{"id": "CVE-2018-18499", "bulletinFamily": "NVD", "title": "CVE-2018-18499", "description": "A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.", "published": "2019-02-28T18:29:00", "modified": "2019-03-01T14:40:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18499", "reporter": "cve@mitre.org", "references": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1468523", "https://www.mozilla.org/security/advisories/mfsa2018-25/", "https://www.mozilla.org/security/advisories/mfsa2018-21/", "https://www.mozilla.org/security/advisories/mfsa2018-20/"], "cvelist": ["CVE-2018-18499"], "type": "cve", "lastseen": "2020-12-09T20:25:38", "edition": 13, "viewCount": 36, "enchantments": {"dependencies": {"references": [{"type": "redhat", "idList": ["RHSA-2018:2693", "RHSA-2018:2692", "RHSA-2018:3403", "RHSA-2018:3458"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310813892", "OPENVAS:1361412562310814071", "OPENVAS:1361412562310813889", "OPENVAS:1361412562310814070", "OPENVAS:1361412562310813890", "OPENVAS:1361412562310813893", "OPENVAS:1361412562310813891", "OPENVAS:1361412562310813894"]}, {"type": "centos", "idList": ["CESA-2018:2692", "CESA-2018:2693", "CESA-2018:3403"]}, {"type": "nessus", "idList": ["MOZILLA_FIREFOX_60_2_ESR.NASL", "MOZILLA_THUNDERBIRD_60_2_1.NASL", "MACOS_THUNDERBIRD_60_2_1.NASL", "MACOSX_FIREFOX_60_2_ESR.NASL", "MACOSX_FIREFOX_62_0.NASL"]}, {"type": "kaspersky", "idList": ["KLA11313", "KLA11336"]}], "modified": "2020-12-09T20:25:38", "rev": 2}, "score": {"value": 4.5, "vector": "NONE", "modified": "2020-12-09T20:25:38", "rev": 2}, "vulnersScore": 4.5}, "cpe": [], "affectedSoftware": [{"cpeName": "mozilla:thunderbird", "name": "mozilla thunderbird", "operator": "lt", "version": "60.2.1"}, {"cpeName": "mozilla:firefox", "name": "mozilla firefox", "operator": "lt", "version": "62.0"}, {"cpeName": "mozilla:firefox_esr", "name": "mozilla firefox esr", "operator": "lt", "version": "60.2"}], "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cpe23": [], "cwe": ["CWE-346"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:mozilla:firefox:62.0:*:*:*:*:*:*:*", "versionEndExcluding": "62.0", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:60.2:*:*:*:*:*:*:*", "versionEndExcluding": "60.2", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:60.2.1:*:*:*:*:*:*:*", "versionEndExcluding": "60.2.1", "vulnerable": true}], "operator": "OR"}]}}

{"centos": [{"lastseen": "2020-12-08T03:34:13", "bulletinFamily": "unix", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "description": "**CentOS Errata and Security Advisory** CESA-2018:2692\n\n\nMozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.2.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376)\n\n* Mozilla: Use-after-free in driver timers (CVE-2018-12377)\n\n* Mozilla: Use-after-free in IndexedDB (CVE-2018-12378)\n\n* Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541)\n\n* Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Alex Gaynor, Boris Zbarsky, Christoph Diehl, Christian Holler, Jason Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell, Nils, Zhanjia Song, and Holger Fuhrmannek as the original reporters.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2018-September/035060.html\n\n**Affected packages:**\nfirefox\n\n**Upstream details at:**\n", "edition": 7, "modified": "2018-09-13T16:39:24", "published": "2018-09-13T16:39:24", "id": "CESA-2018:2692", "href": "http://lists.centos.org/pipermail/centos-announce/2018-September/035060.html", "title": "firefox security update", "type": "centos", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-08T03:34:56", "bulletinFamily": "unix", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "description": "**CentOS Errata and Security Advisory** CESA-2018:2693\n\n\nMozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.2.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376)\n\n* Mozilla: Use-after-free in driver timers (CVE-2018-12377)\n\n* Mozilla: Use-after-free in IndexedDB (CVE-2018-12378)\n\n* Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541)\n\n* Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Alex Gaynor, Boris Zbarsky, Christoph Diehl, Christian Holler, Jason Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell, Nils, Zhanjia Song, and Holger Fuhrmannek as the original reporters.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2018-September/035058.html\n\n**Affected packages:**\nfirefox\n\n**Upstream details at:**\n", "edition": 7, "modified": "2018-09-13T16:33:00", "published": "2018-09-13T16:33:00", "id": "CESA-2018:2693", "href": "http://lists.centos.org/pipermail/centos-announce/2018-September/035058.html", "title": "firefox security update", "type": "centos", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-08T03:34:45", "bulletinFamily": "unix", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12385", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "description": "**CentOS Errata and Security Advisory** CESA-2018:3403\n\n\nMozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.2.1.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376)\n\n* Mozilla: Use-after-free in driver timers (CVE-2018-12377)\n\n* Mozilla: Use-after-free in IndexedDB (CVE-2018-12378)\n\n* Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541)\n\n* Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)\n\n* Mozilla: Crash in TransportSecurityInfo due to cached data (CVE-2018-12385)\n\n* Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords (CVE-2018-12383)\n\nNote: All of the above issues cannot be exploited in Thunderbird by a specially crafted HTML mail, as JavaScript is disabled for mail messages and cannot be enabled. They could be exploited another way in Thunderbird, for example, when viewing the remote content of an RSS feed.\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Alex Gaynor, Boris Zbarsky, Christoph Diehl, Christian Holler, Jason Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell, Nils, Zhanjia Song, Holger Fuhrmannek, Philipp, and Jurgen Gaeremyn as the original reporters.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2018-November/035116.html\n\n**Affected packages:**\nthunderbird\n\n**Upstream details at:**\n", "edition": 6, "modified": "2018-11-05T18:57:41", "published": "2018-11-05T18:57:41", "id": "CESA-2018:3403", "href": "http://lists.centos.org/pipermail/centos-announce/2018-November/035116.html", "title": "thunderbird security update", "type": "centos", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2019-07-25T12:02:38", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12381", "CVE-2018-12378", "CVE-2018-12377", "CVE-2018-12376", "CVE-2018-18499"], "description": "This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.", "modified": "2019-07-25T00:00:00", "published": "2018-09-06T00:00:00", "id": "OPENVAS:1361412562310813891", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813891", "type": "openvas", "title": "Mozilla Firefox Security Updates (mfsa_2018-18_2018-21) - Windows", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Firefox Security Updates(mfsa_2018-18_2018-21)-Windows\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:mozilla:firefox\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813891\");\n script_version(\"2019-07-25T06:05:02+0000\");\n script_cve_id(\"CVE-2018-12377\", \"CVE-2018-12378\", \"CVE-2018-18499\", \"CVE-2018-12379\", \"CVE-2018-12381\",\n \"CVE-2018-12376\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 06:05:02 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-09-06 13:22:47 +0530 (Thu, 06 Sep 2018)\");\n script_name(\"Mozilla Firefox Security Updates (mfsa_2018-18_2018-21) - Windows\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - An use-after-free error in refresh driver timers.\n\n - An use-after-free error in IndexedDB.\n\n - A same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs.\n\n - An out-of-bounds write error with malicious MAR file.\n\n - Page navigation error when the Outlook message's mail columns are incorrectly\n interpreted as a URL.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to cause denial of service condition, page navigation and also arbitrary code\n execution.