The version of Mozilla Firefox ESR installed on the remote macOS host is prior to 60.3. It is, therefore, affected by multiple vulnerabilities :

  - During HTTP Live Stream playback on Firefox for Android,     audio data can be accessed across origins in violation     of security policies. Because the problem is in the     underlying Android service, this issue is addressed by     treating all HLS streams as cross-origin and opaque to     access. *Note: this issue only affects Firefox for     Android. Desktop versions of Firefox are unaffected.*     (CVE-2018-12391)

  - When manipulating user events in nested loops while     opening a document through script, it is possible to     trigger a potentially exploitable crash due to poor     event handling. (CVE-2018-12392)

  - A potential vulnerability was found in 32-bit builds     where an integer overflow during the conversion of     scripts to an internal UTF-16 representation could     result in allocating a buffer too small for the     conversion. This leads to a possible out-of-bounds     write. *Note: 64-bit builds are not vulnerable to this     issue.*     (CVE-2018-12393)

  - By rewriting the Host request headers using the     webRequest API, a WebExtension can bypass domain     restrictions through domain fronting. This would allow     access to domains that share a host that are     otherwise restricted. (CVE-2018-12395)

  - A vulnerability where a WebExtension can run content     scripts in disallowed contexts following navigation or     other events. This allows for potential privilege     escalation by the WebExtension on sites where content     scripts should not be run. (CVE-2018-12396)

  - A WebExtension can request access to local files     without the warning prompt stating that the extension     will 'Access your data for all websites' being displayed     to the user. This allows extensions to run content     scripts in local pages without permission warnings when     a local file is opened. (CVE-2018-12397)

  - Mozilla developers and community members Daniel     Veditz and Philipp reported memory safety bugs present     in Firefox ESR 60.2. Some of these bugs showed evidence     of memory corruption and we presume that with enough     effort that some of these could be exploited to run     arbitrary code. (CVE-2018-12389)

  - Mozilla developers and community members Christian     Holler, Bob Owen, Boris Zbarsky, Calixte Denizet,     Jason Kratzer, Jed Davis, Taegeon Lee, Philipp, Ronald     Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond     Forbes, and Bogdan Tara reported memory safety bugs     present in Firefox 62 and Firefox ESR 60.2. Some of     these bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could     be exploited to run arbitrary code. (CVE-2018-12390)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 60.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-27 advisory.

  - When manipulating user events in nested loops while opening a document through script, it is possible to     trigger a potentially exploitable crash due to poor event handling. (CVE-2018-12392)

  - During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in     violation of security policies. Because the problem is in the underlying Android service, this issue is     addressed by treating all HLS streams as cross-origin and opaque to access.  Note: this issue only affects     Firefox for Android. Desktop versions of Firefox are unaffected. (CVE-2018-12391)

  - A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of     scripts to an internal UTF-16 representation could result in allocating a buffer too small for the     conversion. This leads to a possible out-of-bounds write.  Note: 64-bit builds are not vulnerable to this     issue. (CVE-2018-12393)

  - By rewriting the <code>Host</code> request headers using the <code>webRequest</code> API, a WebExtension     can bypass domain restrictions through domain fronting. This would allow access to domains that share a     host that are otherwise restricted. (CVE-2018-12395)

  - A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation     or other events. This allows for potential privilege escalation by the WebExtension on sites where content     scripts should not be run. (CVE-2018-12396)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for Mozilla Firefox to version 60.3.0esr fixes security issues and stability bugs.

The following security issues were fixed (MFSA 2018-27, boo#1112852) :

  - CVE-2018-12392: Crash with nested event loops

  - CVE-2018-12393: Integer overflow during Unicode     conversion while loading JavaScript

  - CVE-2018-12395: WebExtension bypass of domain     restrictions through header rewriting

  - CVE-2018-12396: WebExtension content scripts can execute     in disallowed contexts

  - CVE-2018-12397: WebExtension local file access     vulnerability

  - CVE-2018-12389: Memory safety bugs fixed in Firefox ESR     60.3

  - CVE-2018-12390: Memory safety bugs fixed in Firefox 63     and Firefox ESR 60.3

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-27 advisory.

  - When manipulating user events in nested loops while opening a document through script, it is possible to     trigger a potentially exploitable crash due to poor event handling. (CVE-2018-12392)

  - During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in     violation of security policies. Because the problem is in the underlying Android service, this issue is     addressed by treating all HLS streams as cross-origin and opaque to access.  Note: this issue only affects     Firefox for Android. Desktop versions of Firefox are unaffected. (CVE-2018-12391)

  - A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of     scripts to an internal UTF-16 representation could result in allocating a buffer too small for the     conversion. This leads to a possible out-of-bounds write.  Note: 64-bit builds are not vulnerable to this     issue. (CVE-2018-12393)

  - By rewriting the <code>Host</code> request headers using the <code>webRequest</code> API, a WebExtension     can bypass domain restrictions through domain fronting. This would allow access to domains that share a     host that are otherwise restricted. (CVE-2018-12395)

  - A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation     or other events. This allows for potential privilege escalation by the WebExtension on sites where content     scripts should not be run. (CVE-2018-12396)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3377:08 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390)
    * Mozilla: Crash with nested event loops (CVE-2018-12392)
    * Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393)
    * Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395)
    * Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396)
    * Mozilla: WebExtension local file permission check bypass (CVE-2018-12397)
    * Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
118394	Mozilla Firefox ESR < 60.3 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	10/25/2018	3/3/2026	critical
118395	Mozilla Firefox ESR < 60.3	Nessus	Windows	10/25/2018	11/18/2025	critical
118444	openSUSE Security Update : Mozilla Firefox (openSUSE-2018-1268)	Nessus	SuSE Local Security Checks	10/26/2018	7/29/2024	critical
275617	Mozilla Firefox ESR < 60.3	Nessus	MacOS X Local Security Checks	11/18/2025	11/18/2025	critical
289958	MiracleLinux 4 : firefox-60.3.0-1.0.1.AXS4 (AXSA:2018-3377:08)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical