ID CVE-2020-6823 Type cve Reporter cve@mitre.org Modified 2020-05-01T13:38:00
Description
A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox < 75.
{"archlinux": [{"lastseen": "2020-09-22T18:36:39", "bulletinFamily": "unix", "cvelist": ["CVE-2020-6821", "CVE-2020-6823", "CVE-2020-6824", "CVE-2020-6825", "CVE-2020-6826"], "description": "Arch Linux Security Advisory ASA-202004-8\n=========================================\n\nSeverity: Critical\nDate : 2020-04-08\nCVE-ID : CVE-2020-6821 CVE-2020-6823 CVE-2020-6824 CVE-2020-6825\nCVE-2020-6826\nPackage : firefox\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-1127\n\nSummary\n=======\n\nThe package firefox before version 75.0-1 is vulnerable to multiple\nissues including arbitrary code execution, information disclosure and\naccess restriction bypass.\n\nResolution\n==========\n\nUpgrade to 75.0-1.\n\n# pacman -Syu \"firefox>=75.0-1\"\n\nThe problems have been fixed upstream in version 75.0.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2020-6821 (information disclosure)\n\nAn information disclosure issue has been found in Firefox before 75.0.\nWhen reading from areas partially or fully outside the source resource\nwith WebGL's copyTexSubImage method, the specification requires the\nreturned values be zero. Previously, this memory was uninitialized,\nleading to potentially sensitive data disclosure.\n\n- CVE-2020-6823 (access restriction bypass)\n\nA security issue has been found in Firefox before 75.0, where a\nmalicious extension could have called\nbrowser.identity.launchWebAuthFlow, controlling the redirect_uri, and\nthrough the Promise returned, obtain the Auth code and gain access to\nthe user's account at the service provider.\n\n- CVE-2020-6824 (information disclosure)\n\nA security issue has been found in Firefox before 75.0, where generated\npasswords may be identical on the same site between separate private\nbrowsing sessions. Initially, a user opens a Private Browsing Window\nand generates a password for a site, then closes the Private Browsing\nWindow but leaves Firefox open. Subsequently, if the user had opened a\nnew Private Browsing Window, revisited the same site, and generated a\nnew password - the generated passwords would have been identical,\nrather than independent.\n\n- CVE-2020-6825 (arbitrary code execution)\n\nSeveral memory safety issues have been found in Firefox before 75.0.\nSome of these bugs showed evidence of memory corruption and Mozilla\npresumes that with enough effort some of these could have been\nexploited to run arbitrary code.\n\n- CVE-2020-6826 (arbitrary code execution)\n\nSeveral memory safety issues have been found in Firefox before 75.0.\nSome of these bugs showed evidence of memory corruption and Mozilla\npresumes that with enough effort some of these could have been\nexploited to run arbitrary code.\n\nImpact\n======\n\nA remote attacker might be able to access sensitive information, bypass\nsecurity restrictions or execute arbitrary code.\n\nReferences\n==========\n\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2020-12/\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6821\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1625404\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6823\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1614919\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6824\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1621853\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6825\nhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1572541%2C1620193%2C1620203\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6826\nhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1613009%2C1613195%2C1616734%2C1617488%2C1619229%2C1620719%2C1624897\nhttps://security.archlinux.org/CVE-2020-6821\nhttps://security.archlinux.org/CVE-2020-6823\nhttps://security.archlinux.org/CVE-2020-6824\nhttps://security.archlinux.org/CVE-2020-6825\nhttps://security.archlinux.org/CVE-2020-6826", "modified": "2020-04-08T00:00:00", "published": "2020-04-08T00:00:00", "id": "ASA-202004-8", "href": "https://security.archlinux.org/ASA-202004-8", "type": "archlinux", "title": "[ASA-202004-8] firefox: multiple issues", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2020-05-02T15:13:23", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "description": "This host is installed with\n Mozilla Firefox and is prone to multiple vulnerabilities.", "modified": "2020-04-10T00:00:00", "published": "2020-04-08T00:00:00", "id": "OPENVAS:1361412562310816741", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310816741", "type": "openvas", "title": "Mozilla Firefox Security Updates( mfsa_2020-12_2020-13 )-MAC OS X", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from the referenced\n# advisories, and are Copyright (C) by the respective right holder(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\n\nCPE = \"cpe:/a:mozilla:firefox\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.816741\");\n script_version(\"2020-04-10T03:46:49+0000\");\n script_cve_id(\"CVE-2020-6821\", \"CVE-2020-6822\", \"CVE-2020-6823\", \"CVE-2020-6824\",\n \"CVE-2020-6825\", \"CVE-2020-6826\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-04-10 03:46:49 +0000 (Fri, 10 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-04-08 13:17:30 +0530 (Wed, 08 Apr 2020)\");\n script_name(\"Mozilla Firefox Security Updates( mfsa_2020-12_2020-13 )-MAC OS X\");\n\n script_tag(name:\"summary\", value:\"This host is installed with\n Mozilla Firefox and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on\n the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - A file overwrite issue in the user's profile directory.\n\n - An uninitialized memory could be read when using the WebGL copyTexSubImage\n method.\n\n - An out of bounds write issue in GMPDecodeData when processing large images.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allows remote\n attackers to execute arbitrary code and disclose sensitive data.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version before\n 75 on MAC OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox version 75\n or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/firefox/new/\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_mozilla_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Mozilla/Firefox/MacOSX/Version\");\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( ! infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE) ) exit( 0 );\nffVer = infos['version'];\nffPath = infos['location'];\n\nif(version_is_less(version:ffVer, test_version:\"75\"))\n{\n report = report_fixed_ver(installed_version:ffVer, fixed_version:\"75\", install_path:ffPath);\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-05-08T09:08:24", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "description": "The remote host is missing an update for the ", "modified": "2020-05-05T00:00:00", "published": "2020-04-08T00:00:00", "id": "OPENVAS:1361412562310844388", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844388", "type": "openvas", "title": "Ubuntu: Security Advisory for firefox (USN-4323-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844388\");\n script_version(\"2020-05-05T07:00:07+0000\");\n script_cve_id(\"CVE-2020-6821\", \"CVE-2020-6822\", \"CVE-2020-6824\", \"CVE-2020-6825\", \"CVE-2020-6826\", \"CVE-2020-6823\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-05-05 07:00:07 +0000 (Tue, 05 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-04-08 03:00:27 +0000 (Wed, 08 Apr 2020)\");\n script_name(\"Ubuntu: Security Advisory for firefox (USN-4323-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU19\\.10|UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"4323-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2020-April/005385.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'firefox'\n package(s) announced via the USN-4323-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple security issues were discovered in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service, obtain sensitive\ninformation, or execute arbitrary code. (CVE-2020-6821, CVE-2020-6822,\nCVE-2020-6824, CVE-2020-6825, CVE-2020-6826)\n\nIt was discovered that extensions could obtain auth codes from OAuth login\nflows in some circumstances. If a user were tricked in to installing a\nspecially crafted extension, an attacker could potentially exploit this to\nobtain access to the user's account. (CVE-2020-6823)\");\n\n script_tag(name:\"affected\", value:\"'firefox' package(s) on Ubuntu 19.10, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU19.10\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"75.0+build3-0ubuntu0.19.10.1\", rls:\"UBUNTU19.10\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"75.0+build3-0ubuntu0.18.04.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"75.0+build3-0ubuntu0.16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-05-02T15:13:32", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "description": "This host is installed with\n Mozilla Firefox and is prone to multiple vulnerabilities.", "modified": "2020-04-10T00:00:00", "published": "2020-04-08T00:00:00", "id": "OPENVAS:1361412562310816740", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310816740", "type": "openvas", "title": "Mozilla Firefox Security Updates( mfsa_2020-12_2020-13 )-Windows", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from the referenced\n# advisories, and are Copyright (C) by the respective right holder(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\n\nCPE = \"cpe:/a:mozilla:firefox\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.816740\");\n script_version(\"2020-04-10T03:46:49+0000\");\n script_cve_id(\"CVE-2020-6821\", \"CVE-2020-6822\", \"CVE-2020-6823\", \"CVE-2020-6824\",\n \"CVE-2020-6825\", \"CVE-2020-6826\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-04-10 03:46:49 +0000 (Fri, 10 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-04-08 15:55:20 +0530 (Wed, 08 Apr 2020)\");\n script_name(\"Mozilla Firefox Security Updates( mfsa_2020-12_2020-13 )-Windows\");\n\n script_tag(name:\"summary\", value:\"This host is installed with\n Mozilla Firefox and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on\n the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - A file overwrite issue in the user's profile directory.\n\n - An uninitialized memory could be read when using the WebGL copyTexSubImage\n method.\n\n - An out of bounds write issue in GMPDecodeData when processing large images.\n\n - Memory safety bugs.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allows remote\n attackers to execute arbitrary code and disclose sensitive data.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version before\n 75 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox version 75\n or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/firefox/new/\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_firefox_detect_win.nasl\");\n script_mandatory_keys(\"Firefox/Win/Ver\");\n script_xref(name:\"URL\", value:\"http://www.mozilla.com/en-US/firefox/all.html\");\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( ! infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE) ) exit( 0 );\nffVer = infos['version'];\nffPath = infos['location'];\n\nif(version_is_less(version:ffVer, test_version:\"75\"))\n{\n report = report_fixed_ver(installed_version:ffVer, fixed_version:\"75\", install_path:ffPath);\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "ubuntu": [{"lastseen": "2020-07-02T11:41:35", "bulletinFamily": "unix", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "description": "Multiple security issues were discovered in Firefox. If a user were \ntricked in to opening a specially crafted website, an attacker could \npotentially exploit these to cause a denial of service, obtain sensitive \ninformation, or execute arbitrary code. (CVE-2020-6821, CVE-2020-6822, \nCVE-2020-6824, CVE-2020-6825, CVE-2020-6826)\n\nIt was discovered that extensions could obtain auth codes from OAuth login \nflows in some circumstances. If a user were tricked in to installing a \nspecially crafted extension, an attacker could potentially exploit this to \nobtain access to the user's account. (CVE-2020-6823)", "edition": 3, "modified": "2020-04-07T00:00:00", "published": "2020-04-07T00:00:00", "id": "USN-4323-1", "href": "https://ubuntu.com/security/notices/USN-4323-1", "title": "Firefox vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2020-04-23T18:52:40", "bulletinFamily": "unix", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "description": "### Background\n\nMozilla Firefox is a popular open-source web browser from the Mozilla Project. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could entice a user to view a specially crafted web page, possibly resulting in the execution of arbitrary code with the privileges of the process, an information leak or a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Mozilla Firefox users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-client/firefox-68.7.0\"\n \n\nAll Mozilla Firefox binary users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-client/firefox-bin-68.7.0\"", "edition": 1, "modified": "2020-04-23T00:00:00", "published": "2020-04-23T00:00:00", "id": "GLSA-202004-11", "href": "https://security.gentoo.org/glsa/202004-11", "title": "Mozilla Firefox: Multiple vulnerabilities", "type": "gentoo", "cvss": {"score": 0.0, "vector": "NONE"}}], "kaspersky": [{"lastseen": "2020-09-02T12:03:27", "bulletinFamily": "info", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "description": "### *Detect date*:\n04/07/2020\n\n### *Severity*:\nHigh\n\n### *Description*:\nMultiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges.\n\n### *Affected products*:\nMozilla Firefox earlier than 75\n\n### *Solution*:\nUpdate to the latest version \n[Download Firefox](<https://www.mozilla.org/en-US/firefox/new/>)\n\n### *Original advisories*:\n[MFSA2020-12](<https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Mozilla Firefox](<https://threats.kaspersky.com/en/product/Mozilla-Firefox/>)\n\n### *CVE-IDS*:\n[CVE-2020-6822](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6822>)0.0Unknown \n[CVE-2020-6825](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6825>)0.0Unknown \n[CVE-2020-6826](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6826>)0.0Unknown \n[CVE-2020-6821](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6821>)0.0Unknown \n[CVE-2020-6823](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6823>)0.0Unknown \n[CVE-2020-6824](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6824>)0.0Unknown", "edition": 1, "modified": "2020-05-22T00:00:00", "published": "2020-04-07T00:00:00", "id": "KLA11725", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11725", "title": "\r KLA11725Multiple vulnerabilities in Mozilla Firefox ", "type": "kaspersky", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2020-09-14T15:45:44", "description": "The version of Firefox installed on the remote macOS or Mac OS X host is prior to 75.0. It is, therefore, affected by\nmultiple vulnerabilities as referenced in the mfsa2020-12 advisory. \n\n - Mozilla developers and community members Tyson Smith and Christian Holler reported \n memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs \n showed evidence of memory corruption and we presume that with enough effort some of \n these could have been exploited to run arbitrary code. (CVE-2020-6825) \n\n - When reading from areas partially or fully outside the source resource with WebGL's \n copyTexSubImage method, the specification requires the returned values be zero. \n Previously, this memory was uninitialized, leading to potentially sensitive data \n disclosure. (CVE-2020-6821)\n\n - On 32-bit builds, an out of bounds write could have occurred when processing an image\n larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could \n have been exploited to run arbitrary code. (CVE-2020-6822) \n\n - A malicious extension could have called browser.identity.launchWebAuthFlow, \n controlling the redirect_uri, and through the Promise returned, obtain the Auth \n code