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version before 62 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox version 62 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-20\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_firefox_detect_win.nasl\");\n script_mandatory_keys(\"Firefox/Win/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"62\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"62\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-25T12:02:24", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12381", "CVE-2018-12378", "CVE-2018-12377", "CVE-2018-12376", "CVE-2018-18499"], "description": "This host is installed with Mozilla Firefox ESR\n and is prone to multiple vulnerabilities.", "modified": "2019-07-25T00:00:00", "published": "2018-09-06T00:00:00", "id": "OPENVAS:1361412562310813889", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813889", "type": "openvas", "title": "Mozilla Firefox ESR Security Updates (mfsa_2018-18_2018-21) - Windows", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Firefox ESR Security Updates(mfsa_2018-18_2018-21)-Windows\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:mozilla:firefox_esr\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813889\");\n script_version(\"2019-07-25T06:05:02+0000\");\n script_cve_id(\"CVE-2018-12377\", \"CVE-2018-12378\", \"CVE-2018-18499\", \"CVE-2018-12379\", \"CVE-2018-12381\",\n \"CVE-2018-12376\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 06:05:02 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-09-06 13:20:50 +0530 (Thu, 06 Sep 2018)\");\n script_name(\"Mozilla Firefox ESR Security Updates (mfsa_2018-18_2018-21) - Windows\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla Firefox ESR\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - An use-after-free error in refresh driver timers.\n\n - An use-after-free error in IndexedDB.\n\n - A same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs.\n\n - An out-of-bounds write error with malicious MAR file.\n\n - Page navigation error when the Outlook message's mail columns are incorrectly\n interpreted as a URL.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to cause denial of service condition, page navigation and also arbitrary code\n execution.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox ESR version before 60.2 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox ESR version 60.2 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-21\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_firefox_detect_win.nasl\");\n script_mandatory_keys(\"Firefox-ESR/Win/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"60.2\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"60.2\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-25T12:02:13", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "description": "This host is installed with Mozilla Firefox ESR\n and is prone to multiple vulnerabilities.", "modified": "2019-07-25T00:00:00", "published": "2018-09-06T00:00:00", "id": "OPENVAS:1361412562310813890", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813890", "type": "openvas", "title": "Mozilla Firefox ESR Security Updates (mfsa_2018-18_2018-21) - MAC OS X", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Firefox ESR Security Updates(mfsa_2018-18_2018-21)-MAC OS X\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:mozilla:firefox_esr\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813890\");\n script_version(\"2019-07-25T06:05:02+0000\");\n script_cve_id(\"CVE-2018-12377\", \"CVE-2018-12378\", \"CVE-2018-18499\", \"CVE-2018-12379\", \"CVE-2017-16541\",\n \"CVE-2018-12376\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 06:05:02 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-09-06 13:21:06 +0530 (Thu, 06 Sep 2018)\");\n script_name(\"Mozilla Firefox ESR Security Updates (mfsa_2018-18_2018-21) - MAC OS X\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla Firefox ESR\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - An use-after-free error in refresh driver timers.\n\n - An use-after-free error in IndexedDB.\n\n - A same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs.\n\n - An out-of-bounds write error with malicious MAR file.\n\n - A proxy bypass using automount and autofs.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to cause denial of service condition, bypass security restrictions and also\n arbitrary code execution.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox ESR version before 60.2 on MAC OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox ESR version 60.2 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-21\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_mozilla_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Mozilla/Firefox-ESR/MacOSX/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"60.2\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"60.2\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-25T12:02:14", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "description": "This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.", "modified": "2019-07-25T00:00:00", "published": "2018-09-06T00:00:00", "id": "OPENVAS:1361412562310813892", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813892", "type": "openvas", "title": "Mozilla Firefox Security Updates (mfsa_2018-18_2018-21) - MAC OS X", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Firefox Security Updates(mfsa_2018-18_2018-21)-MAC OS X\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:mozilla:firefox\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813892\");\n script_version(\"2019-07-25T06:05:02+0000\");\n script_cve_id(\"CVE-2018-12377\", \"CVE-2018-12378\", \"CVE-2018-18499\", \"CVE-2018-12379\", \"CVE-2017-16541\",\n \"CVE-2018-12376\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 06:05:02 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-09-06 13:22:59 +0530 (Thu, 06 Sep 2018)\");\n script_name(\"Mozilla Firefox Security Updates (mfsa_2018-18_2018-21) - MAC OS X\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - An use-after-free error in refresh driver timers.\n\n - An use-after-free error in IndexedDB.\n\n - A same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs.\n\n - An out-of-bounds write error with malicious MAR file.\n\n - A proxy bypass using automount and autofs.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to cause denial of service condition, bypass security restrictions and also\n arbitrary code execution.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version before 62 on MAC OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox version 62 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-20\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_mozilla_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Mozilla/Firefox/MacOSX/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"62\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"62\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-25T12:02:06", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12385", "CVE-2018-12377", "CVE-2018-12376", "CVE-2018-18499"], "description": "This host is installed with Mozilla\n Thunderbird and is prone to multiple vulnerabilities.", "modified": "2019-07-25T00:00:00", "published": "2018-10-05T00:00:00", "id": "OPENVAS:1361412562310814070", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310814070", "type": "openvas", "title": "Mozilla Thunderbird Security Updates (mfsa_2018-20_2018-25) - Windows", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Thunderbird Security Updates(mfsa_2018-20_2018-25)-Windows\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:mozilla:thunderbird\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.814070\");\n script_version(\"2019-07-25T06:05:02+0000\");\n script_cve_id(\"CVE-2018-12377\", \"CVE-2018-12378\", \"CVE-2018-18499\", \"CVE-2018-12379\", \"CVE-2018-12385\",\n \"CVE-2018-12383\", \"CVE-2018-12376\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 06:05:02 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-10-05 11:07:48 +0530 (Fri, 05 Oct 2018)\");\n script_name(\"Mozilla Thunderbird Security Updates (mfsa_2018-20_2018-25) - Windows\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla\n Thunderbird and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - An use-after-free error in refresh driver timers.\n\n - An use-after-free error in IndexedDB.\n\n - A same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs.\n\n - An out-of-bounds write error with malicious MAR file.\n\n - An error related to cached data in the user profile directory.\n\n - An error related to setting of a master password.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to disclose sensitive information, cause denial of service and run arbitrary code.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Thunderbird version before 60.2.1 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Thunderbird version 60.2.1\n or later. For updates refer Reference links.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-25\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_thunderbird_detect_win.nasl\");\n script_mandatory_keys(\"Thunderbird/Win/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"60.2.1\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"60.2.1\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-24T14:01:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12381", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12377", "CVE-2018-12375", "CVE-2018-12376", "CVE-2018-18499"], "description": "This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.", "modified": "2019-07-23T00:00:00", "published": "2018-09-06T00:00:00", "id": "OPENVAS:1361412562310813894", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813894", "type": "openvas", "title": "Mozilla Firefox Security Updates (mfsa_2018-20) - Windows", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Firefox 'Password' Information Disclosure Vulnerability (Windows)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:mozilla:firefox\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813894\");\n script_version(\"2019-07-23T09:16:09+0000\");\n script_cve_id(\"CVE-2018-12377\", \"CVE-2018-12378\", \"CVE-2018-18499\", \"CVE-2018-12379\", \"CVE-2018-12381\",\n \"CVE-2018-12383\", \"CVE-2018-12375\", \"CVE-2018-12376\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-23 09:16:09 +0000 (Tue, 23 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-09-06 13:22:59 +0530 (Thu, 06 Sep 2018)\");\n script_name(\"Mozilla Firefox Security Updates (mfsa_2018-20) - Windows\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - An use-after-free error in refresh driver timers.\n\n - An use-after-free error in IndexedDB.\n\n - A same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs.\n\n - An out-of-bounds write error with malicious MAR file.\n\n - Page navigation error when the Outlook message's mail columns are incorrectly\n interpreted as a URL.\n\n - An error related to setting of a master password.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to disclose sensitive information, cause denial of service and run arbitrary code.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version 58 through 61.0.2 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox version 62 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-20\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_firefox_detect_win.nasl\");\n script_mandatory_keys(\"Firefox/Win/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_in_range(version:vers, test_version:\"58.0\", test_version2:\"61.0.2\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"62\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-25T12:02:18", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12385", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "description": "This host is installed with Mozilla\n Thunderbird and is prone to multiple vulnerabilities.", "modified": "2019-07-25T00:00:00", "published": "2018-10-05T00:00:00", "id": "OPENVAS:1361412562310814071", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310814071", "type": "openvas", "title": "Mozilla Thunderbird Security Updates (mfsa_2018-20_2018-25) - MAC OS X", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Thunderbird Security Updates(mfsa_2018-20_2018-25)-MAC OS X\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:mozilla:thunderbird\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.814071\");\n script_version(\"2019-07-25T06:05:02+0000\");\n script_cve_id(\"CVE-2018-12377\", \"CVE-2018-12378\", \"CVE-2018-18499\", \"CVE-2018-12379\", \"CVE-2017-16541\",\n \"CVE-2018-12385\", \"CVE-2018-12383\", \"CVE-2018-12376\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 06:05:02 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-10-05 11:08:43 +0530 (Fri, 05 Oct 2018)\");\n script_name(\"Mozilla Thunderbird Security Updates (mfsa_2018-20_2018-25) - MAC OS X\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla\n Thunderbird and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - An use-after-free error in refresh driver timers.\n\n - An use-after-free error in IndexedDB.\n\n - A same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs.\n\n - An out-of-bounds write error with malicious MAR file.\n\n - A proxy bypass using automount and autofs.\n\n - An error related to cached data in the user profile directory.\n\n - An error related to setting of a master password.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to disclose sensitive information, cause denial of service, run arbitrary code\n and bypass security restrictions.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Thunderbird version before 60.2.1 on MAC OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Thunderbird version 60.2.1\n or later. For updates refer Reference links.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-25\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_mozilla_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Thunderbird/MacOSX/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"60.2.1\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"60.2.1\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-25T12:02:04", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12375", "CVE-2018-12376", "CVE-2018-18499"], "description": "This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.", "modified": "2019-07-25T00:00:00", "published": "2018-09-06T00:00:00", "id": "OPENVAS:1361412562310813893", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813893", "type": "openvas", "title": "Mozilla Firefox Security Updates (mfsa_2018-20) - MAC OS X", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Firefox 'Password' Information Disclosure Vulnerability (MAC OS X)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:mozilla:firefox\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813893\");\n script_version(\"2019-07-25T06:05:02+0000\");\n script_cve_id(\"CVE-2018-12377\", \"CVE-2018-12378\", \"CVE-2018-18499\", \"CVE-2018-12379\", \"CVE-2017-16541\",\n \"CVE-2018-12383\", \"CVE-2018-12375\", \"CVE-2018-12376\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 06:05:02 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-09-06 13:22:59 +0530 (Thu, 06 Sep 2018)\");\n script_name(\"Mozilla Firefox Security Updates (mfsa_2018-20) - MAC OS X\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - An use-after-free error in refresh driver timers.\n\n - An use-after-free error in IndexedDB.\n\n - A same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs.\n\n - An out-of-bounds write error with malicious MAR file.\n\n - A proxy bypass using automount and autofs.\n\n - An error related to setting of a master password.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to disclose sensitive information, cause denial of service, run arbitrary code\n and bypass security restrictions.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version 58 through 61.0.2 on MAC OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox version 62 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-20\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_mozilla_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Mozilla/Firefox/MacOSX/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE ))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_in_range(version:vers, test_version:\"58.0\", test_version2:\"61.0.2\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"62\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2020-07-01T07:53:37", "bulletinFamily": "unix", "cvelist": ["CVE-2017-16541", "CVE-2018-12376", "CVE-2018-12377", "CVE-2018-12378", "CVE-2018-12379", "CVE-2018-18499"], "description": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.2.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376)\n\n* Mozilla: Use-after-free in driver timers (CVE-2018-12377)\n\n* Mozilla: Use-after-free in IndexedDB (CVE-2018-12378)\n\n* Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541)\n\n* Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Alex Gaynor, Boris Zbarsky, Christoph Diehl, Christian Holler, Jason Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell, Nils, Zhanjia Song, and Holger Fuhrmannek as the original reporters.", "modified": "2020-07-01T11:05:48", "published": "2018-09-12T13:58:54", "id": "RHSA-2018:2692", "href": "https://access.redhat.com/errata/RHSA-2018:2692", "type": "redhat", "title": "(RHSA-2018:2692) Critical: firefox security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-07-01T07:53:39", "bulletinFamily": "unix", "cvelist": ["CVE-2017-16541", "CVE-2018-12376", "CVE-2018-12377", "CVE-2018-12378", "CVE-2018-12379", "CVE-2018-18499"], "description": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.2.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376)\n\n* Mozilla: Use-after-free in driver timers (CVE-2018-12377)\n\n* Mozilla: Use-after-free in IndexedDB (CVE-2018-12378)\n\n* Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541)\n\n* Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Alex Gaynor, Boris Zbarsky, Christoph Diehl, Christian Holler, Jason Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell, Nils, Zhanjia Song, and Holger Fuhrmannek as the original reporters.", "modified": "2020-07-01T11:05:49", "published": "2018-09-12T14:00:20", "id": "RHSA-2018:2693", "href": "https://access.redhat.com/errata/RHSA-2018:2693", "type": "redhat", "title": "(RHSA-2018:2693) Critical: firefox security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-07-01T07:53:18", "bulletinFamily": "unix", "cvelist": ["CVE-2017-16541", "CVE-2018-12376", "CVE-2018-12377", "CVE-2018-12378", "CVE-2018-12379", "CVE-2018-12383", "CVE-2018-12385", "CVE-2018-18499"], "description": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.2.1.