Detections
Analytics

GLSA-201512-10 : Mozilla Products: Multiple vulnerabilities (Bar Mitzvah) (Logjam)

critical Nessus Plugin ID 87710

Language:

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-201512-10 (Mozilla Products: Multiple vulnerabilities)

 Multiple vulnerabilities have been discovered in Mozilla Firefox and Mozilla Thunderbird. Please review the CVE identifiers referenced below for details.
 Impact :

 A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition.
 Workaround :

 There is no known workaround at this time.

Solution

All Firefox users should upgrade to the latest version:
 # emerge --sync # emerge --ask --oneshot --verbose '>=www-client/firefox-38.5.0' All Firefox-bin users should upgrade to the latest version:
 # emerge --sync # emerge --ask --oneshot --verbose '>=www-client/firefox-bin-38.5.0' All Thunderbird users should upgrade to the latest version:
 # emerge --sync # emerge --ask --oneshot --verbose '>=mail-client/thunderbird-38.5.0' All Thunderbird-bin users should upgrade to the latest version:
 # emerge --sync # emerge --ask --oneshot --verbose '>=mail-client/thunderbird-bin-38.5.0'

See Also

https://security.gentoo.org/glsa/201512-10

Plugin Details

Severity: Critical

ID: 87710

File Name: gentoo_GLSA-201512-10.nasl

Version: 2.16

Type: local

Published: 1/4/2016

Updated: 12/5/2022

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:thunderbird-bin, cpe:/o:gentoo:linux, p-cpe:/a:gentoo:linux:thunderbird, p-cpe:/a:gentoo:linux:firefox-bin, p-cpe:/a:gentoo:linux:firefox

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/30/2015

Vulnerability Publication Date: 4/1/2015

CISA Known Exploited Vulnerability Due Dates: 6/15/2022

Exploitable With

CANVAS (CANVAS)

Metasploit (Firefox PDF.js Privileged Javascript Injection)

Reference Information

CVE: CVE-2015-0798, CVE-2015-0799, CVE-2015-0801, CVE-2015-0802, CVE-2015-0803, CVE-2015-0804, CVE-2015-0805, CVE-2015-0806, CVE-2015-0807, CVE-2015-0808, CVE-2015-0810, CVE-2015-0811, CVE-2015-0812, CVE-2015-0813, CVE-2015-0814, CVE-2015-0815, CVE-2015-0816, CVE-2015-2706, CVE-2015-2721, CVE-2015-2722, CVE-2015-2724, CVE-2015-2725, CVE-2015-2726, CVE-2015-2727, CVE-2015-2728, CVE-2015-2729, CVE-2015-2730, CVE-2015-2731, CVE-2015-2733, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740, CVE-2015-2741, CVE-2015-2742, CVE-2015-2743, CVE-2015-2808, CVE-2015-4000, CVE-2015-4153, CVE-2015-4495, CVE-2015-4513, CVE-2015-4514, CVE-2015-4515, CVE-2015-4518, CVE-2015-7181, CVE-2015-7182, CVE-2015-7183, CVE-2015-7187, CVE-2015-7188, CVE-2015-7189, CVE-2015-7191, CVE-2015-7192, CVE-2015-7193, CVE-2015-7194, CVE-2015-7195, CVE-2015-7196, CVE-2015-7197, CVE-2015-7198, CVE-2015-7199, CVE-2015-7200, CVE-2015-7201, CVE-2015-7202, CVE-2015-7203, CVE-2015-7204, CVE-2015-7205, CVE-2015-7207, CVE-2015-7208, CVE-2015-7210, CVE-2015-7211, CVE-2015-7212, CVE-2015-7213, CVE-2015-7214, CVE-2015-7215, CVE-2015-7216, CVE-2015-7217, CVE-2015-7218, CVE-2015-7219, CVE-2015-7220, CVE-2015-7221, CVE-2015-7222, CVE-2015-7223

GLSA: 201512-10