: Texture upload into an unbound backing buffer resulted in an out-of-bound read (CVE-2021-23981)

    * Mozilla: Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9 (CVE-2021-23987)

    * Mozilla: Internal network hosts could have been probed by a malicious webpage (CVE-2021-23982)

    * Mozilla: Malicious extensions could have spoofed popup information (CVE-2021-23984)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0994 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 78.9.0.

    Security Fix(es):

    * Mozilla: Texture upload into an unbound backing buffer resulted in an out-of-bound read (CVE-2021-23981)

    * Mozilla: Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9 (CVE-2021-23987)

    * Mozilla: Internal network hosts could have been probed by a malicious webpage (CVE-2021-23982)

    * Mozilla: Malicious extensions could have spoofed popup information (CVE-2021-23984)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4893-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information, or execute arbitrary code. (CVE-2021-23981, CVE-2021-23982, CVE-2021-23983,     CVE-2021-23987, CVE-2021-23988)

    It was discovered that extensions could open popup windows with control of the window title in some     circumstances. If a user were tricked into installing a specially crafted extension, an attacker could     potentially exploit this to spook a website and trick the user into providing credentials.
    (CVE-2021-23984)

    It was discovered that the DevTools remote debugging feature could be enabled without an indication to the     user. If a local attacker could modify the browser configuration, a remote attacker could potentially     exploit this to obtain sensitive information. (CVE-2021-23985)

    It was discovered that extensions could read the response of cross origin requests in some circumstances.
    If a user were tricked into installing a specially crafted extension, an attacker could potentially     exploit this to obtain sensitive information. (CVE-2021-23986)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing attacks.

For Debian 9 stretch, these problems have been fixed in version 78.9.0esr-1~deb9u1.

We recommend that you upgrade your firefox-esr packages.

For the detailed security status of firefox-esr please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/firefox-esr

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing attacks.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0992 advisory.

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
    (CVE-2021-23982)

  - A malicious extension could have opened a popup window lacking an address bar. The title of the popup     lacking an address bar should not be fully controllable, but in this situation was. This could have been     used to spoof a website and attempt to trick the user into providing credentials. This vulnerability     affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23984)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR     78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9,     Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23987)

  - An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be     exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9. (CVE-2021-4127)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:0990 advisory.

  - Mozilla: Texture upload into an unbound backing buffer resulted in an out-of-bound read (CVE-2021-23981)

  - Mozilla: Internal network hosts could have been probed by a malicious webpage (CVE-2021-23982)

  - Mozilla: Malicious extensions could have spoofed popup information (CVE-2021-23984)

  - Mozilla: Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9 (CVE-2021-23987)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
148013	Mozilla Firefox ESR < 78.9	Nessus	MacOS X Local Security Checks	3/23/2021	11/18/2025	critical
149233	GLSA-202104-10 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/3/2021	1/12/2024	high
148116	RHEL 8 : thunderbird (RHSA-2021:0993)	Nessus	Red Hat Local Security Checks	3/25/2021	11/7/2024	critical
148120	RHEL 8 : firefox (RHSA-2021:0990)	Nessus	Red Hat Local Security Checks	3/25/2021	11/7/2024	critical
148121	RHEL 8 : thunderbird (RHSA-2021:0994)	Nessus	Red Hat Local Security Checks	3/25/2021	11/7/2024	critical
148135	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4893-1)	Nessus	Ubuntu Local Security Checks	3/26/2021	8/28/2024	high
148166	Debian DLA-2607-1 : firefox-esr security update	Nessus	Debian Local Security Checks	3/26/2021	6/3/2021	high
148169	Debian DSA-4874-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	3/26/2021	6/3/2021	high
148184	CentOS 7 : firefox (RHSA-2021:0992)	Nessus	CentOS Local Security Checks	3/26/2021	10/9/2024	critical
148188	CentOS 8 : firefox (CESA-2021:0990)	Nessus	CentOS Local Security Checks	3/26/2021	6/3/2021	high

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

high

high

high

critical

high