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376)\n\n* Mozilla: Use-after-free in driver timers (CVE-2018-12377)\n\n* Mozilla: Use-after-free in IndexedDB (CVE-2018-12378)\n\n* Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541)\n\n* Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)\n\n* Mozilla: Crash in TransportSecurityInfo due to cached data (CVE-2018-12385)\n\n* Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords (CVE-2018-12383)\n\nNote: All of the above issues cannot be exploited in Thunderbird by a specially crafted HTML mail, as JavaScript is disabled for mail messages and cannot be enabled. They could be exploited another way in Thunderbird, for example, when viewing the remote content of an RSS feed.\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Alex Gaynor, Boris Zbarsky, Christoph Diehl, Christian Holler, Jason Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell, Nils, Zhanjia Song, Holger Fuhrmannek, Philipp, and Jurgen Gaeremyn as the original reporters.", "modified": "2020-07-01T11:05:50", "published": "2018-10-30T18:55:51", "id": "RHSA-2018:3403", "href": "https://access.redhat.com/errata/RHSA-2018:3403", "type": "redhat", "title": "(RHSA-2018:3403) Important: thunderbird security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-07-01T07:54:34", "bulletinFamily": "unix", "cvelist": ["CVE-2017-16541", "CVE-2018-12376", "CVE-2018-12377", "CVE-2018-12378", "CVE-2018-12379", "CVE-2018-12383", "CVE-2018-12385", "CVE-2018-18499"], "description": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.2.1.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376)\n\n* Mozilla: Use-after-free in driver timers (CVE-2018-12377)\n\n* Mozilla: Use-after-free in IndexedDB (CVE-2018-12378)\n\n* Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541)\n\n* Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)\n\n* Mozilla: Crash in TransportSecurityInfo due to cached data (CVE-2018-12385)\n\n* Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords (CVE-2018-12383)\n\nNote: All of the above issues cannot be exploited in Thunderbird by a specially crafted HTML mail, as JavaScript is disabled for mail messages and cannot be enabled. They could be exploited another way in Thunderbird, for example, when viewing the remote content of an RSS feed.\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Alex Gaynor, Boris Zbarsky, Christoph Diehl, Christian Holler, Jason Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell, Nils, Zhanjia Song, Holger Fuhrmannek, Philipp, and Jurgen Gaeremyn as the original reporters.", "modified": "2020-07-01T11:05:49", "published": "2018-11-05T14:56:07", "id": "RHSA-2018:3458", "href": "https://access.redhat.com/errata/RHSA-2018:3458", "type": "redhat", "title": "(RHSA-2018:3458) Important: thunderbird security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-01-01T03:50:41", "description": "The version of Mozilla Firefox ESR installed on the remote Windows\nhost is prior to 60.2. It is, therefore, affected by multiple\ncritical and high severity vulnerabilities.", "edition": 25, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-09-06T00:00:00", "title": "Mozilla Firefox ESR < 60.2 Multiple Critical Vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12381", "CVE-2018-12378", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:mozilla:firefox_esr"], "id": "MOZILLA_FIREFOX_60_2_ESR.NASL", "href": "https://www.tenable.com/plugins/nessus/117293", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(117293);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/04/05 23:25:09\");\n\n script_cve_id(\n \"CVE-2017-16541\",\n \"CVE-2018-12376\",\n \"CVE-2018-12377\",\n \"CVE-2018-12378\",\n \"CVE-2018-12379\",\n \"CVE-2018-12381\",\n \"CVE-2018-18499\"\n );\n script_bugtraq_id(\"101665\");\n script_xref(name:\"MFSA\", value:\"2018-21\");\n\n script_name(english:\"Mozilla Firefox ESR < 60.2 Multiple Critical Vulnerabilities\");\n script_summary(english:\"Checks the version of Firefox ESR.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote Windows host is affected by\nmultiple critical and high severity vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Mozilla Firefox ESR installed on the remote Windows\nhost is prior to 60.2. It is, therefore, affected by multiple\ncritical and high severity vulnerabilities.\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1412081\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?eeb4654f\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1435319\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6f8c53b5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1450989\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?20fb56d5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1459383\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0ba771ab\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1466577\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ec8a52cc\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1466991\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?729f9359\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1467363\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1de4cab5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1467889\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c5d40321\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1468523\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?38d5db79\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1468738\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2e15e66a\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1469309\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?71d5c763\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1469914\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0410b02e\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1470260\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c939fbe7\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1471953\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?06cc0e92\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1472925\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?635f0fa0\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1473113\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?4376815f\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1473161\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?99b48daf\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1478575\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fdfa1d66\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1478849\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?d0c0acea\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480092\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?69cce0e2\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480517\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ae70d802\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480521\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dd5f0586\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1481093\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7d6a368a\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1483120\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?61040df6\");\n # https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?387cd93f\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Firefox ESR version 60.2 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-12376\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/09/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/09/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox_esr\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mozilla_org_installed.nasl\");\n script_require_keys(\"Mozilla/Firefox/Version\");\n\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\n\nport = get_kb_item(\"SMB/transport\");\nif (!port) port = 445;\n\ninstalls = get_kb_list(\"SMB/Mozilla/Firefox/*\");\nif (isnull(installs)) audit(AUDIT_NOT_INST, \"Firefox\");\n\nmozilla_check_version(installs:installs, product:'firefox', esr:TRUE, fix:'60.2', min:'60.0', severity:SECURITY_HOLE);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T03:29:25", "description": "The version of Mozilla Firefox ESR installed on the remote macOS or\nMac OS X host is prior to 60.2. It is, therefore, affected by\nmultiple vulnerabilities, some of which allow code execution and\npotentially exploitable crashes.", "edition": 25, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-09-06T00:00:00", "title": "Mozilla Firefox ESR < 60.2 Multiple Vulnerabilities (macOS)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12381", "CVE-2018-12378", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:mozilla:firefox_esr"], "id": "MACOSX_FIREFOX_60_2_ESR.NASL", "href": "https://www.tenable.com/plugins/nessus/117292", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(117292);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/04/05 23:25:06\");\n\n script_cve_id(\n \"CVE-2017-16541\",\n \"CVE-2018-12376\",\n \"CVE-2018-12377\",\n \"CVE-2018-12378\",\n \"CVE-2018-12379\",\n \"CVE-2018-12381\",\n \"CVE-2018-18499\"\n );\n script_bugtraq_id(\"101665\");\n script_xref(name:\"MFSA\", value:\"2018-21\");\n\n script_name(english:\"Mozilla Firefox ESR < 60.2 Multiple Vulnerabilities (macOS)\");\n script_summary(english:\"Checks the version of Firefox ESR.