TencentOS Server 3: firefox (TSSA-2026:0820)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0820.
##

include('compat.inc');

if (description)
{
  script_id(333135);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/06");

  script_cve_id(
    "CVE-2026-15718",
    "CVE-2026-15719",
    "CVE-2026-16349",
    "CVE-2026-16350",
    "CVE-2026-16351",
    "CVE-2026-16352",
    "CVE-2026-16353",
    "CVE-2026-16354",
    "CVE-2026-16355",
    "CVE-2026-16356",
    "CVE-2026-16357",
    "CVE-2026-16358",
    "CVE-2026-16359",
    "CVE-2026-16360",
    "CVE-2026-16361",
    "CVE-2026-16362",
    "CVE-2026-16363",
    "CVE-2026-16368",
    "CVE-2026-16369",
    "CVE-2026-16371",
    "CVE-2026-16374",
    "CVE-2026-16375",
    "CVE-2026-16377",
    "CVE-2026-16379",
    "CVE-2026-16381",
    "CVE-2026-16383",
    "CVE-2026-16387",
    "CVE-2026-16390",
    "CVE-2026-16391",
    "CVE-2026-16396",
    "CVE-2026-16405",
    "CVE-2026-16412",
    "CVE-2026-56208"
  );
  script_xref(name:"IAVA", value:"2026-A-0695-S");
  script_xref(name:"IAVA", value:"2026-A-0755");

  script_name(english:"TencentOS Server 3: firefox (TSSA-2026:0820)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0820 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-15718:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    We are aware that exploit code for this is public however we are not aware of any attacks in the wild
    abusing this flaw.

    CVE-2026-15719:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    We are aware that exploit code for this is public however we are not aware of any attacks in the wild
    abusing this flaw.

    CVE-2026-16349:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Same-origin policy bypass in the DOM: Navigation component

    CVE-2026-16350:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Incorrect boundary conditions in the Audio/Video: cubeb component

    CVE-2026-16351:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Sandbox escape due to use-after-free in the DOM: Navigation component

    CVE-2026-16352:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Sandbox escape due to use-after-free in the Disability Access APIs component

    CVE-2026-16353:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Invalid pointer in the DOM: Bindings (WebIDL) component

    CVE-2026-16354:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Information disclosure in the Graphics: ImageLib component

    CVE-2026-16355:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    JIT miscompilation in the JavaScript Engine: JIT component

    CVE-2026-16356:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Sandbox escape due to use-after-free in the Disability Access APIs component

    CVE-2026-16357:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Incorrect boundary conditions in the Graphics component

    CVE-2026-16358:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Site isolation issue in the Graphics: WebRender component

    CVE-2026-16359:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Incorrect boundary conditions in the Audio/Video: GMP component

    CVE-2026-16360:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed
    evidence of memory corruption and we presume that with enough effort some of these could have been
    exploited to run arbitrary code.

    CVE-2026-16361:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory
    corruption and we presume that with enough effort some of these could have been exploited to run arbitrary
    code.

    CVE-2026-16362:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Use-after-free in the WebRTC: Audio/Video component

    CVE-2026-16363:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    JIT miscompilation in the JavaScript: WebAssembly component

    CVE-2026-16368:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Incorrect boundary conditions in the JavaScript: WebAssembly component

    CVE-2026-16369:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Integer overflow in the JavaScript: WebAssembly component

    CVE-2026-16371:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Privilege escalation in the DOM: Navigation component

    CVE-2026-16374:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Information disclosure in the Framework component in DevTools

    CVE-2026-16375:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Site isolation issue in the Networking: HTTP component

    CVE-2026-16377:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Mitigation bypass in the PDF Viewer component

    CVE-2026-16379:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Privilege escalation in the DOM: Content Processes component

    CVE-2026-16381:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Same-origin policy bypass in the Networking: DNS component

    CVE-2026-16383:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Mitigation bypass in the DOM: Networking component

    CVE-2026-16387:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Site isolation issue in the Networking component

    CVE-2026-16390:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Mitigation bypass in the Enterprise Policies component

    CVE-2026-16391:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Information disclosure in the Storage: IndexedDB component

    CVE-2026-16396:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Privilege escalation in WebExtensions

    CVE-2026-16405:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Information disclosure in the Networking: WebSockets component

    CVE-2026-16412:
    A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the
    following issue:
    Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed
    evidence of memory corruption and we presume that with enough effort some of these could have been
    exploited to run arbitrary code.

    CVE-2026-56208:
    A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw
    in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around
    guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds
    write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can
    influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a
    denial of service (process crash) or potentially achieve code execution.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260820.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-16412");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:firefox");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'firefox-140.13.0-1.tl3.ap.1', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-140.13.0-1.tl3.ap.1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-debuginfo-140.13.0-1.tl3.ap.1', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-debuginfo-140.13.0-1.tl3.ap.1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-debugsource-140.13.0-1.tl3.ap.1', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-debugsource-140.13.0-1.tl3.ap.1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'firefox / firefox-debuginfo / firefox-debugsource');
}