Mozilla Firefox < 60.0

#%NASL_MIN_LEVEL 80900
## 
# (C) Tenable, Inc.
#                                  
# The descriptive text and package checks in this plugin were
# extracted from Mozilla Foundation Security Advisory mfsa2018-11.
# The text itself is copyright (C) Mozilla Foundation.
## 

include('compat.inc');

if (description)
{
  script_id(275694);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/18");

  script_cve_id(
    "CVE-2018-5150",
    "CVE-2018-5151",
    "CVE-2018-5152",
    "CVE-2018-5153",
    "CVE-2018-5154",
    "CVE-2018-5155",
    "CVE-2018-5157",
    "CVE-2018-5158",
    "CVE-2018-5159",
    "CVE-2018-5160",
    "CVE-2018-5163",
    "CVE-2018-5164",
    "CVE-2018-5165",
    "CVE-2018-5166",
    "CVE-2018-5167",
    "CVE-2018-5168",
    "CVE-2018-5169",
    "CVE-2018-5172",
    "CVE-2018-5173",
    "CVE-2018-5174",
    "CVE-2018-5175",
    "CVE-2018-5176",
    "CVE-2018-5177",
    "CVE-2018-5179",
    "CVE-2018-5180",
    "CVE-2018-5181",
    "CVE-2018-5182"
  );
  script_xref(name:"IAVA", value:"2018-A-0160-S");

  script_name(english:"Mozilla Firefox < 60.0");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Firefox installed on the remote macOS or Mac OS X host is prior to 60.0. It is, therefore, affected by
multiple vulnerabilities as referenced in the mfsa2018-11 advisory.

  - Mozilla developers and community members Christoph Diehl, Christian Holler, Jon Coppeard, Jason Kratzer,
    Nathan Froyd, Paul Theriault, Ryan VanderMeulen, Tyson Smith, Sebastian Hengst, Byron Campen, Emilio Cobos
    lvarez, Ronald Crane, and Phillipp reported memory safety bugs present in Firefox 59. Some of these bugs
    showed evidence of memory corruption and we presume that with enough effort that some of these could be
    exploited to run arbitrary code. (CVE-2018-5151)

  - An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer
    overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable
    crash triggerable by web content. (CVE-2018-5159)

  - A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip
    paths. This results in a potentially exploitable crash. (CVE-2018-5154)

  - A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths.
    This results in a potentially exploitable crash. (CVE-2018-5155)

  - Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept
    messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an
    authenticated user on a third-party website. (CVE-2018-5157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mozilla Firefox version 60.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-5151");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2018-5159");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/05/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_firefox_installed.nasl");
  script_require_keys("installed_sw/Mozilla Firefox");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "macos"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Mozilla Firefox",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "60.0"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);