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote macOS or Mac OS X host is\naffected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Mozilla Firefox ESR installed on the remote macOS or\nMac OS X host is prior to 60.2. It is, therefore, affected by\nmultiple vulnerabilities, some of which allow code execution and\npotentially exploitable crashes.\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1412081\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?eeb4654f\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1435319\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6f8c53b5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1450989\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?20fb56d5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1459383\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0ba771ab\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1466577\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ec8a52cc\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1466991\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?729f9359\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1467363\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1de4cab5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1467889\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c5d40321\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1468523\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?38d5db79\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1468738\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2e15e66a\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1469309\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?71d5c763\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1469914\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0410b02e\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1470260\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c939fbe7\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1471953\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?06cc0e92\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1472925\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?635f0fa0\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1473113\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?4376815f\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1473161\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?99b48daf\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1478575\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fdfa1d66\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1478849\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?d0c0acea\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480092\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?69cce0e2\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480517\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ae70d802\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480521\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dd5f0586\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1481093\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7d6a368a\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1483120\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?61040df6\");\n # https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?387cd93f\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Firefox version 62.0.0 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-12376\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/09/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/09/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox_esr\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_firefox_installed.nasl\");\n script_require_keys(\"MacOSX/Firefox/Version\");\n\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\n\nkb_base = \"MacOSX/Firefox\";\nget_kb_item_or_exit(kb_base+\"/Installed\");\n\nversion = get_kb_item_or_exit(kb_base+\"/Version\", exit_code:1);\npath = get_kb_item_or_exit(kb_base+\"/Path\", exit_code:1);\n\nis_esr = get_kb_item(kb_base+\"/is_esr\");\nif (isnull(is_esr)) audit(AUDIT_NOT_INST, \"Mozilla Firefox ESR\");\n\nmozilla_check_version(product:'firefox', version:version, path:path, esr:TRUE, fix:'60.2', min:'60.0', severity:SECURITY_HOLE);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T03:22:45", "description": "The version of Thunderbird installed on the remote macOS or Mac OS X\nhost is prior to 60.2.1. It is, therefore, affected by multiple\nvulnerabilities as referenced in the mfsa2018-25 advisory.\n\n - A use-after-free vulnerability can occur when refresh\n driver timers are refreshed in some circumstances during\n shutdown when the timer is deleted while still in use.\n This results in a potentially exploitable crash.\n (CVE-2018-12377)\n\n - A use-after-free vulnerability can occur when an\n IndexedDB index is deleted while still in use by\n JavaScript code that is providing payload values to be\n stored. This results in a potentially exploitable crash.\n (CVE-2018-12378)\n\n - A same-origin policy violation allowing the theft of\n cross-origin URL entries when using a <meta>\n meta http-equiv=refresh on a page to cause a\n redirection to another site using\n performance.getEntries(). This is a same-\n origin policy violation and could allow for data theft.\n (CVE-2018-18499)\n\n - When the Mozilla Updater opens a MAR format file which\n contains a very long item filename, an out-of-bounds\n write can be triggered, leading to a potentially\n exploitable crash. This requires running the Mozilla\n Updater manually on the local system with the malicious\n MAR file in order to occur. (CVE-2018-12379)\n\n - Browser proxy settings can be bypassed by using the\n automount feature with autofs to create a mount point on\n the local file system. Content can be loaded from this\n mounted file system directly using a file:\n URI, bypassing configured proxy settings. *Note:\n this issue only affects OS X in default configurations.\n On Linux systems, autofs must be installed for the\n vulnerability to occur and Windows is not affected.*\n (CVE-2017-16541)\n\n - A potentially exploitable crash in\n TransportSecurityInfo used for SSL can be\n triggered by data stored in the local cache in the user\n profile directory. This issue is only exploitable in\n combination with another vulnerability allowing an\n attacker to write data into the local cache or from\n locally installed malware. This issue also triggers a\n non-exploitable startup crash for users switching\n between the Nightly and Release versions of Firefox if\n the same profile is used. (CVE-2018-12385)\n\n - If a user saved passwords before Firefox 58 and then\n later set a master password, an unencrypted copy of\n these passwords is still accessible. This is because the\n older stored password file was not deleted when the data\n was copied to a new format starting in Firefox 58. The\n new master password is added only on the new file. This\n could allow the exposure of stored password data outside\n of user expectations. (CVE-2018-12383)\n\n - Mozilla developers and community members Alex Gaynor,\n Boris Zbarsky, Christoph Diehl, Christian Holler, Jason\n Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl\n Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell,\n and Andrei Cristian Petcu reported memory safety bugs\n present in Firefox 61 and Firefox ESR 60.1. Some of\n these bugs showed evidence of memory corruption and we\n presume that with enough effort that some of these could\n be exploited to run arbitrary code. (CVE-2018-12376)\n\nNote that Nessus has not tested for this issue but has instead relied\nonly on the application's self-reported version number.", "edition": 19, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-01-30T00:00:00", "title": "Mozilla Thunderbird < 60.2.1", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12385", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:mozilla:thunderbird"], "id": "MACOS_THUNDERBIRD_60_2_1.NASL", "href": "https://www.tenable.com/plugins/nessus/121478", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from Mozilla Foundation Security Advisory mfsa2018-25.\n# The text itself is copyright (C) Mozilla Foundation.\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(121478);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/04/02 21:54:17\");\n\n script_cve_id(\n \"CVE-2017-16541\",\n \"CVE-2018-12376\",\n \"CVE-2018-12377\",\n \"CVE-2018-12378\",\n \"CVE-2018-12379\",\n \"CVE-2018-12383\",\n \"CVE-2018-12385\",\n \"CVE-2018-18499\"\n );\n script_xref(name: \"MFSA\", value: \"2018-25\");\n\n script_name(english:\"Mozilla Thunderbird < 60.2.1\");\n script_summary(english:\"Checks the version of Thunderbird.