A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Firefox < 58.

The remote NewStart CGSL host, running version MAIN 4.05, has firefox packages installed that are affected by multiple vulnerabilities:

  - Memory safety bugs were reported in Firefox 58 and     Firefox ESR 52.6. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Thunderbird < 52.7,     Firefox ESR < 52.7, and Firefox < 59. (CVE-2018-5125)

  - A buffer overflow can occur when manipulating the SVG     animatedPathSegList through script. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.7, Firefox ESR < 52.7, and     Firefox < 59. (CVE-2018-5127)

  - A lack of parameter validation on IPC messages results     in a potential out-of-bounds write through malformed IPC     messages. This can potentially allow for sandbox escape     through memory corruption in the parent process. This     vulnerability affects Thunderbird < 52.7, Firefox ESR <     52.7, and Firefox < 59. (CVE-2018-5129)

  - When packets with a mismatched RTP payload type are sent     in WebRTC connections, in some circumstances a     potentially exploitable crash is triggered. This     vulnerability affects Firefox ESR < 52.7 and Firefox <     59. (CVE-2018-5130)

  - Under certain circumstances the fetch() API can return     transient local copies of resources that were sent with     a no-store or no-cache cache header instead of     downloading a copy from the network as it should. This     can result in previously stored, locally cached data of     a website being accessible to users if they share a     common profile while browsing. This vulnerability     affects Firefox ESR < 52.7 and Firefox < 59.
    (CVE-2018-5131)

  - An integer overflow can occur during conversion of text     to some Unicode character sets due to an unchecked     length parameter. This vulnerability affects Firefox ESR     < 52.7 and Thunderbird < 52.7. (CVE-2018-5144)

  - Memory safety bugs were reported in Firefox ESR 52.6.
    These bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could     be exploited to run arbitrary code. This vulnerability     affects Firefox ESR < 52.7 and Thunderbird < 52.7.
    (CVE-2018-5145)

  - Memory safety bugs were reported in Firefox 57 and     Firefox ESR 52.5. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Thunderbird < 52.6,     Firefox ESR < 52.6, and Firefox < 58. (CVE-2018-5089)

  - A use-after-free vulnerability can occur during WebRTC     connections when interacting with the DTMF timers. This     results in a potentially exploitable crash. This     vulnerability affects Firefox ESR < 52.6 and Firefox <     58. (CVE-2018-5091)

  - An integer overflow vulnerability in the Skia library     when allocating memory for edge builders on some systems     with at least 8 GB of RAM. This results in the use of     uninitialized memory, resulting in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox <     58. (CVE-2018-5095)

  - A use-after-free vulnerability can occur while editing     events in form elements on a page, resulting in a     potentially exploitable crash. This vulnerability     affects Firefox ESR < 52.6 and Thunderbird < 52.6.
    (CVE-2018-5096)

  - A use-after-free vulnerability can occur during XSL     transformations when the source document for the     transformation is manipulated by script content during     the transformation. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox <     58. (CVE-2018-5097)

  - A use-after-free vulnerability can occur when form input     elements, focus, and selections are manipulated by     script content. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox <     58. (CVE-2018-5098)

  - A use-after-free vulnerability can occur when the widget     listener is holding strong references to browser objects     that have previously been freed, resulting in a     potentially exploitable crash when these references are     used. This vulnerability affects Thunderbird < 52.6,     Firefox ESR < 52.6, and Firefox < 58. (CVE-2018-5099)

  - A use-after-free vulnerability can occur when     manipulating HTML media elements with media streams,     resulting in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.6, Firefox ESR <     52.6, and Firefox < 58. (CVE-2018-5102)

  - A use-after-free vulnerability can occur during mouse     event handling due to issues with multiprocess support.
    This results in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.6, Firefox ESR <     52.6, and Firefox < 58. (CVE-2018-5103)

