The remote host is affected by the vulnerability described in GLSA-202104-10 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of Firefox installed on the remote Windows host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory.

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

  - By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could     have been applied, resulting in memory corruption and a potentially exploitable crash. (CVE-2021-23983)

  - A malicious extension could have opened a popup window lacking an address bar. The title of the popup     lacking an address bar should not be fully controllable, but in this situation was. This could have been     used to spoof a website and attempt to trick the user into providing credentials. (CVE-2021-23984)

  - If an attacker is able to alter specific about:config values (for example malware running on the user's     computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to     the user. This would have allowed a remote attacker (able to make a direct network connection to the     victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by     providing a visual cue when Devtools has an open network socket. (CVE-2021-23985)

  - A malicious extension with the 'search' permission could have installed a new search engine whose favicon     referenced a cross-origin URL.  The response to this cross-origin request could have been read by the     extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin     permissions.  This cross-origin request was made without cookies, so the sensitive information disclosed     by the violation was limited to local-network resources or resources that perform IP-based authentication.
    (CVE-2021-23986)

  - Mozilla developers and community members Matthew Gregan, Tyson Smith, Julien Wajsberg, and Alexis     Beingessner reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2021-23987)

  - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2021-23988)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory.

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

  - By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could     have been applied, resulting in memory corruption and a potentially exploitable crash. (CVE-2021-23983)

  - A malicious extension could have opened a popup window lacking an address bar. The title of the popup     lacking an address bar should not be fully controllable, but in this situation was. This could have been     used to spoof a website and attempt to trick the user into providing credentials. (CVE-2021-23984)

  - If an attacker is able to alter specific about:config values (for example malware running on the user's     computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to     the user. This would have allowed a remote attacker (able to make a direct network connection to the     victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by     providing a visual cue when Devtools has an open network socket. (CVE-2021-23985)

  - A malicious extension with the 'search' permission could have installed a new search engine whose favicon     referenced a cross-origin URL.  The response to this cross-origin request could have been read by the     extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin     permissions.  This cross-origin request was made without cookies, so the sensitive information disclosed     by the violation was limited to local-network resources or resources that perform IP-based authentication.
    (CVE-2021-23986)

  - Mozilla developers and community members Matthew Gregan, Tyson Smith, Julien Wajsberg, and Alexis     Beingessner reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2021-23987)

  - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2021-23988)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4893-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
149233	GLSA-202104-10 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/3/2021	1/12/2024	high
148014	Mozilla Firefox < 87.0	Nessus	Windows	3/23/2021	6/3/2021	high
148015	Mozilla Firefox < 87.0	Nessus	MacOS X Local Security Checks	3/23/2021	6/3/2021	high
148135	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4893-1)	Nessus	Ubuntu Local Security Checks	3/26/2021	10/16/2023	high

Detections

Analytics

Plugins Search

high

high

high

high