and gain access to the user's account at the service provider. (CVE-2020-6823)\n\n - Initially, a user opens a Private Browsing Window and generates a password for a site,\n then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the\n user had opened a new Private Browsing Window, revisited the same site, and generated\n a new password - the generated passwords would have been identical, rather than\n independent. (CVE-2020-6824) \n\n - Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory \n safety bugs present in Firefox 74. Some of these bugs showed evidence of memory \n corruption and we presume that with enough effort some of these could have been \n exploited to run arbitrary code. (CVE-2020-6826)\n\nNote that Nessus has not tested for this issue but has\ninstead relied only on the application's self-reported version number.", "edition": 3, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-04-07T00:00:00", "title": "Mozilla Firefox < 75.0 Multiple Vulnerabilities (mfsa2020-12)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "modified": "2020-04-07T00:00:00", "cpe": ["cpe:/a:mozilla:firefox"], "id": "MACOS_FIREFOX_75_0.NASL", "href": "https://www.tenable.com/plugins/nessus/135275", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\n# The descriptive text and package checks in this plugin were\n# extracted from Mozilla Foundation Security Advisory mfsa2020-12.\n# The text itself is copyright (C) Mozilla Foundation.\n\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(135275);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/04/09\");\n\n script_cve_id(\n \"CVE-2020-6821\",\n \"CVE-2020-6822\",\n \"CVE-2020-6823\",\n \"CVE-2020-6824\",\n \"CVE-2020-6825\",\n \"CVE-2020-6826\"\n );\n script_xref(name:\"MFSA\", value:\"2020-12\");\n\n script_name(english:\"Mozilla Firefox < 75.0 Multiple Vulnerabilities (mfsa2020-12)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Firefox installed on the remote macOS or Mac OS X host is prior to 75.0. It is, therefore, affected by\nmultiple vulnerabilities as referenced in the mfsa2020-12 advisory. \n\n - Mozilla developers and community members Tyson Smith and Christian Holler reported \n memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs \n showed evidence of memory corruption and we presume that with enough effort some of \n these could have been exploited to run arbitrary code. (CVE-2020-6825) \n\n - When reading from areas partially or fully outside the source resource with WebGL's \n copyTexSubImage method, the specification requires the returned values be zero. \n Previously, this memory was uninitialized, leading to potentially sensitive data \n disclosure. (CVE-2020-6821)\n\n - On 32-bit builds, an out of bounds write could have occurred when processing an image\n larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could \n have been exploited to run arbitrary code. (CVE-2020-6822) \n\n - A malicious extension could have called browser.identity.launchWebAuthFlow, \n controlling the redirect_uri, and through the Promise returned, obtain the Auth \n code and gain access to the user's account at the service provider. (CVE-2020-6823)\n\n - Initially, a user opens a Private Browsing Window and generates a password for a site,\n then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the\n user had opened a new Private Browsing Window, revisited the same site, and generated\n a new password - the generated passwords would have been identical, rather than\n independent. (CVE-2020-6824) \n\n - Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory \n safety bugs present in Firefox 74. Some of these bugs showed evidence of memory \n corruption and we presume that with enough effort some of these could have been \n exploited to run arbitrary code. (CVE-2020-6826)\n\nNote that Nessus has not tested for this issue but has\ninstead relied only on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Firefox version 75.0 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-6825\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_firefox_installed.nasl\");\n script_require_keys(\"MacOSX/Firefox/Installed\");\n\n exit(0);\n}\n\ninclude('mozilla_version.inc');\n\nkb_base = 'MacOSX/Firefox';\nget_kb_item_or_exit(kb_base+'/Installed');\n\nversion = get_kb_item_or_exit(kb_base+'/Version', exit_code:1);\npath = get_kb_item_or_exit(kb_base+'/Path', exit_code:1);\n\nis_esr = get_kb_item(kb_base+'/is_esr');\nif (is_esr) exit(0, 'The Mozilla Firefox installation is in the ESR branch.');\n\nmozilla_check_version(version:version, path:path, product:'firefox', esr:FALSE, fix:'75.0', severity:SECURITY_HOLE);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-09-14T19:29:23", "description": "Multiple security issues were discovered in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service, obtain\nsensitive information, or execute arbitrary code. (CVE-2020-6821,\nCVE-2020-6822, CVE-2020-6824, CVE-2020-6825, CVE-2020-6826)\n\nIt was discovered that extensions could obtain auth codes from OAuth\nlogin flows in some circumstances. If a user were tricked in to\ninstalling a specially crafted extension, an attacker could\npotentially exploit this to obtain access to the user's account.\n(CVE-2020-6823).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 7, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-04-08T00:00:00", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 19.10 : firefox vulnerabilities (USN-4323-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "modified": "2020-04-08T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:firefox", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:19.10"], "id": "UBUNTU_USN-4323-1.NASL", "href": "https://www.tenable.com/plugins/nessus/135284", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4323-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(135284);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/05/08\");\n\n script_cve_id(\"CVE-2020-6821\", \"CVE-2020-6822\", \"CVE-2020-6823\", \"CVE-2020-6824\", \"CVE-2020-6825\", \"CVE-2020-6826\");\n script_xref(name:\"USN\", value:\"4323-1\");\n script_xref(name:\"IAVA\", value:\"2020-A-0128-S\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 19.10 : firefox vulnerabilities (USN-4323-1)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security issues were discovered in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service, obtain\nsensitive information, or execute arbitrary code. (CVE-2020-6821,\nCVE-2020-6822, CVE-2020-6824, CVE-2020-6825, CVE-2020-6826)\n\nIt was discovered that extensions could obtain auth codes from OAuth\nlogin flows in some circumstances. If a user were tricked in to\ninstalling a specially crafted extension, an attacker could\npotentially exploit this to obtain access to the user's account.\n(CVE-2020-6823).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4323-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected firefox package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:19.10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/04/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/08\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04|19\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04 / 19.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"firefox\", pkgver:\"75.0+build3-0ubuntu0.16.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"firefox\", pkgver:\"75.0+build3-0ubuntu0.18.04.1\")) flag++;\nif (ubuntu_check(osver:\"19.10\", pkgname:\"firefox\", pkgver:\"75.0+build3-0ubuntu0.19.10.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"firefox\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-09-14T16:22:26", "description": "The version of Firefox installed on the remote Windows host is prior to 75.0. It is, therefore, affected by multiple\nvulnerabilities as referenced in the mfsa2020-12 advisory. \n\n - Mozilla developers and community members Tyson Smith and Christian Holler reported \n memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs \n showed evidence of memory corruption and we presume that with enough effort some of \n these could have been exploited to run arbitrary code. (CVE-2020-6825) \n\n - When reading from areas partially or fully outside the source resource with WebGL's \n copyTexSubImage method, the specification requires the returned values be zero. \n Previously, this memory was uninitialized, leading to potentially sensitive data \n disclosure. (CVE-2020-6821)\n\n - On 32-bit builds, an out of bounds write could have occurred when processing an image\n larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could \n have been exploited to run arbitrary code. (CVE-2020-6822) \n\n - A malicious extension could have called browser.identity.launchWebAuthFlow, \n controlling the redirect_uri, and through the Promise returned, obtain the Auth \n code and gain access to the user's account at the service provider. (CVE-2020-6823)\n\n - Initially, a user opens a Private Browsing Window and generates a password for a site,\n then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the\n user had opened a new Private Browsing Window, revisited the same site, and generated\n a new password - the generated passwords would have been identical, rather than\n independent. (CVE-2020-6824) \n\n - Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory \n safety bugs present in Firefox 74. Some of these bugs showed evidence of memory \n corruption and we presume that with enough effort some of these could have been \n exploited to run arbitrary code. (CVE-2020-6826)\n\nNote that Nessus has not tested for this issue but has\ninstead relied only on the application's self-reported version number.", "edition": 3, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-04-07T00:00:00", "title": "Mozilla Firefox < 75.0 (mfsa2020-12)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "modified": "2020-04-07T00:00:00", "cpe": ["cpe:/a:mozilla:firefox"], "id": "MOZILLA_FIREFOX_75_0.NASL", "href": "https://www.tenable.com/plugins/nessus/135276", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\n# The descriptive text and package checks in this plugin were\n# extracted from Mozilla Foundation Security Advisory mfsa2020-12.\n# The text itself is copyright (C) Mozilla Foundation.