  - A use-after-free vulnerability can occur during font     face manipulation when a font face is freed while still     in use, resulting in a potentially exploitable crash.
    This vulnerability affects Thunderbird < 52.6, Firefox     ESR < 52.6, and Firefox < 58. (CVE-2018-5104)

  - If right-to-left text is used in the addressbar with     left-to-right alignment, it is possible in some     circumstances to scroll this text to spoof the displayed     URL. This issue could result in the wrong URL being     displayed as a location, which can mislead users to     believe they are on a different site than the one     loaded. This vulnerability affects Thunderbird < 52.6,     Firefox ESR < 52.6, and Firefox < 58. (CVE-2018-5117)

  - An out of bounds write flaw was found in the processing     of vorbis audio data. A maliciously crafted file or     audio stream could cause the application to crash or,     potentially, execute arbitrary code. (CVE-2018-5146)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has firefox packages installed that are affected by multiple vulnerabilities:

  - Memory safety bugs were reported in Firefox 58 and     Firefox ESR 52.6. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Thunderbird < 52.7,     Firefox ESR < 52.7, and Firefox < 59. (CVE-2018-5125)

  - A buffer overflow can occur when manipulating the SVG     animatedPathSegList through script. This results in a     potentially exploitable crash. This vulnerability     affects Thunderbird < 52.7, Firefox ESR < 52.7, and     Firefox < 59. (CVE-2018-5127)

  - A lack of parameter validation on IPC messages results     in a potential out-of-bounds write through malformed IPC     messages. This can potentially allow for sandbox escape     through memory corruption in the parent process. This     vulnerability affects Thunderbird < 52.7, Firefox ESR <     52.7, and Firefox < 59. (CVE-2018-5129)

  - When packets with a mismatched RTP payload type are sent     in WebRTC connections, in some circumstances a     potentially exploitable crash is triggered. This     vulnerability affects Firefox ESR < 52.7 and Firefox <     59. (CVE-2018-5130)

  - Under certain circumstances the fetch() API can return     transient local copies of resources that were sent with     a no-store or no-cache cache header instead of     downloading a copy from the network as it should. This     can result in previously stored, locally cached data of     a website being accessible to users if they share a     common profile while browsing. This vulnerability     affects Firefox ESR < 52.7 and Firefox < 59.
    (CVE-2018-5131)

  - An integer overflow can occur during conversion of text     to some Unicode character sets due to an unchecked     length parameter. This vulnerability affects Firefox ESR     < 52.7 and Thunderbird < 52.7. (CVE-2018-5144)

  - Memory safety bugs were reported in Firefox ESR 52.6.
    These bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could     be exploited to run arbitrary code. This vulnerability     affects Firefox ESR < 52.7 and Thunderbird < 52.7.
    (CVE-2018-5145)

  - Memory safety bugs were reported in Firefox 57 and     Firefox ESR 52.5. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Thunderbird < 52.6,     Firefox ESR < 52.6, and Firefox < 58. (CVE-2018-5089)

  - A use-after-free vulnerability can occur during WebRTC     connections when interacting with the DTMF timers. This     results in a potentially exploitable crash. This     vulnerability affects Firefox ESR < 52.6 and Firefox <     58. (CVE-2018-5091)

  - An integer overflow vulnerability in the Skia library     when allocating memory for edge builders on some systems     with at least 8 GB of RAM. This results in the use of     uninitialized memory, resulting in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox <     58. (CVE-2018-5095)

  - A use-after-free vulnerability can occur while editing     events in form elements on a page, resulting in a     potentially exploitable crash. This vulnerability     affects Firefox ESR < 52.6 and Thunderbird < 52.6.
    (CVE-2018-5096)

  - A use-after-free vulnerability can occur during XSL     transformations when the source document for the     transformation is manipulated by script content during     the transformation. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox <     58. (CVE-2018-5097)

  - A use-after-free vulnerability can occur when form input     elements, focus, and selections are manipulated by     script content. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox <     58. (CVE-2018-5098)

