Detections
Analytics
NewStart CGSL CORE 5.04 / MAIN 5.04 : firefox Vulnerability (NS-SA-2021-0112)
high Nessus Plugin ID 154546
Language:
Synopsis
The remote NewStart CGSL host is affected by a vulnerability.Description
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has firefox packages installed that are affected by a vulnerability:- Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11. (CVE-2021-29967)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade the vulnerable CGSL firefox packages. Note that updated packages may not be available yet. Please contact ZTE for more information.See Also
Plugin Details
Severity: High
ID: 154546
File Name: newstart_cgsl_NS-SA-2021-0112_firefox.nasl
Version: 1.2
Type: local
Published: 10/27/2021
Updated: 10/27/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2021-29967
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:zte:cgsl_core:firefox, p-cpe:/a:zte:cgsl_core:firefox-debuginfo, p-cpe:/a:zte:cgsl_main:firefox, p-cpe:/a:zte:cgsl_main:firefox-debuginfo, cpe:/o:zte:cgsl_core:5, cpe:/o:zte:cgsl_main:5
Required KB Items: Host/local_checks_enabled, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 9/24/2021
Vulnerability Publication Date: 6/2/2021
Reference Information
CVE: CVE-2021-29967
IAVA: 2021-A-0264-S