Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89.

The remote host is affected by the vulnerability described in GLSA-202107-09 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4978-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, re-enable     camera devices without an additional permission prompt, spoof the browser UI, or execute arbitrary code.
    (CVE-2021-29959, CVE-2021-29961, CVE-2021-29966, CVE-2021-29967)

    It was discovered that filenames printed from private browsing mode were incorrectly retained in     preferences. A local attacker could potentially exploit this to obtain sensitive information.
    (CVE-2021-29960)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 89.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-23 advisory.

  - A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in     password manager to suggest passwords for the currently active website instead of the website that     triggered the dialog. This bug only affects Firefox for Android. Other operating systems are     unaffected. (CVE-2021-29965)

  - Firefox used to cache the last filename used for printing a file. When generating a filename for printing,     Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead     to the title of a website visited during private browsing mode being stored on disk. (CVE-2021-29960)

  - When styling and rendering an oversized `` element, Firefox did not apply correct clipping which     allowed an attacker to paint over the user interface. (CVE-2021-29961)

  - Address bar search suggestions in private browsing mode were re-using session data from normal mode.
    This bug only affects Firefox for Android. Other operating systems are unaffected. (CVE-2021-29963)

  - A locally-installed hostile program could send `WMCOPYDATA` messages that Firefox would process     incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other     operating systems are unaffected. (CVE-2021-29964)

  - When a user has already allowed a website to access microphone and camera, disabling camera sharing would     not fully prevent the website from re-enabling it without an additional prompt. This was only possible if     the website kept recording with the microphone until re-enabling the camera. (CVE-2021-29959)

  - Firefox for Android would become unstable and hard-to-recover when a website opened too many popups.
    This bug only affects Firefox for Android. Other operating systems are unaffected. (CVE-2021-29962)

  - Mozilla developers Christian Holler, Anny Gakhokidze, Alexandru Michis, Gabriele Svelto reported memory     safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code. (CVE-2021-29967)

  - Mozilla developers Christian Holler, Tooru Fujisawa, Tyson Smith reported memory safety bugs present in     Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2021-29966)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 89.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-23 advisory.

  - A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in     password manager to suggest passwords for the currently active website instead of the website that     triggered the dialog. This bug only affects Firefox for Android. Other operating systems are     unaffected. (CVE-2021-29965)

  - Firefox used to cache the last filename used for printing a file. When generating a filename for printing,     Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead     to the title of a website visited during private browsing mode being stored on disk. (CVE-2021-29960)

  - When styling and rendering an oversized `` element, Firefox did not apply correct clipping which     allowed an attacker to paint over the user interface. (CVE-2021-29961)

  - Address bar search suggestions in private browsing mode were re-using session data from normal mode.
    This bug only affects Firefox for Android. Other operating systems are unaffected. (CVE-2021-29963)

  - A locally-installed hostile program could send `WMCOPYDATA` messages that Firefox would process     incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other     operating systems are unaffected. (CVE-2021-29964)

  - When a user has already allowed a website to access microphone and camera, disabling camera sharing would     not fully prevent the website from re-enabling it without an additional prompt. This was only possible if     the website kept recording with the microphone until re-enabling the camera. (CVE-2021-29959)

  - Firefox for Android would become unstable and hard-to-recover when a website opened too many popups.
    This bug only affects Firefox for Android. Other operating systems are unaffected. (CVE-2021-29962)

  - Mozilla developers Christian Holler, Anny Gakhokidze, Alexandru Michis, Gabriele Svelto reported memory     safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code. (CVE-2021-29967)

  - Mozilla developers Christian Holler, Tooru Fujisawa, Tyson Smith reported memory safety bugs present in     Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2021-29966)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
157041	GLSA-202107-09 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
150152	Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4978-1)	Nessus	Ubuntu Local Security Checks	high
150120	Mozilla Firefox < 89.0	Nessus	MacOS X Local Security Checks	high
150119	Mozilla Firefox < 89.0	Nessus	Windows	high

Detections

Analytics

CVE-2021-29966

high

Tenable Plugins

high

high

high

high