  - A use-after-free vulnerability can occur when the widget     listener is holding strong references to browser objects     that have previously been freed, resulting in a     potentially exploitable crash when these references are     used. This vulnerability affects Thunderbird < 52.6,     Firefox ESR < 52.6, and Firefox < 58. (CVE-2018-5099)

  - A use-after-free vulnerability can occur when     manipulating HTML media elements with media streams,     resulting in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.6, Firefox ESR <     52.6, and Firefox < 58. (CVE-2018-5102)

  - A use-after-free vulnerability can occur during mouse     event handling due to issues with multiprocess support.
    This results in a potentially exploitable crash. This     vulnerability affects Thunderbird < 52.6, Firefox ESR <     52.6, and Firefox < 58. (CVE-2018-5103)

  - A use-after-free vulnerability can occur during font     face manipulation when a font face is freed while still     in use, resulting in a potentially exploitable crash.
    This vulnerability affects Thunderbird < 52.6, Firefox     ESR < 52.6, and Firefox < 58. (CVE-2018-5104)

  - If right-to-left text is used in the addressbar with     left-to-right alignment, it is possible in some     circumstances to scroll this text to spoof the displayed     URL. This issue could result in the wrong URL being     displayed as a location, which can mislead users to     believe they are on a different site than the one     loaded. This vulnerability affects Thunderbird < 52.6,     Firefox ESR < 52.6, and Firefox < 58. (CVE-2018-5117)

  - An out of bounds write flaw was found in the processing     of vorbis audio data. A maliciously crafted file or     audio stream could cause the application to crash or,     potentially, execute arbitrary code. (CVE-2018-5146)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Versions of Mozilla Firefox ESR earlier than 52.6 are unpatched for the following vulnerabilities :

 - An integer overflow that is triggered when allocating memory for edge builders. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when the source document for XSL transformation is manipulated by script content during the transformation. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'layout/forms/nsNumberControlFrame.cpp' that is triggered when handling form input elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the widget listener. The issue is triggered when holding strong references to browser objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'dom/html/HTMLMediaElement.cpp' that is triggered when handling specially crafted HTML media elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'EventStateManager::DispatchMouseOrPointerEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouse events. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling font faces. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in 'browser/base/content/browser.js' that is triggered when right-to-left text is used in the address bar with left-to-right alignment. This may allow a context-dependent attacker to spoof the URL bar.
 - A use-after-free error exists that is triggered when WebRTC connections interact with DTMF timers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when editing events in form elements on a page. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readV1ArrayBuffer()' function in 'js/src/vm/StructuredClone.cpp' that is triggered when deserializing invalid typed arrays. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'MediaEngineDefaultVideoSource::Allocate()' function in 'dom/media/webrtc/MediaEngineDefault.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'toolkit/components/places/History.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCookieService::RemoveCookiesWithOriginAttributes()' function in 'netwerk/cookie/nsCookieService.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the Skia component that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'startupcache/StartupCache.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/media/GraphDriver.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebrtcGmpVideoDecoder::ReleaseGmp()' function in 'media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/base/DirectionalityUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCookieService::PurgeCookies()' function in 'netwerk/cookie/nsCookieService.cpp' that is triggered when handling cookie expiry. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified race condition exists in 'modules/libjar/nsJAR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified race condition exists in 'netwerk/base/AutoClose.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'js/src/vm/StructuredClone.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.

