This update for MozillaFirefox fixes the following issues :

Firefox Extended Support Release 78.6.1 ESR

  - Fixed: Critical security issue MFSA 2021-01     (bsc#1180623)

  - CVE-2020-16044 Use-after-free write when handling a     malicious COOKIE-ECHO SCTP chunk

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202101-04 (Mozilla Firefox: Remote code execution)

    A use-after-free bug was discovered in Mozilla Firefox&rsquo;s handling of       SCTP.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0089 advisory.

  - Mozilla: Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk (CVE-2020-16044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0054 advisory.

  - Mozilla: Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk (CVE-2020-16044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-48866282e5 advisory.

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local     attacker to perform OS-level privilege escalation via a crafted file. (CVE-2021-21117)

  - Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21118)

  - Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-21119)

  - Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21120)

  - Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21121)

  - Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21122)

  - Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21123)

  - Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21124)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21125)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass site isolation via a crafted Chrome Extension. (CVE-2021-21126)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass content security policy via a crafted Chrome Extension. (CVE-2021-21127)

  - Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21128)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21129, CVE-2021-21130,     CVE-2021-21131)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to potentially perform a sandbox escape via a crafted Chrome Extension. (CVE-2021-21132)

  - Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker     who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.
    (CVE-2021-21133)

  - Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2021-21134)

  - Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21135)

  - Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21136)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to obtain potentially sensitive information from disk via a crafted HTML page. (CVE-2021-21137)

  - Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform a sandbox escape via a crafted file. (CVE-2021-21138)

  - Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21139)

  - Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform out of bounds memory access via via a USB device. (CVE-2021-21140)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass file extension policy via a crafted HTML page. (CVE-2021-21141)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge installed on the remote Windows host is prior to 88.0.705.50. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

Chromium was updated to 88.0.4324.96 boo#1181137

  - CVE-2021-21117: Insufficient policy enforcement in     Cryptohome

  - CVE-2021-21118: Insufficient data validation in V8

  - CVE-2021-21119: Use after free in Media

  - CVE-2021-21120: Use after free in WebSQL

  - CVE-2021-21121: Use after free in Omnibox

  - CVE-2021-21122: Use after free in Blink

  - CVE-2021-21123: Insufficient data validation in File     System API

  - CVE-2021-21124: Potential user after free in Speech     Recognizer

  - CVE-2021-21125: Insufficient policy enforcement in File     System API

  - CVE-2020-16044: Use after free in WebRTC

  - CVE-2021-21126: Insufficient policy enforcement in     extensions

  - CVE-2021-21127: Insufficient policy enforcement in     extensions

  - CVE-2021-21128: Heap buffer overflow in Blink

  - CVE-2021-21129: Insufficient policy enforcement in File     System API

  - CVE-2021-21130: Insufficient policy enforcement in File     System API

  - CVE-2021-21131: Insufficient policy enforcement in File     System API

  - CVE-2021-21132: Inappropriate implementation in DevTools

  - CVE-2021-21133: Insufficient policy enforcement in     Downloads

  - CVE-2021-21134: Incorrect security UI in Page Info

  - CVE-2021-21135: Inappropriate implementation in     Performance API

  - CVE-2021-21136: Insufficient policy enforcement in     WebView

  - CVE-2021-21137: Inappropriate implementation in DevTools

  - CVE-2021-21138: Use after free in DevTools

  - CVE-2021-21139: Inappropriate implementation in iframe     sandbox

  - CVE-2021-21140: Uninitialized Use in USB

  - CVE-2021-21141: Insufficient policy enforcement in File     System API

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-16044     Ned Williamson discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2021-21117     Rory McNamara discovered a policy enforcement issue in     Cryptohome.

  - CVE-2021-21118     Tyler Nighswander discovered a data validation issue in     the v8 JavaScript library.

  - CVE-2021-21119     A use-after-free issue was discovered in media handling.

  - CVE-2021-21120     Nan Wang and Guang Gong discovered a use-after-free     issue in the WebSQL implementation.

  - CVE-2021-21121     Leecraso and Guang Gong discovered a use-after-free     issue in the Omnibox.

  - CVE-2021-21122     Renata Hodovan discovered a use-after-free issue in     Blink/WebKit.

  - CVE-2021-21123     Maciej Pulikowski discovered a data validation issue.

