The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5479 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.11 ESR.

    Security Fix(es):

    * Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI     (CVE-2022-34468)

    * Mozilla: Use-after-free in nsSHistory (CVE-2022-34470)

    * Mozilla: A popup window could be resized in a way to overlay the address bar with web content     (CVE-2022-34479)

    * Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (CVE-2022-34484)

    * Mozilla: Undesired attributes could be set as part of prototype pollution (CVE-2022-2200)

    * Mozilla: CSP bypass enabling stylesheet injection (CVE-2022-31744)

    * Mozilla: Unavailable PAC file resulted in OCSP requests being blocked (CVE-2022-34472)

    * Mozilla: Potential integer overflow in ReplaceElementsAt (CVE-2022-34481)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : firefox (RHSA-2022:5479)

critical Nessus Plugin ID 162662

Version 1.9