The remote NewStart CGSL host, running firefox MAIN 4.06, has multiple vulnerabilities affecting Firefox versions 73.0.3683.75 or prior, < 65.0.1, < 66, ESR < 60.7.2, < 67.0.4, < 67.0.3
Reporter | Title | Published | Views | Family All 199 |
---|---|---|---|---|
![]() | firefox security update | 29 May 201919:47 | – | centos |
![]() | thunderbird security update | 10 Jun 201922:49 | – | centos |
![]() | firefox security update | 29 May 201919:48 | – | centos |
![]() | thunderbird security update | 10 Jun 201922:30 | – | centos |
![]() | firefox security update | 1 Jul 201915:56 | – | centos |
![]() | firefox security update | 1 Jul 201915:53 | – | centos |
![]() | [SECURITY] [DLA 1800-1] firefox-esr security update | 23 May 201909:40 | – | debian |
![]() | [SECURITY] [DSA 4451-1] thunderbird security update | 24 May 201921:01 | – | debian |
![]() | [SECURITY] [DLA 1806-1] thunderbird security update | 27 May 201908:46 | – | debian |
![]() | [SECURITY] [DSA 4448-1] firefox-esr security update | 22 May 201921:24 | – | debian |
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2019-0175. The text
# itself is copyright (C) ZTE, Inc.
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(128691);
script_version("1.16");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/04/25");
script_cve_id(
"CVE-2018-18511",
"CVE-2019-5798",
"CVE-2019-7317",
"CVE-2019-9797",
"CVE-2019-9800",
"CVE-2019-9816",
"CVE-2019-9817",
"CVE-2019-9819",
"CVE-2019-9820",
"CVE-2019-11691",
"CVE-2019-11692",
"CVE-2019-11693",
"CVE-2019-11698",
"CVE-2019-11707",
"CVE-2019-11708"
);
script_bugtraq_id(107009);
script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/06/13");
script_xref(name:"CEA-ID", value:"CEA-2021-0025");
script_xref(name:"CEA-ID", value:"CEA-2019-0458");
script_name(english:"NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2019-0175)");
script_set_attribute(attribute:"synopsis", value:
"The remote machine is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 4.06, has firefox packages installed that are affected by multiple
vulnerabilities:
- Lack of correct bounds checking in Skia in Google Chrome
prior to 73.0.3683.75 allowed a remote attacker to
perform an out of bounds memory read via a crafted HTML
page. (CVE-2019-5798)
- Cross-origin images can be read from a canvas element in
violation of the same-origin policy using the
transferFromImageBitmap method. *Note: This only affects
Firefox 65. Previous versions are unaffected.*. This
vulnerability affects Firefox < 65.0.1. (CVE-2018-18511)
- Cross-origin images can be read in violation of the
same-origin policy by exporting an image after using
createImageBitmap to read the image and then rendering
the resulting bitmap image within a canvas element. This
vulnerability affects Firefox < 66. (CVE-2019-9797)
- Insufficient vetting of parameters passed with the
Prompt:Open IPC message between child and parent
processes can result in the non-sandboxed parent process
opening web content chosen by a compromised child
process. When combined with additional vulnerabilities
this could result in executing arbitrary code on the
user's computer. This vulnerability affects Firefox ESR
< 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
(CVE-2019-11708)
- A type confusion vulnerability can occur when
manipulating JavaScript objects due to issues in
Array.pop. This can allow for an exploitable crash. We
are aware of targeted attacks in the wild abusing this
flaw. This vulnerability affects Firefox ESR < 60.7.1,
Firefox < 67.0.3, and Thunderbird < 60.7.2.
(CVE-2019-11707)
- png_image_free in png.c in libpng 1.6.x before 1.6.37
has a use-after-free because png_image_free_function is
called under png_safe_execute. (CVE-2019-7317)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0175");
script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL firefox packages. Note that updated packages may not be available yet. Please contact ZTE
for more information.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-11708");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/04");
script_set_attribute(attribute:"patch_publication_date", value:"2019/08/29");
script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"NewStart CGSL Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/ZTE-CGSL/release");
if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
if (release !~ "CGSL MAIN 4.06")
audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 4.06');
if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
flag = 0;
pkgs = {
"CGSL MAIN 4.06": [
"firefox-60.8.0-1.el6.centos",
"firefox-debuginfo-60.8.0-1.el6.centos"
]
};
pkg_list = pkgs[release];
foreach (pkg in pkg_list)
if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox");
}
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo