AlmaLinux 9 : firefox (ALSA-2026:27734)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# AlmaLinux Security Advisory ALSA-2026:27734.
##

include('compat.inc');

if (description)
{
  script_id(322283);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/24");

  script_cve_id(
    "CVE-2026-12289",
    "CVE-2026-12290",
    "CVE-2026-12291",
    "CVE-2026-12292",
    "CVE-2026-12294",
    "CVE-2026-12295",
    "CVE-2026-12296",
    "CVE-2026-12297",
    "CVE-2026-12298",
    "CVE-2026-12299",
    "CVE-2026-12302",
    "CVE-2026-12304",
    "CVE-2026-12305",
    "CVE-2026-12306",
    "CVE-2026-12307",
    "CVE-2026-12308",
    "CVE-2026-12309",
    "CVE-2026-12310",
    "CVE-2026-12311",
    "CVE-2026-12312",
    "CVE-2026-12313",
    "CVE-2026-12314",
    "CVE-2026-12315",
    "CVE-2026-12324",
    "CVE-2026-12325",
    "CVE-2026-12327",
    "CVE-2026-12328",
    "CVE-2026-12329",
    "CVE-2026-12330"
  );
  script_xref(name:"ALSA", value:"2026:27734");
  script_xref(name:"RHSA", value:"2026:27734");

  script_name(english:"AlmaLinux 9 : firefox (ALSA-2026:27734)");

  script_set_attribute(attribute:"synopsis", value:
"The remote AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the
ALSA-2026:27734 advisory.

    * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)
      * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing
    component (CVE-2026-12313)
      * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing
    component (CVE-2026-12311)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox
    152 and Thunderbird 152 (CVE-2026-12327)
      * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)
      * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird
    ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)
      * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component
    (CVE-2026-12330)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)
      * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)
      * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)
      * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)
      * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)
      * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307)
      * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component
    (CVE-2026-12297)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305)
      * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292)
      * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308)
      * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component
    (CVE-2026-12324)
      * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304)
      * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291)
      * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://errata.almalinux.org/9/ALSA-2026-27734.html");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2026:27734");
  script_set_attribute(attribute:"solution", value:
"Update the affected firefox and / or firefox-x11 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-12297");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(1286, 131, 243, 266, 346, 403, 653, 733, 787, 807, 823, 825, 843);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alma:linux:firefox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alma:linux:firefox-x11");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::appstream");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::baseos");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::crb");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::highavailability");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::nfv");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::realtime");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::resilientstorage");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::sap");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::sap_hana");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alma:linux:9::supplementary");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.x', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);

var constraints = [
  {
    'release': '9',
    'pkgs': [
      {'reference':'firefox-140.12.0-1.el9_8.alma.1', 'cpu':'aarch64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE},
      {'reference':'firefox-140.12.0-1.el9_8.alma.1', 'cpu':'ppc64le', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE},
      {'reference':'firefox-140.12.0-1.el9_8.alma.1', 'cpu':'s390x', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE},
      {'reference':'firefox-140.12.0-1.el9_8.alma.1', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE},
      {'reference':'firefox-x11-140.12.0-1.el9_8.alma.1', 'cpu':'aarch64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE},
      {'reference':'firefox-x11-140.12.0-1.el9_8.alma.1', 'cpu':'ppc64le', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE},
      {'reference':'firefox-x11-140.12.0-1.el9_8.alma.1', 'cpu':'s390x', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE},
      {'reference':'firefox-x11-140.12.0-1.el9_8.alma.1', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'firefox / firefox-x11');
}