Versions of Mozilla Firefox earlier than 58 are unpatched for the following vulnerabilities :

 - An out-of-bounds read flaw exists in the 'js::WasmTableObject::getImpl()' function. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
 - An overflow condition exists in the 'ShiftFromList()' function in 'js/src/vm/List-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow and potentially execute arbitrary code.
 - A flaw exists in 'gfx/2d/Filters.h' related to missing thread safety. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the JavaScript just-in-time (JIT) compiler that is triggered when handling call stacks. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated when handling TypeScripts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'AppendToList()' function in 'js/src/vm/List-inl.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CalcTableChecksum()' function in 'gfx/2d/ScaledFontMac.cpp' that is triggered when handling checksums that are not 4-byte aligned. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'HttpChannelChild::Release()' function in 'netwerk/protocol/http/HttpChannelChild.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebrtcVideoConduit::VideoStreamFactory::CreateEncoderStreams()' function in 'media/webrtc/signaling/src/media-conduit/VideoConduit.cpp' that is triggered as certain input is not properly validated when handling temporal layers for screencasts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'dom/media/MediaDecoderStateMachine.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ParseFTPList()' function in 'netwerk/streamconv/converters/ParseFTPList.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the accessibility component related to use of uninitialized memory. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists related to use of uninitialized memory when handling cocoa widgets. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the security manager component related to use of uninitialized memory. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An integer overflow that is triggered when allocating memory for edge builders. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when the source document for XSL transformation is manipulated by script content during the transformation. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'layout/forms/nsNumberControlFrame.cpp' that is triggered when handling form input elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the widget listener. The issue is triggered when holding strong references to browser objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsIDocument::IsPotentiallyScrollable()' function in 'dom/base/nsDocument.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsCSSFrameConstructor::CreateLetterFrame()' function in 'layout/base/nsCSSFrameConstructor.cpp' that is triggered when manipulating floating first-letter style elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'dom/html/HTMLMediaElement.cpp' that is triggered when handling specially crafted HTML media elements. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'EventStateManager::DispatchMouseOrPointerEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling mouse events. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling font faces. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in WebExtensions that may allow a context-dependent attacker to bypass user prompts and save and execute downloaded files without user confirmation.
 - A flaw exists that is triggered when a user selects error exists links when tools are open. This may allow a context-dependent attacker to cause style editor traffic in the Developer Tools to be routed through a service worker hosted on a third party website, potentially disclosing sensitive cross-origin information.
 - A flaw exists as the printing process creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against a file to cause the program to unexpectedly disclose arbitrary files.
 - A flaw exists in 'dom/file/nsHostObjectProtocolHandler.cpp' that is triggered during the handling of certain manually entered blob URLs. This may allow a context-dependent attacker to gain access to potentially sensitive information from private browsing.
 - A flaw exists in the 'MediaManager::GetUserMedia()' function in 'dom/media/MediaManager.cpp'. This may allow a context-dependent attacker to spoof the origin of audio prompts.
 - A flaw exists that is triggered when cursor visibility is toggled back and forth from 'none' to an image via a script. This may allow a context-dependent attacker to cause the cursor to be rendered invisibly.
 - A flaw exists that is triggered during the handling of a specially formatted URL that is dragged to the address bar from page content. This may allow a context-dependent attacker to spoof the URL bar.
 - A flaw exists in the developement tool panels of an extension that may allow a context-dependent attacker to bypass restrictions and load non-relative URLS, which may potentially include privileged pages.
 - A flaw exists in the 'browser.identity'.'launchWebAuthFlow()' function in WebExtensions that is triggered as HTTPS content loading restrictions are not properly honored. This may allow a context-dependent attacker to load content over an HTTP connection.
 - A flaw exists that is triggered when changing a cookie to HttpOnly when a document is open. This can cause the cookie to remain accessible until the document is closed.
 - A flaw exists that is due to program displaying HTTP authentication prompts from background pages over the currently loaded foreground page. This may allow a context-dependent attacker to potentially spoof the originating page of an authentication prompt.
 - A flaw exists in WebExtensions with the ActiveTab permission that may allow a context-dependent attacker to inject frames from arbitrary origins into the loaded page and gain access to arbitrary frame content.
 - A flaw exists in 'browser/base/content/browser.js' that is triggered when right-to-left text is used in the address bar with left-to-right alignment. This may allow a context-dependent attacker to spoof the URL bar.
 - A flaw exists in the Activity Stream page that is triggered as it may improperly create images via the file: URL. This may allow a context-dependent attacker to gain access to potentially sensitive local information.
 - A flaw exists in the reader view that can allow a context-dependent attacker to bypass CORS header restrictions and view cross-origin content that should be prohibited from loading.
 - A flaw exists in 'browser/themes/osx/browser.css' that is triggered when rendering Tibetan characters in several unspecified fonts. This may allow a context-dependent attacker to spoof a valid domain name.
 - An integer overflow in the 'DoCrypt()' function in 'dom/crypto/WebCryptoTask.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when WebRTC connections interact with DTMF timers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling threads for web workers. This may allowa context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when editing events in form elements on a page. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'JSStructuredCloneReader::readV1ArrayBuffer()' function in 'js/src/vm/StructuredClone.cpp' that is triggered when deserializing invalid typed arrays. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCookieService::RemoveCookiesWithOriginAttributes()' function in 'netwerk/cookie/nsCookieService.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'WebrtcGmpVideoDecoder::ReleaseGmp()' function in 'media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsCookieService::PurgeCookies()' function in 'netwerk/cookie/nsCookieService.cpp' that is triggered when handling cookie expiry. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified race condition exists in 'modules/libjar/nsJAR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified race condition exists in 'netwerk/base/AutoClose.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the browser UI that is triggered when handling specially crafted HTML fragments. This may allow a context-dependent attacker to potentially execute arbitrary code.

