The remote host is affected by the vulnerability described in GLSA-201911-07 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-2663 advisory.

    [68.1.0-1.0.1]
    - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [68.1.0-1]
    - Update to 68.1.0 ESR

    [68.0.1-4]
    - Enable system nss

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 25 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.9.0 ESR.

Security Fix(es) :

* Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812)

* Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

* Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742)

* Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

* Mozilla: Use-after-free while manipulating video (CVE-2019-11746)

* Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

* firefox: stored passwords in 'Saved Logins' can be copied without master password entry (CVE-2019-11733)

* Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update upgrades Firefox to version 60.9.0 ESR.&#13; &#13;
Security Fix(es):&#13; &#13;

  - Mozilla: Sandbox escape through Firefox Sync     (CVE-2019-9812)&#13; &#13;

  - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox     ESR 68.1, and&#13; Firefox ESR 60.9     (CVE-2019-11740)&#13; &#13;

  - Mozilla: Same-origin policy violation with SVG filters     and canvas to&#13; steal cross-origin images     (CVE-2019-11742)&#13; &#13;

  - Mozilla: XSS by breaking out of title and textarea     elements using&#13; innerHTML (CVE-2019-11744)&#13;
    &#13;

  - Mozilla: Use-after-free while manipulating video     (CVE-2019-11746)&#13; &#13;

  - Mozilla: Use-after-free while extracting a key value in     IndexedDB&#13; (CVE-2019-11752)&#13; &#13;

  - firefox: stored passwords in 'Saved Logins' can be     copied without master&#13; password entry     (CVE-2019-11733)&#13; &#13;

  - Mozilla: Cross-origin access to unload event attributes     (CVE-2019-11743)&#13; --&#13;

This update for MozillaFirefox to 68.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-9811: Fixed a sandbox escape via installation     of malicious language pack. (bsc#1140868)

  - CVE-2019-9812: Fixed a sandbox escape through Firefox     Sync. (bsc#1149294)

  - CVE-2019-11710: Fixed several memory safety bugs.
    (bsc#1140868)

  - CVE-2019-11714: Fixed a potentially exploitable crash in     Necko. (bsc#1140868)

  - CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)

  - CVE-2019-11718: Fixed inadequate sanitation in the     Activity Stream component. (bsc#1140868)

  - CVE-2019-11720: Fixed a character encoding XSS     vulnerability. (bsc#1140868)

  - CVE-2019-11721: Fixed a homograph domain spoofing issue     through unicode latin 'kra' character. (bsc#1140868)

  - CVE-2019-11723: Fixed a cookie leakage during add-on     fetching across private browsing boundaries.
    (bsc#1140868)

  - CVE-2019-11724: Fixed an outdated permission, granting     access to retired site input.mozilla.org. (bsc#1140868)

  - CVE-2019-11725: Fixed a Safebrowsing bypass involving     WebSockets. (bsc#1140868)

  - CVE-2019-11727: Fixed a vulnerability where it possible     to force NSS to sign CertificateVerify with PKCS#1 v1.5     signatures when those are the only ones advertised by     server in CertificateRequest in TLS 1.3. (bsc#1141322)

  - CVE-2019-11728: Fixed an improper handling of the     Alt-Svc header that allowed remote port scans.
    (bsc#1140868)

  - CVE-2019-11733: Fixed an insufficient protection of     stored passwords in 'Saved Logins'. (bnc#1145665)

  - CVE-2019-11735: Fixed several memory safety bugs.
    (bnc#1149293)

  - CVE-2019-11736: Fixed a file manipulation and privilege     escalation in Mozilla Maintenance Service. (bnc#1149292) 

  - CVE-2019-11738: Fixed a content security policy bypass     through hash-based sources in directives. (bnc#1149302)

  - CVE-2019-11740: Fixed several memory safety bugs.
    (bsc#1149299)

  - CVE-2019-11742: Fixed a same-origin policy violation     involving SVG filters and canvas to steal cross-origin     images. (bsc#1149303)

  - CVE-2019-11743: Fixed a timing side-channel attack on     cross-origin information, utilizing unload event     attributes. (bsc#1149298)

  - CVE-2019-11744: Fixed an XSS caused by breaking out of     title and textarea elements using innerHTML.
    (bsc#1149304)

  - CVE-2019-11746: Fixed a use-after-free while     manipulating video. (bsc#1149297)

  - CVE-2019-11752: Fixed a use-after-free while extracting     a key value in IndexedDB. (bsc#1149296)

  - CVE-2019-11753: Fixed a privilege escalation with     Mozilla Maintenance Service in custom Firefox     installation location. (bsc#1149295)

Non-security issues fixed :

&#9; - Latest update now also released for s390x. (bsc#1109465)

  - Fixed a segmentation fault on s390vsl082. (bsc#1117473)

  - Fixed a crash on SLES15 s390x. (bsc#1124525)

  - Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
131267	GLSA-201911-07 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	11/25/2019	4/10/2024	critical
128599	Oracle Linux 8 : firefox (ELSA-2019-2663)	Nessus	Oracle Linux Local Security Checks	9/9/2019	10/22/2024	critical
128976	CentOS 6 : firefox (CESA-2019:2694)	Nessus	CentOS Local Security Checks	9/18/2019	4/24/2024	critical
128667	Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20190910)	Nessus	Scientific Linux Local Security Checks	9/11/2019	4/26/2024	critical
129665	openSUSE Security Update : MozillaFirefox (openSUSE-2019-2260)	Nessus	SuSE Local Security Checks	10/7/2019	4/19/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical