The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5233 advisory.

  - Mozilla: Variable time processing of cross-origin images during drawImage calls (CVE-2020-16012)

  - Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code     (CVE-2020-26951)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - Mozilla: XSS through paste (manual and clipboard API) (CVE-2020-26956)

  - Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions (CVE-2020-26958)

  - Mozilla: Use-after-free in WebRequestService (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

  - Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 (CVE-2020-26968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the SLSA-2020:5239-1 advisory.

  - Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code     (CVE-2020-26951)

  - Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 (CVE-2020-26968)

  - Mozilla: Variable time processing of cross-origin images during drawImage calls (CVE-2020-16012)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - Mozilla: XSS through paste (manual and clipboard API) (CVE-2020-26956)

  - Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions (CVE-2020-26958)

  - Mozilla: Use-after-free in WebRequestService (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5239 advisory.

  - Mozilla: Variable time processing of cross-origin images during drawImage calls (CVE-2020-16012)

  - Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code     (CVE-2020-26951)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - Mozilla: XSS through paste (manual and clipboard API) (CVE-2020-26956)

  - Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions (CVE-2020-26958)

  - Mozilla: Use-after-free in WebRequestService (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

  - Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 (CVE-2020-26968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the SLSA-2020:5257-1 advisory.

  - Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code     (CVE-2020-26951)

  - Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 (CVE-2020-26968)

  - Mozilla: Variable time processing of cross-origin images during drawImage calls (CVE-2020-16012)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - Mozilla: XSS through paste (manual and clipboard API) (CVE-2020-26956)

  - Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions (CVE-2020-26958)

  - Mozilla: Use-after-free in WebRequestService (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)

  - CVE-2020-26951: Parsing mismatches could confuse and     bypass security sanitizer for chrome privileged code

  - CVE-2020-16012: Variable time processing of cross-origin     images during drawImage calls

  - CVE-2020-26953: Fullscreen could be enabled without     displaying the security UI

  - CVE-2020-26956: XSS through paste (manual and clipboard     API)

  - CVE-2020-26958: Requests intercepted through     ServiceWorkers lacked MIME type restrictions

  - CVE-2020-26959: Use-after-free in WebRequestService

  - CVE-2020-26960: Potential use-after-free in uses of     nsTArray

  - CVE-2020-15999: Heap buffer overflow in freetype

  - CVE-2020-26961: DoH did not filter IPv4 mapped IP     Addresses

  - CVE-2020-26965: Software keyboards may have remembered     typed passwords

  - CVE-2020-26966: Single-word search queries were also     broadcast to local network

  - CVE-2020-26968: Memory safety bugs fixed in Firefox 83     and Firefox ESR 78.5

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:5235 advisory.

  - Mozilla: Variable time processing of cross-origin images during drawImage calls (CVE-2020-16012)

  - Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code     (CVE-2020-26951)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - Mozilla: XSS through paste (manual and clipboard API) (CVE-2020-26956)

  - Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions (CVE-2020-26958)

  - Mozilla: Use-after-free in WebRequestService (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

  - Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 (CVE-2020-26968)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
143280	RHEL 8 : firefox (RHSA-2020:5233)	Nessus	Red Hat Local Security Checks	11/30/2020	4/28/2024	high
143360	Scientific Linux Security Update : firefox on SL7.x x86_64 (2020:5239)	Nessus	Scientific Linux Local Security Checks	11/30/2020	2/7/2024	high
143370	RHEL 7 : firefox (RHSA-2020:5239)	Nessus	Red Hat Local Security Checks	12/1/2020	4/28/2024	high
143371	Scientific Linux Security Update : firefox on SL6.x i686/x86_64 (2020:5257)	Nessus	Scientific Linux Local Security Checks	12/1/2020	2/7/2024	high
143723	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:3458-1)	Nessus	SuSE Local Security Checks	12/9/2020	12/5/2022	high
143910	CentOS 7 : thunderbird (CESA-2020:5235)	Nessus	CentOS Local Security Checks	12/9/2020	2/5/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high