 - Mutliple vulnerabilities in the following may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code:
 - 'media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp'
 - 'gfx/thebes/gfxPlatformFontList.cpp'
 - 'dom/media/systemservices/CamerasChild.cpp'
 - 'dom/media/MediaDecoder.cpp'
 - 'js/src/gc/Zone.h'
 - 'js/src/jsfun.h'
 - 'dom/plugins/ipc/PluginMessageUtils.cpp'
 - 'ipc/glue/IPCMessageUtils.h'
 - 'dom/media/webrtc/MediaEngineDefault.cpp'
 - 'toolkit/components/places/History.cpp'
 - 'startupcache/StartupCache.cpp'
 - 'dom/media/GraphDriver.cpp'
 - 'media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.h'
 - 'dom/base/DirectionalityUtils.cpp'
 - 'media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp'
 - 'js/src/vm/StructuredClone.cpp'

The remote host is affected by the vulnerability described in GLSA-201802-03 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page, possibly resulting in the execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to perform Man-in-the-Middle attacks,       obtain sensitive information, spoof the address bar, conduct clickjacking       attacks, bypass security restrictions and protection mechanisms, or have       other unspecified impact.
  Workaround :

    There is no known workaround at this time.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox. (CVE-2018-5089, CVE-2018-5091,     CVE-2018-5095, CVE-2018-5096, CVE-2018-5097,     CVE-2018-5098, CVE-2018-5099, CVE-2018-5102,     CVE-2018-5103, CVE-2018-5104, CVE-2018-5117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox to version 52.6 several issues. These security issues were fixed :

  - CVE-2018-5091: Use-after-free with DTMF timers     (bsc#1077291).

  - CVE-2018-5095: Integer overflow in Skia library during     edge builder allocation (bsc#1077291).

  - CVE-2018-5096: Use-after-free while editing form     elements (bsc#1077291).

  - CVE-2018-5097: Use-after-free when source document is     manipulated during XSLT (bsc#1077291).

  - CVE-2018-5098: Use-after-free while manipulating form     input elements (bsc#1077291).

  - CVE-2018-5099: Use-after-free with widget listener     (bsc#1077291).

  - CVE-2018-5104: Use-after-free during font face     manipulation (bsc#1077291).

  - CVE-2018-5089: Fixed several memory safety bugs     (bsc#1077291).

  - CVE-2018-5117: URL spoofing with right-to-left text     aligned left-to-right (bsc#1077291).

  - CVE-2018-5102: Use-after-free in HTML media elements     (bsc#1077291).

  - CVE-2018-5103: Use-after-free during mouse event     handling (bsc#1077291).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox to version ESR 52.6 fixes several issues. These security issues were fixed :

  - CVE-2018-5091: Use-after-free with DTMF timers     (bsc#1077291).

  - CVE-2018-5095: Integer overflow in Skia library during     edge builder allocation (bsc#1077291).

  - CVE-2018-5096: Use-after-free while editing form     elements (bsc#1077291).

  - CVE-2018-5097: Use-after-free when source document is     manipulated during XSLT (bsc#1077291).

  - CVE-2018-5098: Use-after-free while manipulating form     input elements (bsc#1077291).

  - CVE-2018-5099: Use-after-free with widget listener     (bsc#1077291).

  - CVE-2018-5102: Use-after-free in HTML media elements     (bsc#1077291).

  - CVE-2018-5103: Use-after-free during mouse event     handling (bsc#1077291).

  - CVE-2018-5104: Use-after-free during font face     manipulation (bsc#1077291).

  - CVE-2018-5117: URL spoofing with right-to-left text     aligned left-to-right (bsc#1077291).

  - CVE-2018-5089: Various memory safety bugs (bsc#1077291).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or URL spoofing.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3544-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via application     crash, spoof the origin in audio capture prompts, trick the user in to providing HTTP credentials for     another origin, spoof the addressbar contents, or execute arbitrary code. (CVE-2018-5089, CVE-2018-5090,     CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095, CVE-2018-5097, CVE-2018-5098,     CVE-2018-5099, CVE-2018-5100, CVE-2018-5101, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5109,     CVE-2018-5114, CVE-2018-5115, CVE-2018-5117, CVE-2018-5122)

    Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a     specially crafted extension, an attacker could potentially exploit these to gain additional privileges,     bypass same-origin restrictions, or execute arbitrary code. (CVE-2018-5105, CVE-2018-5113, CVE-2018-5116)

    A security issue was discovered with the developer tools. If a user were tricked in to opening a specially     crafted website with the developer tools open, an attacker could potentially exploit this to obtain     sensitive information from other origins. (CVE-2018-5106)

    A security issue was discovered with printing. An attacker could potentially exploit this to obtain     sensitive information from local files. (CVE-2018-5107)

    It was discovered that manually entered blob URLs could be accessed by subsequent private browsing tabs.
    If a user were tricked in to entering a blob URL, an attacker could potentially exploit this to obtain     sensitive information from a private browsing context. (CVE-2018-5108)

    It was discovered that dragging certain specially formatted URLs to the addressbar could cause the wrong     URL to be displayed. If a user were tricked in to opening a specially crafted website and dragging a URL     to the addressbar, an attacker could potentially exploit this to spoof the addressbar contents.
    (CVE-2018-5111)

    It was discovered that WebExtension developer tools panels could open non-relative URLs. If a user were     tricked in to installing a specially crafted extension and running the developer tools, an attacker could     potentially exploit this to gain additional privileges. (CVE-2018-5112)

    It was discovered that ActivityStream images can attempt to load local content through file: URLs. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in     combination with another vulnerability that allowed sandbox protections to be bypassed, in order to obtain     sensitive information from local files. (CVE-2018-5118)

    It was discovered that the reader view will load cross-origin content in violation of CORS headers. An     attacker could exploit this to bypass CORS restrictions. (CVE-2018-5119)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update upgrades Firefox to version 52.6.0 ESR.

Security Fix(es) :

  - Multiple flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Firefox to crash or, potentially, execute     arbitrary code with the privileges of the user running     Firefox. (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095,     CVE-2018-5096, CVE-2018-5097, CVE-2018-5098,     CVE-2018-5099, CVE-2018-5102, CVE-2018-5103,     CVE-2018-5104, CVE-2018-5117)

  - To mitigate timing-based side-channel attacks similar to     'Spectre' and 'Meltdown', the resolution of     performance.now() has been reduced from 5s to 20s.

