The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:2663 advisory.

  - firefox: stored passwords in 'Saved Logins' can be copied without master password entry (CVE-2019-11733)

  - Mozilla: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1 (CVE-2019-11735)

  - Mozilla: Content security policy bypass through hash-based sources in directives (CVE-2019-11738)

  - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, Firefox ESR 60.9, Thunderbird 68.1, and     Thunderbird 60.9 (CVE-2019-11740)

  - Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images     (CVE-2019-11742)

  - Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

  - Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

  - Mozilla: Use-after-free while manipulating video (CVE-2019-11746)

  - Mozilla: 'Forget about this site' removes sites from pre-loaded HSTS list (CVE-2019-11747)

  - Mozilla: Persistence of WebRTC permissions in a third party context (CVE-2019-11748)

  - Mozilla: Camera information available without prompting using getUserMedia (CVE-2019-11749)

  - Mozilla: Type confusion in Spidermonkey (CVE-2019-11750)

  - Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

  - Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Mozilla Foundation reports :

CVE-2019-11751: Malicious code execution through command line parameters

CVE-2019-11746: Use-after-free while manipulating video

CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML

CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images

CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service

CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location

CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB

CVE-2019-9812: Sandbox escape through Firefox Sync

CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com

CVE-2019-11743: Cross-origin access to unload event attributes

CVE-2019-11748: Persistence of WebRTC permissions in a third party context

CVE-2019-11749: Camera information available without prompting using getUserMedia

CVE-2019-5849: Out-of-bounds read in Skia

CVE-2019-11750: Type confusion in Spidermonkey

CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard

CVE-2019-11738: Content security policy bypass through hash-based sources in directives

CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list

CVE-2019-11734: Memory safety bugs fixed in Firefox 69

CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1

CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9

This update for MozillaFirefox to 68.1 fixes the following issues :

Security issues fixed :

CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)

CVE-2019-9812: Fixed a sandbox escape through Firefox Sync.
(bsc#1149294)

CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)

CVE-2019-11714: Fixed a potentially exploitable crash in Necko.
(bsc#1140868)

CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)

CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)

CVE-2019-11720: Fixed a character encoding XSS vulnerability.
(bsc#1140868)

CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)

CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)

CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)

CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets.
(bsc#1140868)

CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3.
(bsc#1141322)

CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)

CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)

CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)

CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)

CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)

CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)

CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)

CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)

CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)

CVE-2019-11746: Fixed a use-after-free while manipulating video.
(bsc#1149297)

CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)

CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed: Latest update now also released for s390x.
(bsc#1109465)

Fixed a segmentation fault on s390vsl082. (bsc#1117473)

Fixed a crash on SLES15 s390x. (bsc#1124525)

Fixed a segmentation fault. (bsc#1133810)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
145625	CentOS 8 : firefox (CESA-2019:2663)	Nessus	CentOS Local Security Checks	2021/1/29	2024/1/25	critical
128491	FreeBSD : mozilla -- multiple vulnerabilities (05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6)	Nessus	FreeBSD Local Security Checks	2019/9/4	2024/4/29	critical
129583	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2019:2545-1)	Nessus	SuSE Local Security Checks	2019/10/4	2024/4/19	critical
147407	NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2023/4/25	critical

检测

插件搜索

critical

critical

critical

critical