Mozilla Firefox < 63.0

#%NASL_MIN_LEVEL 80900
## 
# (C) Tenable, Inc.
#                                  
# The descriptive text and package checks in this plugin were
# extracted from Mozilla Foundation Security Advisory mfsa2018-26.
# The text itself is copyright (C) Mozilla Foundation.
## 

include('compat.inc');

if (description)
{
  script_id(275622);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/18");

  script_cve_id(
    "CVE-2018-12388",
    "CVE-2018-12390",
    "CVE-2018-12391",
    "CVE-2018-12392",
    "CVE-2018-12393",
    "CVE-2018-12395",
    "CVE-2018-12396",
    "CVE-2018-12397",
    "CVE-2018-12398",
    "CVE-2018-12399",
    "CVE-2018-12400",
    "CVE-2018-12401",
    "CVE-2018-12402",
    "CVE-2018-12403"
  );
  script_xref(name:"IAVA", value:"2018-A-0348-S");

  script_name(english:"Mozilla Firefox < 63.0");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Firefox installed on the remote macOS or Mac OS X host is prior to 63.0. It is, therefore, affected by
multiple vulnerabilities as referenced in the mfsa2018-26 advisory.

  - When manipulating user events in nested loops while opening a document through script, it is possible to
    trigger a potentially exploitable crash due to poor event handling. (CVE-2018-12392)

  - During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in
    violation of security policies. Because the problem is in the underlying Android service, this issue is
    addressed by treating all HLS streams as cross-origin and opaque to access.  Note: this issue only affects
    Firefox for Android. Desktop versions of Firefox are unaffected. (CVE-2018-12391)

  - A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of
    scripts to an internal UTF-16 representation could result in allocating a buffer too small for the
    conversion. This leads to a possible out-of-bounds write.  Note: 64-bit builds are not vulnerable to this
    issue. (CVE-2018-12393)

  - By rewriting the <code>Host</code> request headers using the <code>webRequest</code> API, a WebExtension
    can bypass domain restrictions through domain fronting. This would allow access to domains that share a
    host that are otherwise restricted. (CVE-2018-12395)

  - A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation
    or other events. This allows for potential privilege escalation by the WebExtension on sites where content
    scripts should not be run. (CVE-2018-12396)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mozilla Firefox version 63.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-12391");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2018-12392");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_firefox_installed.nasl");
  script_require_keys("installed_sw/Mozilla Firefox");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "macos"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Mozilla Firefox",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "63.0"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);