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:0122 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6 (MFSA 2018-03) (CVE-2018-5089)

  - Mozilla: Use-after-free with DTMF timers (MFSA 2018-03) (CVE-2018-5091)

  - Mozilla: Integer overflow in Skia library during edge builder allocation (MFSA 2018-03) (CVE-2018-5095)

  - Mozilla: Use-after-free while editing form elements (MFSA 2018-03) (CVE-2018-5096)

  - Mozilla: Use-after-free when source document is manipulated during XSLT (MFSA 2018-03) (CVE-2018-5097)

  - Mozilla: Use-after-free while manipulating form input elements (MFSA 2018-03) (CVE-2018-5098)

  - Mozilla: Use-after-free with widget listener (MFSA 2018-03) (CVE-2018-5099)

  - Mozilla: Use-after-free in HTML media elements (MFSA 2018-03) (CVE-2018-5102)

  - Mozilla: Use-after-free during mouse event handling (MFSA 2018-03) (CVE-2018-5103)

  - Mozilla: Use-after-free during font face manipulation (MFSA 2018-03) (CVE-2018-5104)

  - Mozilla: URL spoofing with right-to-left text aligned left-to-right (MFSA 2018-03) (CVE-2018-5117)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-0122 advisory.

    [52.6.0-1.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one
    - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484]

    [52.6.0-1]
    - Update to 52.6.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

  - update to Firefox 52.6esr (boo#1077291) MFSA 2018-01

  - Speculative execution side-channel attack ('Spectre')     MFSA 2018-03

  - CVE-2018-5091 (bmo#1423086) Use-after-free with DTMF     timers

  - CVE-2018-5095 (bmo#1418447) Integer overflow in Skia     library during edge builder allocation

  - CVE-2018-5096 (bmo#1418922) Use-after-free while editing     form elements

  - CVE-2018-5097 (bmo#1387427) Use-after-free when source     document is manipulated during XSLT

  - CVE-2018-5098 (bmo#1399400) Use-after-free while     manipulating form input elements

  - CVE-2018-5099 (bmo#1416878) Use-after-free with widget     listener

  - CVE-2018-5102 (bmo#1419363) Use-after-free in HTML media     elements

  - CVE-2018-5103 (bmo#1423159) Use-after-free during mouse     event handling

  - CVE-2018-5104 (bmo#1425000) Use-after-free during font     face manipulation

  - CVE-2018-5117 (bmo#1395508) URL spoofing with     right-to-left text aligned left-to-right

  - CVE-2018-5089 Memory safety bugs fixed in Firefox 58 and     Firefox ESR 52.6

  - Added additional patches and configurations to fix     builds on s390 and PowerPC.

  - Added firefox-glibc-getrandom.patch effecting builds on     s390 and PowerPC

  - Added mozilla-s390-bigendian.patch along with     icudt58b.dat bigendian ICU data file for running Firefox     on bigendian architectures (bmo#1322212 and bmo#1264836)

  - Added mozilla-s390-nojit.patch to enable atomic     operations used by the JS engine when JIT is disabled on     s390

  - Build configuration options specific to s390

  - Requires NSS >= 3.29.5

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, integer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service or URL spoofing.

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 52.6.0esr-1~deb7u1.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for firefox is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 52.6.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117)

* To mitigate timing-based side-channel attacks similar to 'Spectre' and 'Meltdown', the resolution of performance.now() has been reduced from 5ms to 20ms.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Jason Kratzer, Marcia Knous, Nathan Froyd, Oriol Brufau, Ronald Crane, Randell Jesup, Tyson Smith, Cobos Alvarez, Ryan VanderMeulen, Sebastian Hengst, Karl Tomlinson, Xidorn Quan, Ludovic Hirlimann, Jason Orendorff, Looben Yang, Anonymous, Nils, and Xisigr as the original reporters.

