By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87.

The remote host is affected by the vulnerability described in GLSA-202104-10 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4893-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information, or execute arbitrary code. (CVE-2021-23981, CVE-2021-23982, CVE-2021-23983,     CVE-2021-23987, CVE-2021-23988)

    It was discovered that extensions could open popup windows with control of the window title in some     circumstances. If a user were tricked into installing a specially crafted extension, an attacker could     potentially exploit this to spook a website and trick the user into providing credentials.
    (CVE-2021-23984)

    It was discovered that the DevTools remote debugging feature could be enabled without an indication to the     user. If a local attacker could modify the browser configuration, a remote attacker could potentially     exploit this to obtain sensitive information. (CVE-2021-23985)

    It was discovered that extensions could read the response of cross origin requests in some circumstances.
    If a user were tricked into installing a specially crafted extension, an attacker could potentially     exploit this to obtain sensitive information. (CVE-2021-23986)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory.

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

  - By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could     have been applied, resulting in memory corruption and a potentially exploitable crash. (CVE-2021-23983)

  - A malicious extension could have opened a popup window lacking an address bar. The title of the popup     lacking an address bar should not be fully controllable, but in this situation was. This could have been     used to spoof a website and attempt to trick the user into providing credentials. (CVE-2021-23984)

  - If an attacker is able to alter specific about:config values (for example malware running on the user's     computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to     the user. This would have allowed a remote attacker (able to make a direct network connection to the     victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by     providing a visual cue when Devtools has an open network socket. (CVE-2021-23985)

  - A malicious extension with the 'search' permission could have installed a new search engine whose favicon     referenced a cross-origin URL.  The response to this cross-origin request could have been read by the     extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin     permissions.  This cross-origin request was made without cookies, so the sensitive information disclosed     by the violation was limited to local-network resources or resources that perform IP-based authentication.
    (CVE-2021-23986)

  - Mozilla developers and community members Matthew Gregan, Tyson Smith, Julien Wajsberg, and Alexis     Beingessner reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2021-23987)

  - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2021-23988)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory.

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. (CVE-2021-23982)

  - By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could     have been applied, resulting in memory corruption and a potentially exploitable crash. (CVE-2021-23983)

  - A malicious extension could have opened a popup window lacking an address bar. The title of the popup     lacking an address bar should not be fully controllable, but in this situation was. This could have been     used to spoof a website and attempt to trick the user into providing credentials. (CVE-2021-23984)

  - If an attacker is able to alter specific about:config values (for example malware running on the user's     computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to     the user. This would have allowed a remote attacker (able to make a direct network connection to the     victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by     providing a visual cue when Devtools has an open network socket. (CVE-2021-23985)

  - A malicious extension with the 'search' permission could have installed a new search engine whose favicon     referenced a cross-origin URL.  The response to this cross-origin request could have been read by the     extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin     permissions.  This cross-origin request was made without cookies, so the sensitive information disclosed     by the violation was limited to local-network resources or resources that perform IP-based authentication.
    (CVE-2021-23986)

  - Mozilla developers and community members Matthew Gregan, Tyson Smith, Julien Wajsberg, and Alexis     Beingessner reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2021-23987)

  - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2021-23988)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
149233	GLSA-202104-10 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
148135	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4893-1)	Nessus	Ubuntu Local Security Checks	high
148015	Mozilla Firefox < 87.0	Nessus	MacOS X Local Security Checks	high
148014	Mozilla Firefox < 87.0	Nessus	Windows	high

Detections

Analytics

CVE-2021-23983

medium

Tenable Plugins

high

high

high

high