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A mail client installed on the remote macOS or Mac OS X host is\naffected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Thunderbird installed on the remote macOS or Mac OS X\nhost is prior to 60.2.1. It is, therefore, affected by multiple\nvulnerabilities as referenced in the mfsa2018-25 advisory.\n\n - A use-after-free vulnerability can occur when refresh\n driver timers are refreshed in some circumstances during\n shutdown when the timer is deleted while still in use.\n This results in a potentially exploitable crash.\n (CVE-2018-12377)\n\n - A use-after-free vulnerability can occur when an\n IndexedDB index is deleted while still in use by\n JavaScript code that is providing payload values to be\n stored. This results in a potentially exploitable crash.\n (CVE-2018-12378)\n\n - A same-origin policy violation allowing the theft of\n cross-origin URL entries when using a <meta>\n meta http-equiv=refresh on a page to cause a\n redirection to another site using\n performance.getEntries(). This is a same-\n origin policy violation and could allow for data theft.\n (CVE-2018-18499)\n\n - When the Mozilla Updater opens a MAR format file which\n contains a very long item filename, an out-of-bounds\n write can be triggered, leading to a potentially\n exploitable crash. This requires running the Mozilla\n Updater manually on the local system with the malicious\n MAR file in order to occur. (CVE-2018-12379)\n\n - Browser proxy settings can be bypassed by using the\n automount feature with autofs to create a mount point on\n the local file system. Content can be loaded from this\n mounted file system directly using a file:\n URI, bypassing configured proxy settings. *Note:\n this issue only affects OS X in default configurations.\n On Linux systems, autofs must be installed for the\n vulnerability to occur and Windows is not affected.*\n (CVE-2017-16541)\n\n - A potentially exploitable crash in\n TransportSecurityInfo used for SSL can be\n triggered by data stored in the local cache in the user\n profile directory. This issue is only exploitable in\n combination with another vulnerability allowing an\n attacker to write data into the local cache or from\n locally installed malware. This issue also triggers a\n non-exploitable startup crash for users switching\n between the Nightly and Release versions of Firefox if\n the same profile is used. (CVE-2018-12385)\n\n - If a user saved passwords before Firefox 58 and then\n later set a master password, an unencrypted copy of\n these passwords is still accessible. This is because the\n older stored password file was not deleted when the data\n was copied to a new format starting in Firefox 58. The\n new master password is added only on the new file. This\n could allow the exposure of stored password data outside\n of user expectations. (CVE-2018-12383)\n\n - Mozilla developers and community members Alex Gaynor,\n Boris Zbarsky, Christoph Diehl, Christian Holler, Jason\n Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl\n Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell,\n and Andrei Cristian Petcu reported memory safety bugs\n present in Firefox 61 and Firefox ESR 60.1. Some of\n these bugs showed evidence of memory corruption and we\n presume that with enough effort that some of these could\n be exploited to run arbitrary code. (CVE-2018-12376)\n\nNote that Nessus has not tested for this issue but has instead relied\nonly on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1470260\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1459383\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1468523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1473113\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1412081\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1490585\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1475775\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1469309\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1469914\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1450989\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1480092\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1480517\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1481093\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1478575\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1471953\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1473161\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1466991\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1468738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1483120\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1467363\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1472925\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1466577\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1467889\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1480521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1478849\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Thunderbird version 60.2.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-12377\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/30\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:thunderbird\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_thunderbird_installed.nasl\");\n script_require_keys(\"MacOSX/Thunderbird/Installed\");\n\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\n\nkb_base = \"MacOSX/Thunderbird\";\nget_kb_item_or_exit(kb_base+\"/Installed\");\n\nversion = get_kb_item_or_exit(kb_base+\"/Version\", exit_code:1);\npath = get_kb_item_or_exit(kb_base+\"/Path\", exit_code:1);\n\nis_esr = get_kb_item(kb_base+\"/is_esr\");\nif (is_esr) exit(0, 'The Mozilla Thunderbird installation is in the ESR branch.');\n\nmozilla_check_version(product:'thunderbird', version:version, path:path, esr:FALSE, fix:'60.2.1', severity:SECURITY_HOLE);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T03:53:05", "description": "The version of Mozilla Thunderbird installed on the remote Windows\nhost is prior to 60.2.1. It is, therefore, affected by multiple\nvulnerabilities :\n\n - A use-after-free vulnerability can occur when refresh\n driver timers are refreshed in some circumstances during\n shutdown when the timer is deleted while still in use.\n This results in a potentially exploitable crash.\n (CVE-2018-12377)\n\n - A use-after-free vulnerability can occur when an\n IndexedDB index is deleted while still in use by\n JavaScript code that is providing payload values to be\n stored. This results in a potentially exploitable crash.\n (CVE-2018-12378)\n\n - A same-origin policy violation allowing the theft of\n cross-origin URL entries when using a <meta>\n meta http-equiv=refresh on a page to cause a\n redirection to another site using\n performance.getEntries(). This is a same-\n origin policy violation and could allow for data theft.\n (CVE-2018-18499)\n\n - When the Mozilla Updater opens a MAR format file which\n contains a very long item filename, an out-of-bounds\n write can be triggered, leading to a potentially\n exploitable crash. This requires running the Mozilla\n Updater manually on the local system with the malicious\n MAR file in order to occur. (CVE-2018-12379)\n\n - Browser proxy settings can be bypassed by using the\n automount feature with autofs to create a mount point on\n the local file system. Content can be loaded from this\n mounted file system directly using a file:\n URI, bypassing configured proxy settings. *Note:\n this issue only affects OS X in default configurations.\n On Linux systems, autofs must be installed for the\n vulnerability to occur and Windows is not affected.*\n (CVE-2017-16541)\n\n - A potentially exploitable crash in\n TransportSecurityInfo used for SSL can be\n triggered by data stored in the local cache in the user\n profile directory. This issue is only exploitable in\n combination with another vulnerability allowing an\n attacker to write data into the local cache or from\n locally installed malware. This issue also triggers a\n non-exploitable startup crash for users switching\n between the Nightly and Release versions of Firefox if\n the same profile is used. (CVE-2018-12385)\n\n - If a user saved passwords before Firefox 58 and then\n later set a master password, an unencrypted copy of\n these passwords is still accessible. This is because the\n older stored password file was not deleted when the data\n was copied to a new format starting in Firefox 58. The\n new master password is added only on the new file. This\n could allow the exposure of stored password data outside\n of user expectations. (CVE-2018-12383)\n\n - Mozilla developers and community members Alex Gaynor,\n Boris Zbarsky, Christoph Diehl, Christian Holler, Jason\n Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl\n Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell,\n and Andrei Cristian Petcu reported memory safety bugs\n present in Firefox 61 and Firefox ESR 60.1. Some of\n these bugs showed evidence of memory corruption and we\n presume that with enough effort that some of these could\n be exploited to run arbitrary code. (CVE-2018-12376)\n\nNote that Nessus has not tested for this issue but has instead relied\nonly on the application's self-reported version number.", "edition": 22, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-10-05T00:00:00", "title": "Mozilla Thunderbird < 60.2.1 Multiple Vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12385", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:mozilla:thunderbird"], "id": "MOZILLA_THUNDERBIRD_60_2_1.NASL", "href": "https://www.tenable.com/plugins/nessus/117939", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from Mozilla Foundation Security Advisory mfsa2018-25.