Mozilla Firefox < 21.0 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 6828

Synopsis

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Description

Versions of Firefox prior to 21.0 are potentially affected by the following security issues :

- An outdated MozillaMaintenance Service registry entry can trigger a trusted path privilege escalation (CVE-2013-1673)
- An unspecified arbitrary code execution vulnerability within update service (CVE-2012-1942)
- An arbitrary code execution vulnerability in Mozilla Maintenance Service with junctions (CVE-2013-1672)
- Multiple memory corruption vulnerabilities exist that can lead to code execution (CVE-2013-0801, CVE-2013-1669)
- The Chrome Object Wrapper (COW) does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (CVE-2013-1670)
- File input control can disclose full path information, leading to information leakage that can be used for further attacks (CVE-2013-1671)
- Some DOMSVGZoomEvent functions are used without being properly initialized, which can lead to information leakage in certain cases. (CVE-2013-1675)
- A series of use-after-free, out of bounds read, and invalid write problems can be exploited for remote code execution (CVE-2013-1674, CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Solution

Upgrade to Firefox 21.0 or later.

Plugin Details

Severity: High

ID: 6828

Family: Web Clients

Published: 5/16/2013

Updated: 3/6/2019

Nessus ID: 66442, 66449, 66480, 66600, 66766

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Patch Publication Date: 5/14/2013

Vulnerability Publication Date: 5/14/2013

Reference Information

CVE: CVE-2013-0801, CVE-2013-1669, CVE-2013-1670, CVE-2013-1671, CVE-2013-1672, CVE-2013-1673, CVE-2013-1674, CVE-2013-1675, CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681

BID: 59855, 59858, 59859, 59860, 59861, 59862, 59863, 59864, 59865, 59868, 59869, 59870, 59872, 59873

Detections

Analytics