Amazon Linux 2 : firefox (ALASFIREFOX-2023-010)

high Nessus Plugin ID 181940

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of firefox installed on the remote host is prior to 102.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-010 advisory.

2023-09-27: CVE-2021-28429 was added to this advisory.

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file. (CVE-2021-28429)

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for example, if processing a file line by line), problems occur. Using this vulnerability in the doContent function allows an attacker to triage a denial of service or potentially arbitrary code execution.
(CVE-2022-40674)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that when injecting an HTML base element; some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. (CVE-2022-40956)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of inconsistent data in the instruction and data cache when creating wasm code, which could lead to a potentially exploitablecrash. (CVE-2022-40957)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that by injecting a cookie with certain special characters, an attacker on a shared subdomain, which is not a secure context,could set and overwrite cookies from a secure context, leading to session fixation and other attacks. (CVE-2022-40958)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that certain pages did not have their FeaturePolicy fully initialized during iframe navigation, leading to a bypass that leaked device permissions into untrusted subdocuments. (CVE-2022-40959)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and causing a potentially exploitable crash. (CVE-2022-40960)

A stack based buffer overflow vulnerability was identified in Mozilla Firefox and Firefox ESR. This vulnerability occurs when the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). An attacker could cause of denial-of-service style crash by exploiting this vulnerability. To exploit this vulnerability, a remote, unauthenticated attacker would need to convince a user to visit a specially crafted website or open a malicious document.
(CVE-2022-40961)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers Nika Layzell, Timothy Nikkel, Jeff Muizelaar, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reporting memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and the presumption that with enough effort, some have been exploited to run arbitrary code. (CVE-2022-40962)

Mozilla: A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via performance.getEntries(). (CVE-2022-42927)

Mozilla: Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. (CVE-2022-42928)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a website called window.print() causing a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings. (CVE-2022-42929)

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers Ashley Hale and the Mozilla Fuzzing Team, reporting memory safety bugs present in Firefox 105 and Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and, with enough effort, exploited to run arbitrary code. (CVE-2022-42932)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update firefox' to update your system.

Plugin Details

Severity: High

ID: 181940

File Name: al2_ALASFIREFOX-2023-010.nasl

Version: 1.3

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 9/27/2023

Updated: 12/11/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-42932

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:firefox, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:firefox-debuginfo

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/21/2023

Vulnerability Publication Date: 9/14/2022

Reference Information

CVE: CVE-2021-28429, CVE-2022-40674, CVE-2022-40956, CVE-2022-40957, CVE-2022-40958, CVE-2022-40959, CVE-2022-40960, CVE-2022-40961, CVE-2022-40962, CVE-2022-42927, CVE-2022-42928, CVE-2022-42929, CVE-2022-42932

IAVA: 2022-A-0384-S, 2022-A-0435-S, 2022-A-0491-S, 2023-A-0132-S

Detections

Analytics