\n# The text itself is copyright (C) Mozilla Foundation.\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(117939);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/04/05 23:25:09\");\n\n script_cve_id(\n \"CVE-2017-16541\",\n \"CVE-2018-12376\",\n \"CVE-2018-12377\",\n \"CVE-2018-12378\",\n \"CVE-2018-12379\",\n \"CVE-2018-12383\",\n \"CVE-2018-12385\",\n \"CVE-2018-18499\"\n );\n script_xref(name: \"MFSA\", value: \"2018-25\");\n\n script_name(english:\"Mozilla Thunderbird < 60.2.1 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of Thunderbird.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote Windows host is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Mozilla Thunderbird installed on the remote Windows\nhost is prior to 60.2.1. It is, therefore, affected by multiple\nvulnerabilities :\n\n - A use-after-free vulnerability can occur when refresh\n driver timers are refreshed in some circumstances during\n shutdown when the timer is deleted while still in use.\n This results in a potentially exploitable crash.\n (CVE-2018-12377)\n\n - A use-after-free vulnerability can occur when an\n IndexedDB index is deleted while still in use by\n JavaScript code that is providing payload values to be\n stored. This results in a potentially exploitable crash.\n (CVE-2018-12378)\n\n - A same-origin policy violation allowing the theft of\n cross-origin URL entries when using a <meta>\n meta http-equiv=refresh on a page to cause a\n redirection to another site using\n performance.getEntries(). This is a same-\n origin policy violation and could allow for data theft.\n (CVE-2018-18499)\n\n - When the Mozilla Updater opens a MAR format file which\n contains a very long item filename, an out-of-bounds\n write can be triggered, leading to a potentially\n exploitable crash. This requires running the Mozilla\n Updater manually on the local system with the malicious\n MAR file in order to occur. (CVE-2018-12379)\n\n - Browser proxy settings can be bypassed by using the\n automount feature with autofs to create a mount point on\n the local file system. Content can be loaded from this\n mounted file system directly using a file:\n URI, bypassing configured proxy settings. *Note:\n this issue only affects OS X in default configurations.\n On Linux systems, autofs must be installed for the\n vulnerability to occur and Windows is not affected.*\n (CVE-2017-16541)\n\n - A potentially exploitable crash in\n TransportSecurityInfo used for SSL can be\n triggered by data stored in the local cache in the user\n profile directory. This issue is only exploitable in\n combination with another vulnerability allowing an\n attacker to write data into the local cache or from\n locally installed malware. This issue also triggers a\n non-exploitable startup crash for users switching\n between the Nightly and Release versions of Firefox if\n the same profile is used. (CVE-2018-12385)\n\n - If a user saved passwords before Firefox 58 and then\n later set a master password, an unencrypted copy of\n these passwords is still accessible. This is because the\n older stored password file was not deleted when the data\n was copied to a new format starting in Firefox 58. The\n new master password is added only on the new file. This\n could allow the exposure of stored password data outside\n of user expectations. (CVE-2018-12383)\n\n - Mozilla developers and community members Alex Gaynor,\n Boris Zbarsky, Christoph Diehl, Christian Holler, Jason\n Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl\n Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell,\n and Andrei Cristian Petcu reported memory safety bugs\n present in Firefox 61 and Firefox ESR 60.1. Some of\n these bugs showed evidence of memory corruption and we\n presume that with enough effort that some of these could\n be exploited to run arbitrary code. (CVE-2018-12376)\n\nNote that Nessus has not tested for this issue but has instead relied\nonly on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1412081\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1450989\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1459383\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1466577\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1466991\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1467363\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1467889\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1468523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1468738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1469309\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1469914\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1470260\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1471953\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1472925\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1473113\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1473161\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1475775\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1478575\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1478849\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1480092\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1480517\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1480521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1481093\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1483120\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.mozilla.org/show_bug.cgi?id=1490585\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Thunderbird version 60.2.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-12377\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/10/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:thunderbird\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mozilla_org_installed.nasl\");\n script_require_keys(\"Mozilla/Thunderbird/Version\");\n\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\n\nport = get_kb_item(\"SMB/transport\");\nif (!port) port = 445;\n\ninstalls = get_kb_list(\"SMB/Mozilla/Thunderbird/*\");\nif (isnull(installs)) audit(AUDIT_NOT_INST, \"Thunderbird\");\n\nmozilla_check_version(installs:installs, product:'thunderbird', esr:FALSE, fix:'60.2.1', severity:SECURITY_HOLE);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T03:29:28", "description": "The version of Mozilla Firefox installed on the remote macOS host is\nprior to 62. It is, therefore, affected by multiple vulnerabilities as\nnoted in Mozilla Firefox stable channel update release notes for\n2018/09/05. Please refer to the release notes for additional\ninformation. Note that Nessus has not attempted to exploit these\nissues but has instead relied only on the application's self-reported\nversion number.", "edition": 20, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2018-12-18T00:00:00", "title": "Mozilla Firefox < 62 Multiple Vulnerabilities (macOS)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-12379", "CVE-2018-12381", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12382", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12375", "CVE-2018-12376", "CVE-2018-18499"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:mozilla:firefox"], "id": "MACOSX_FIREFOX_62_0.NASL", "href": "https://www.tenable.com/plugins/nessus/119748", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119748);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/04/05 23:25:06\");\n\n script_cve_id(\n \"CVE-2017-16541\",\n \"CVE-2018-12375\",\n \"CVE-2018-12376\",\n \"CVE-2018-12377\",\n \"CVE-2018-12378\",\n \"CVE-2018-12379\",\n \"CVE-2018-12381\",\n \"CVE-2018-12382\",\n \"CVE-2018-12383\",\n \"CVE-2018-18499\"\n );\n\n script_name(english:\"Mozilla Firefox < 62 Multiple Vulnerabilities (macOS)\");\n script_summary(english:\"Checks the version of Firefox.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote macOS host is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Mozilla Firefox installed on the remote macOS host is\nprior to 62. It is, therefore, affected by multiple vulnerabilities as\nnoted in Mozilla Firefox stable channel update release notes for\n2018/09/05. Please refer to the release notes for additional\ninformation. Note that Nessus has not attempted to exploit these\nissues but has instead relied only on the application's self-reported\nversion number.