Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension     in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain     sensitive information by sniffing the network during a session in which there was an incorrect decision to     accept a compromised and revoked certificate. (CVE-2014-8642)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required     character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout     CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP     response. (CVE-2013-6167)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject     stylesheets and bypass Content Security Policy (CSP). This vulnerability affects Firefox < 63.
    (CVE-2018-12398)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of Firefox installed on the remote Windows host is prior to 69.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-25 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 69.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-25 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4122-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to obtain sensitive information, bypass     Content Security Policy (CSP) protections, bypass same-origin restrictions, conduct cross-site scripting     (XSS) attacks, cause a denial of service, or execute arbitrary code. (CVE-2019-5849, CVE-2019-11734,     CVE-2019-11735, CVE-2019-11737, CVE-2019-11738, CVE-2019-11740, CVE-2019-11742, CVE-2019-11743,     CVE-2019-11744, CVE-2019-11746, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11752)

    It was discovered that a compromised content process could log in to a malicious Firefox Sync account. An     attacker could potentially exploit this, in combination with another vulnerability, to disable the     sandbox. (CVE-2019-9812)

    It was discovered that addons.mozilla.org and accounts.firefox.com could be loaded in to the same content     process. An attacker could potentially exploit this, in combination with another vulnerability that     allowed a cross-site scripting (XSS) attack, to modify browser settings. (CVE-2019-11741)

    It was discovered that the Forget about this site feature in the history pane removes HTTP Strict     Transport Security (HSTS) settings for sites on the pre-load list. An attacker could potentially exploit     this to bypass the protections offered by HSTS. (CVE-2019-11747)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Foundation reports :

CVE-2019-11751: Malicious code execution through command line parameters

CVE-2019-11746: Use-after-free while manipulating video

CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML

CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images

CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service

CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location

CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB

CVE-2019-9812: Sandbox escape through Firefox Sync

CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com

CVE-2019-11743: Cross-origin access to unload event attributes

CVE-2019-11748: Persistence of WebRTC permissions in a third party context

CVE-2019-11749: Camera information available without prompting using getUserMedia

CVE-2019-5849: Out-of-bounds read in Skia

CVE-2019-11750: Type confusion in Spidermonkey

CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard

CVE-2019-11738: Content security policy bypass through hash-based sources in directives

CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list

CVE-2019-11734: Memory safety bugs fixed in Firefox 69

CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1

CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2019-5805     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2019-5806     Wen Xu discovered an integer overflow issue in the Angle     library.

  - CVE-2019-5807     TimGMichaud discovered a memory corruption issue in the     v8 JavaScript library.

  - CVE-2019-5808     cloudfuzzer discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2019-5809     Mark Brand discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2019-5810     Mark Amery discovered an information disclosure issue.

  - CVE-2019-5811     Jun Kokatsu discovered a way to bypass the Cross-Origin     Resource Sharing feature.

  - CVE-2019-5813     Aleksandar Nikolic discovered an out-of-bounds read     issue in the v8 JavaScript library.

  - CVE-2019-5814     @AaylaSecura1138 discovered a way to bypass the     Cross-Origin Resource Sharing feature.

  - CVE-2019-5815     Nicolas Gregoire discovered a buffer overflow issue in     Blink/Webkit.

  - CVE-2019-5818     Adrian Tolbaru discovered an uninitialized value issue.

  - CVE-2019-5819     Svyat Mitin discovered an error in the developer tools.

  - CVE-2019-5820     pdknsk discovered an integer overflow issue in the     pdfium library.

  - CVE-2019-5821     pdknsk discovered another integer overflow issue in the     pdfium library.

  - CVE-2019-5822     Jun Kokatsu discovered a way to bypass the Cross-Origin     Resource Sharing feature.

  - CVE-2019-5823     David Erceg discovered a navigation error.

  - CVE-2019-5824     leecraso and Guang Gong discovered an error in the media     player.