\n\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(135276);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/04/09\");\n\n script_cve_id(\n \"CVE-2020-6821\",\n \"CVE-2020-6822\",\n \"CVE-2020-6823\",\n \"CVE-2020-6824\",\n \"CVE-2020-6825\",\n \"CVE-2020-6826\"\n );\n script_xref(name:\"MFSA\", value:\"2020-12\");\n\n script_name(english:\"Mozilla Firefox < 75.0 (mfsa2020-12)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Firefox installed on the remote Windows host is prior to 75.0. It is, therefore, affected by multiple\nvulnerabilities as referenced in the mfsa2020-12 advisory. \n\n - Mozilla developers and community members Tyson Smith and Christian Holler reported \n memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs \n showed evidence of memory corruption and we presume that with enough effort some of \n these could have been exploited to run arbitrary code. (CVE-2020-6825) \n\n - When reading from areas partially or fully outside the source resource with WebGL's \n copyTexSubImage method, the specification requires the returned values be zero. \n Previously, this memory was uninitialized, leading to potentially sensitive data \n disclosure. (CVE-2020-6821)\n\n - On 32-bit builds, an out of bounds write could have occurred when processing an image\n larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could \n have been exploited to run arbitrary code. (CVE-2020-6822) \n\n - A malicious extension could have called browser.identity.launchWebAuthFlow, \n controlling the redirect_uri, and through the Promise returned, obtain the Auth \n code and gain access to the user's account at the service provider. (CVE-2020-6823)\n\n - Initially, a user opens a Private Browsing Window and generates a password for a site,\n then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the\n user had opened a new Private Browsing Window, revisited the same site, and generated\n a new password - the generated passwords would have been identical, rather than\n independent. (CVE-2020-6824) \n\n - Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory \n safety bugs present in Firefox 74. Some of these bugs showed evidence of memory \n corruption and we presume that with enough effort some of these could have been \n exploited to run arbitrary code. (CVE-2020-6826)\n\nNote that Nessus has not tested for this issue but has\ninstead relied only on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Firefox version 75.0 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-6825\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mozilla_org_installed.nasl\");\n script_require_keys(\"Mozilla/Firefox/Version\");\n\n exit(0);\n}\n\ninclude('mozilla_version.inc');\n\nport = get_kb_item(\"SMB/transport\");\nif (!port) port = 445;\n\ninstalls = get_kb_list(\"SMB/Mozilla/Firefox/*\");\nif (isnull(installs)) audit(AUDIT_NOT_INST, \"Firefox\");\n\nmozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'75.0', severity:SECURITY_HOLE);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-09-29T06:51:57", "description": "The remote host is affected by the vulnerability described in GLSA-202004-11\n(Mozilla Firefox: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Mozilla Firefox. Please\n review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could entice a user to view a specially crafted web\n page, possibly resulting in the execution of arbitrary code with the\n privileges of the process, an information leak or a Denial of Service\n condition.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 5, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-04-24T00:00:00", "title": "GLSA-202004-11 : Mozilla Firefox: Multiple vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-6826", "CVE-2020-6824", "CVE-2020-6822", "CVE-2020-6825", "CVE-2020-6821", "CVE-2020-6823"], "modified": "2020-04-24T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:firefox", "cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:firefox-bin"], "id": "GENTOO_GLSA-202004-11.NASL", "href": "https://www.tenable.com/plugins/nessus/135947", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 202004-11.\n#\n# The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(135947);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/28\");\n\n script_cve_id(\"CVE-2020-6821\", \"CVE-2020-6822\", \"CVE-2020-6823\", \"CVE-2020-6824\", \"CVE-2020-6825\", \"CVE-2020-6826\");\n script_xref(name:\"GLSA\", value:\"202004-11\");\n\n script_name(english:\"GLSA-202004-11 : Mozilla Firefox: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The remote host is affected by the vulnerability described in GLSA-202004-11\n(Mozilla Firefox: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Mozilla Firefox. Please\n review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could entice a user to view a specially crafted web\n page, possibly resulting in the execution of arbitrary code with the\n privileges of the process, an information leak or a Denial of Service\n condition.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/202004-11\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"All Mozilla Firefox users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=www-client/firefox-68.7.0'\n All Mozilla Firefox binary users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=www-client/firefox-bin-68.7.0'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:firefox-bin\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/04/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/24\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"www-client/firefox\", unaffected:make_list(\"ge 68.7.0\"), vulnerable:make_list(\"lt 68.7.0\"))) flag++;\nif (qpkg_check(package:\"www-client/firefox-bin\", unaffected:make_list(\"ge 68.7.0\"), vulnerable:make_list(\"lt 68.7.0\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Mozilla Firefox\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}