\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1412081\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?eeb4654f\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1433502\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?3f3e46cb\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1435319\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6f8c53b5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1450989\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?20fb56d5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1459383\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0ba771ab\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1461027\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9999cb80\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1462693\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?63398af6\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1466577\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ec8a52cc\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1466991\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?729f9359\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1467363\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1de4cab5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1467889\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c5d40321\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1468523\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?38d5db79\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1468738\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2e15e66a\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1469309\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?71d5c763\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1469914\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0410b02e\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1470260\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c939fbe7\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1471953\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?06cc0e92\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1472925\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?635f0fa0\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1473113\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?4376815f\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1473161\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?99b48daf\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1475431\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b90402bb\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1475775\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bc528cf5\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1478575\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fdfa1d66\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1478849\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?d0c0acea\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1479311\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f284ef32\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480092\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?69cce0e2\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480517\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ae70d802\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480521\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dd5f0586\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1480965\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7be72ad4\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1481093\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7d6a368a\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=1483120\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?61040df6\");\n # https://bugzilla.mozilla.org/show_bug.cgi?id=894215\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9284762b\");\n # https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8517426b\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Firefox version 62 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-12376\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/09/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/18\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_firefox_installed.nasl\");\n script_require_keys(\"MacOSX/Firefox/Installed\");\n\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\n\nkb_base = \"MacOSX/Firefox\";\nget_kb_item_or_exit(kb_base+\"/Installed\");\n\nversion = get_kb_item_or_exit(kb_base+\"/Version\", exit_code:1);\npath = get_kb_item_or_exit(kb_base+\"/Path\", exit_code:1);\n\nif (get_kb_item(kb_base + '/is_esr')) exit(0, 'The Mozilla Firefox installation is in the ESR branch.');\n\nmozilla_check_version(product:'firefox', version:version, path:path, esr:FALSE, fix:'62', severity:SECURITY_HOLE);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "kaspersky": [{"lastseen": "2020-09-02T11:53:17", "bulletinFamily": "info", "cvelist": ["CVE-2018-12379", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12385", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12376", "CVE-2018-18499"], "description": "### *Detect date*:\n10/04/2018\n\n### *Severity*:\nWarning\n\n### *Description*:\nMultiple serious vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code. Below is a complete list of vulnerabilities:\n\n### *Affected products*:\nMozilla Thunderbird earlier than 60.2.1\n\n### *Solution*:\nUpdate to the latest version \n[Download Mozilla Thunderbird](<https://www.mozilla.org/en-US/thunderbird/>)\n\n### *Original advisories*:\n[Mozilla Foundation Security Advisory 2018-25](<https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Mozilla Thunderbird](<https://threats.kaspersky.com/en/product/Mozilla-Thunderbird/>)\n\n### *CVE-IDS*:\n[CVE-2018-12377](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12377>)0.0Unknown \n[CVE-2018-12378](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12378>)0.0Unknown \n[CVE-2018-12379](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12379>)0.0Unknown \n[CVE-2017-16541](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16541>)0.0Unknown \n[CVE-2018-12383](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12383>)0.0Unknown \n[CVE-2018-12376](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12376>)0.0Unknown \n[CVE-2018-12385](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12385>)0.0Unknown \n[CVE-2018-18499](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18499>)0.0Unknown", "edition": 24, "modified": "2020-05-22T00:00:00", "published": "2018-10-04T00:00:00", "id": "KLA11336", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11336", "title": "\r KLA11336Multiple vulnerabilities in Mozilla Thunderbird ", "type": "kaspersky", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-09-02T11:56:13", "bulletinFamily": "info", "cvelist": ["CVE-2018-12379", "CVE-2018-12381", "CVE-2018-12378", "CVE-2018-12383", "CVE-2018-12382", "CVE-2018-12377", "CVE-2017-16541", "CVE-2018-12375", "CVE-2018-12376", "CVE-2018-18499"], "description": "### *Detect date*:\n09/05/2018\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities were found in Mozilla Firefox and Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities:\n\n### *Affected products*:\nMozilla Firefox earlier than 62 \nMozilla Firefox ESR earlier than 60.2\n\n### *Solution*:\nUpdate to the latest version \n[Download Mozilla Firefox](<https://www.mozilla.org/en-US/firefox/new/>) \n[Download Mozilla Firefox ESR](<https://www.mozilla.org/en-US/firefox/organizations/all/>)\n\n### *Original advisories*:\n[Mozilla Foundation Security Advisory 2018-20](<https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/>) \n[Mozilla Foundation Security Advisory 2018-21](<https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Mozilla Firefox](<https://threats.kaspersky.com/en/product/Mozilla-Firefox/>)\n\n### *CVE-IDS*:\n[CVE-2018-12377](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12377>)0.0Unknown \n[CVE-2018-12378](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12378>)0.0Unknown \n[CVE-2018-12379](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12379>)0.0Unknown \n[CVE-2017-16541](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16541>)0.0Unknown \n[CVE-2018-12381](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12381>)0.0Unknown \n[CVE-2018-12382](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12382>)0.0Unknown \n[CVE-2018-12383](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12383>)0.0Unknown \n[CVE-2018-12375](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12375>)0.0Unknown \n[CVE-2018-12376](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12376>)0.0Unknown \n[CVE-2018-18499](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18499>)0.0Unknown", "edition": 27, "modified": "2020-05-22T00:00:00", "published": "2018-09-05T00:00:00", "id": "KLA11313", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11313", "title": "\r KLA11313Multiple vulnerabilities in Mozilla Firefox and Mozilla Firefox ESR ", "type": "kaspersky", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}