Mozilla Firefox < 61.0

#%NASL_MIN_LEVEL 80900
## 
# (C) Tenable, Inc.
#                                  
# The descriptive text and package checks in this plugin were
# extracted from Mozilla Foundation Security Advisory mfsa2018-15.
# The text itself is copyright (C) Mozilla Foundation.
## 

include('compat.inc');

if (description)
{
  script_id(275661);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/18");

  script_cve_id(
    "CVE-2018-5156",
    "CVE-2018-5186",
    "CVE-2018-5187",
    "CVE-2018-5188",
    "CVE-2018-12358",
    "CVE-2018-12359",
    "CVE-2018-12360",
    "CVE-2018-12361",
    "CVE-2018-12362",
    "CVE-2018-12363",
    "CVE-2018-12364",
    "CVE-2018-12365",
    "CVE-2018-12366",
    "CVE-2018-12367",
    "CVE-2018-12368",
    "CVE-2018-12369",
    "CVE-2018-12370",
    "CVE-2018-12371"
  );
  script_xref(name:"IAVA", value:"2018-A-0200-S");

  script_name(english:"Mozilla Firefox < 61.0");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Firefox installed on the remote macOS or Mac OS X host is prior to 61.0. It is, therefore, affected by
multiple vulnerabilities as referenced in the mfsa2018-15 advisory.

  - Mozilla developers and community members Alex Gaynor, Christoph Diehl, Christian Holler, Jason Kratzer,
    David Major, Jon Coppeard, Nicolas B. Pierron, Jason Kratzer, Marcia Knous, and Ronald Crane reported
    memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed
    evidence of memory corruption and we presume that with enough effort that some of these could be exploited
    to run arbitrary code. (CVE-2018-5188)

  - Windows 10 does not warn users before opening executable files with the <code>SettingContent-ms</code>
    extension even when they have been downloaded from the internet and have the Mark of the Web. Without
    the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This
    also allows a WebExtension with the limited <code>downloads.open</code> permission to execute arbitrary
    code without user interaction on Windows 10 systems  Note: this issue only affects Windows operating
    systems. Other operating systems are unaffected. (CVE-2018-12368)

  - A buffer overflow can occur when rendering canvas content while adjusting the height and width of the
    <code><canvas></code> element dynamically, causing data to be written outside of the currently
    computed boundaries. This results in a potentially exploitable crash. (CVE-2018-12359)

  - A use-after-free vulnerability can occur when deleting an <code>input</code> element during a mutation
    event handler triggered by focusing that element. This results in a potentially exploitable crash.
    (CVE-2018-12360)

  - An integer overflow can occur in the <code>SwizzleData</code> code while calculating buffer sizes. The
    overflowed value is used for subsequent graphics computations when their inputs are not sanitized which
    results in a potentially exploitable crash. (CVE-2018-12361)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mozilla Firefox version 61.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-12368");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2018-5188");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/06/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_firefox_installed.nasl");
  script_require_keys("installed_sw/Mozilla Firefox");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "macos"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Mozilla Firefox",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "61.0"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);