  - CVE-2021-21124     Chaoyang Ding discovered a use-after-free issue in the     speech recognizer.

  - CVE-2021-21125     Ron Masas discovered a policy enforcement issue.

  - CVE-2021-21126     David Erceg discovered a policy enforcement issue in     extensions.

  - CVE-2021-21127     Jasminder Pal Singh discovered a policy enforcement     issue in extensions.

  - CVE-2021-21128     Liang Dong discovered a buffer overflow issue in     Blink/WebKit.

  - CVE-2021-21129     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21130     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21131     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21132     David Erceg discovered an implementation error in the     developer tools.

  - CVE-2021-21133     wester0x01 discovered a policy enforcement issue.

  - CVE-2021-21134     wester0x01 discovered a user interface error.

  - CVE-2021-21135     ndevtk discovered an implementation error in the     Performance API.

  - CVE-2021-21136     Shiv Sahni, Movnavinothan V, and Imdad Mohammed     discovered a policy enforcement error.

  - CVE-2021-21137     bobbybear discovered an implementation error in the     developer tools.

  - CVE-2021-21138     Weipeng Jiang discovered a use-after-free issue in the     developer tools.

  - CVE-2021-21139     Jun Kokatsu discovered an implementation error in the     iframe sandbox.

  - CVE-2021-21140     David Manouchehri discovered uninitialized memory in the     USB implementation.

  - CVE-2021-21141     Maciej Pulikowski discovered a policy enforcement error.

  - CVE-2021-21142     Khalil Zhani discovered a use-after-free issue.

  - CVE-2021-21143     Allen Parker and Alex Morgan discovered a buffer     overflow issue in extensions.

  - CVE-2021-21144     Leecraso and Guang Gong discovered a buffer overflow     issue.

  - CVE-2021-21145     A use-after-free issue was discovered.

  - CVE-2021-21146     Alison Huffman and Choongwoo Han discovered a     use-after-free issue.

  - CVE-2021-21147     Roman Starkov discovered an implementation error in the     skia library.

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or an information leak.

For Debian 9 stretch, these problems have been fixed in version 1:78.7.0-1~deb9u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has firefox packages installed that are affected by multiple vulnerabilities:

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. This vulnerability affects Firefox <     85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects     Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23954)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox     ESR < 78.7. (CVE-2021-23960)

  - Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and     Firefox ESR < 78.7. (CVE-2021-23964)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If that's not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,     and the content of that error may have revealed information about the resource. This vulnerability affects     Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. (CVE-2021-23973)

  - Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and     Firefox ESR < 78.8. (CVE-2021-23978)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote host is prior to 88.0.4324.96. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_01_stable-channel-update-for-desktop_19 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144909	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2021:0080-1)	Nessus	SuSE Local Security Checks	1/13/2021	1/30/2024	high
144832	GLSA-202101-04 : Mozilla Firefox: Remote code execution	Nessus	Gentoo Local Security Checks	1/11/2021	1/30/2024	high
144937	RHEL 8 : thunderbird (RHSA-2021:0089)	Nessus	Red Hat Local Security Checks	1/13/2021	4/28/2024	high
144848	RHEL 8 : firefox (RHSA-2021:0054)	Nessus	Red Hat Local Security Checks	1/11/2021	4/28/2024	high
145391	Fedora 33 : chromium (2021-48866282e5)	Nessus	Fedora Local Security Checks	1/25/2021	1/26/2024	critical
145448	Microsoft Edge (Chromium) < 88.0.705.50 Multiple Vulnerabilities	Nessus	Windows	1/26/2021	1/26/2024	critical
145485	openSUSE Security Update : chromium (openSUSE-2021-166)	Nessus	SuSE Local Security Checks	1/27/2021	1/26/2024	critical
146318	Debian DSA-4846-1 : chromium - security update	Nessus	Debian Local Security Checks	2/9/2021	1/22/2024	critical
146155	Debian DLA-2541-1 : thunderbird security update	Nessus	Debian Local Security Checks	2/4/2021	1/24/2024	high
154451	NewStart CGSL CORE 5.05 / MAIN 5.05 : firefox Multiple Vulnerabilities (NS-SA-2021-0178)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	10/27/2021	high
701297	Google Chrome < 88.0.4324.96 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/19/2021	1/19/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

critical

critical

critical

high

high

high