The version of Mozilla Firefox installed on the remote Windows host is prior to 58. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 52.6. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 58. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.6. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes.

Mozilla Foundation reports :

CVE-2018-5091: Use-after-free with DTMF timers

CVE-2018-5092: Use-after-free in Web Workers

CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing

CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory

CVE-2018-5095: Integer overflow in Skia library during edge builder allocation

CVE-2018-5097: Use-after-free when source document is manipulated during XSLT

CVE-2018-5098: Use-after-free while manipulating form input elements

CVE-2018-5099: Use-after-free with widget listener

CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory

CVE-2018-5101: Use-after-free with floating first-letter style elements

CVE-2018-5102: Use-after-free in HTML media elements

CVE-2018-5103: Use-after-free during mouse event handling

CVE-2018-5104: Use-after-free during font face manipulation

CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts

CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker

CVE-2018-5107: Printing process will follow symlinks for local file access

CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs

CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution

CVE-2018-5110: Cursor can be made invisible on OS X

CVE-2018-5111: URL spoofing in addressbar through drag and drop

CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel

CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow

CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts

CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs

CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access

CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right

CVE-2018-5118: Activity Stream images can attempt to load local content through file :

CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers

CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar

CVE-2018-5122: Potential integer overflow in DoCrypt

CVE-2018-5090: Memory safety bugs fixed in Firefox 58

CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6

ID	Name	Product	Family	Severity
127371	NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0124)	Nessus	NewStart CGSL Local Security Checks	critical
127160	NewStart CGSL MAIN 5.04 : firefox Multiple Vulnerabilities (NS-SA-2019-0011)	Nessus	NewStart CGSL Local Security Checks	critical
700334	Mozilla Firefox ESR < 52.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
700326	Mozilla Firefox < 58 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
106884	GLSA-201802-03 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
106772	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2018-1044)	Nessus	Huawei Local Security Checks	critical
106771	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2018-1043)	Nessus	Huawei Local Security Checks	critical
106654	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:0374-1)	Nessus	SuSE Local Security Checks	critical
106617	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2018:0361-1)	Nessus	SuSE Local Security Checks	critical
106509	Debian DSA-4102-1 : thunderbird - security update	Nessus	Debian Local Security Checks	critical
106347	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3544-1)	Nessus	Ubuntu Local Security Checks	critical
106337	Scientific Linux Security Update : firefox on SL6.x, SL7.x i386/x86_64 (20180124)	Nessus	Scientific Linux Local Security Checks	critical
106329	RHEL 6 / 7 : firefox (RHSA-2018:0122)	Nessus	Red Hat Local Security Checks	critical
106327	Oracle Linux 6 / 7 : firefox (ELSA-2018-0122)	Nessus	Oracle Linux Local Security Checks	critical
106324	openSUSE Security Update : MozillaFirefox (openSUSE-2018-85)	Nessus	SuSE Local Security Checks	critical
106320	Debian DSA-4096-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
106318	Debian DLA-1256-1 : firefox-esr security update	Nessus	Debian Local Security Checks	critical
106317	CentOS 6 / 7 : firefox (CESA-2018:0122)	Nessus	CentOS Local Security Checks	critical
106303	Mozilla Firefox < 58 Multiple Vulnerabilities	Nessus	Windows	critical
106302	Mozilla Firefox ESR < 52.6 Multiple Vulnerabilities	Nessus	Windows	critical
106301	Mozilla Firefox < 58 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
106300	Mozilla Firefox ESR < 52.6 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
106288	FreeBSD : mozilla -- multiple vulnerabilities (a891c5b4-3d7a-4de9-9c71-eef3fd698c77)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-5091

critical

Tenable Plugins

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical