The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5782-1 advisory.

    It was discovered that Firefox was using an out-of-date libusrsctp library. An attacker could possibly use     this library to perform a reentrancy issue on Firefox. (CVE-2022-46871)

    Nika Layzell discovered that Firefox was not performing a check on paste received from cross-processes. An     attacker could potentially exploit this to obtain sensitive information. (CVE-2022-46872)

    Pete Freitag discovered that Firefox did not implement the unsafe-hashes CSP directive. An attacker who     was able to inject markup into a page otherwise protected by a Content Security Policy may have been able     to inject an executable script. (CVE-2022-46873)

    Matthias Zoellner discovered that Firefox was not keeping the filename ending intact when using the drag-     and-drop event. An attacker could possibly use this issue to add a file with a malicious extension,     leading to execute arbitrary code. (CVE-2022-46874)

    Hafiizh discovered that Firefox was not handling fullscreen notifications when the browser window goes     into fullscreen mode. An attacker could possibly use this issue to spoof the user and obtain sensitive     information. (CVE-2022-46877)

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information across domains, or execute arbitrary code. (CVE-2022-46878,

    CVE-2022-46879)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5782-1)

high Nessus Plugin ID 168840

Version 1.7

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.7 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.6 Jul 11, 2023, 4:01 AM Detection Plugin Feed: 202307110401
Version 1.5 Jul 11, 2023, 1:48 AM Detection Plugin Feed: 202307110148
Version 1.5 Jan 19, 2023, 6:11 PM IAVM reference Plugin Feed: 202301191811
Version 1.4 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.3 Jan 5, 2023, 6:23 PM CVSS metrics ("CVSSv3 score" changed from "7.5" to "8.8") Severity (changed from "High" to "Critical") CVSSv2 score source (changed from "CVE-2022-46872" to "CVE-2022-46879") CVSS temporal metrics ("CVSSv3 temporal score" set to "7.7") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv2 score" changed from "7.8" to "10.0") CVSS temporal metrics ("CVSSv2 temporal score" set to "7.4") CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H") Plugin Feed: 202301051823
Version 1.2 Dec 16, 2022, 5:48 AM New Plugin Feed: 202212160548