  - CVE-2019-5825     Genming Liu, Jianyu Chen, Zhen Feng, and Jessica Liu     discovered an out-of-bounds write issue in the v8     JavaScript library.

  - CVE-2019-5826     Genming Liu, Jianyu Chen, Zhen Feng, and Jessica Liu     discovered a use-after-free issue.

  - CVE-2019-5827     mlfbrown discovered an out-of-bounds read issue in the     sqlite library.

  - CVE-2019-5828     leecraso and Guang Gong discovered a use-after-free     issue.

  - CVE-2019-5829     Lucas Pinheiro discovered a use-after-free issue.

  - CVE-2019-5830     Andrew Krashichkov discovered a credential error in the     Cross-Origin Resource Sharing feature.

  - CVE-2019-5831     yngwei discovered a map error in the v8 JavaScript     library.

  - CVE-2019-5832     Sergey Shekyan discovered an error in the Cross-Origin     Resource Sharing feature.

  - CVE-2019-5833     Khalil Zhani discovered a user interface error.

  - CVE-2019-5834     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2019-5836     Omair discovered a buffer overflow issue in the Angle     library.

  - CVE-2019-5837     Adam Iawniuk discovered an information disclosure issue.

  - CVE-2019-5838     David Erceg discovered an error in extension     permissions.

  - CVE-2019-5839     Masato Kinugawa discovered implementation errors in     Blink/Webkit.

  - CVE-2019-5840     Eliya Stein and Jerome Dangu discovered a way to bypass     the popup blocker.

  - CVE-2019-5842     BUGFENSE discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2019-5847     m3plex discovered an error in the v8 JavaScript library.

  - CVE-2019-5848     Mark Amery discovered an information disclosure issue.

  - CVE-2019-5849     Zhen Zhou discovered an out-of-bounds read in the Skia     library.

  - CVE-2019-5850     Brendon Tiszka discovered a use-after-free issue in the     offline page fetcher.

  - CVE-2019-5851     Zhe Jin discovered a use-after-poison issue.

  - CVE-2019-5852     David Erceg discovered an information disclosure issue.

  - CVE-2019-5853     Yngwei and sakura discovered a memory corruption issue.

  - CVE-2019-5854     Zhen Zhou discovered an integer overflow issue in the     pdfium library.

  - CVE-2019-5855     Zhen Zhou discovered an integer overflow issue in the     pdfium library.

  - CVE-2019-5856     Yongke Wang discovered an error related to filesystem:
    URI permissions.

  - CVE-2019-5857     cloudfuzzer discovered a way to crash chromium.

  - CVE-2019-5858     evil1m0 discovered an information disclosure issue.

  - CVE-2019-5859     James Lee discovered a way to launch alternative     browsers.

  - CVE-2019-5860     A use-after-free issue was discovered in the v8     JavaScript library.

  - CVE-2019-5861     Robin Linus discovered an error determining click     location.

  - CVE-2019-5862     Jun Kokatsu discovered an error in the AppCache     implementation.

  - CVE-2019-5864     Devin Grindle discovered an error in the Cross-Origin     Resourse Sharing feature for extensions.

  - CVE-2019-5865     Ivan Fratric discovered a way to bypass the site     isolation feature.

  - CVE-2019-5867     Lucas Pinheiro discovered an out-of-bounds read issue in     the v8 JavaScript library.

  - CVE-2019-5868     banananapenguin discovered a use-after-free issue in the     v8 JavaScript library.

ID	Name	Product	Family	Severity
200050	RHEL 7 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
200049	RHEL 6 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199961	RHEL 8 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
128525	Mozilla Firefox < 69.0	Nessus	Windows	critical
128524	Mozilla Firefox < 69.0	Nessus	MacOS X Local Security Checks	critical
128521	Ubuntu 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-4122-1)	Nessus	Ubuntu Local Security Checks	critical
128491	FreeBSD : mozilla -- multiple vulnerabilities (05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6)	Nessus	FreeBSD Local Security Checks	critical
127868	Debian DSA-4500-1 : chromium - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-5849

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical