Lucene search

K

Ubuntu: Security Advisory (USN-6649-1)

🗓️ 22 Feb 2024 00:00:00Reported by Copyright (C) 2024 Greenbone AGType 
openvas
 openvas
🔗 plugins.openvas.org👁 15 Views

The remote host is missing an update for the 'firefox' package(s) announced via the USN-6649-1 advisory. Multiple security issues were discovered in Firefox that could lead to denial of service, sensitive information leakage, and arbitrary code execution. Ubuntu 20.04 is affected

Show more
Related
Refs
Code
ReporterTitlePublishedViews
Family
Kaspersky
KLA64088 Multiple vulnerabilities in Mozilla Firefox
20 Feb 202400:00
kaspersky
Kaspersky
KLA64089 Multiple vulnerabilities in Mozilla Firefox ESR
20 Feb 202400:00
kaspersky
Kaspersky
KLA64090 Multiple vulnerabilities in Mozilla Thunderbird
20 Feb 202400:00
kaspersky
Ubuntu
Firefox regressions
6 Mar 202400:00
ubuntu
Ubuntu
Firefox vulnerabilities
22 Feb 202400:00
ubuntu
Ubuntu
Thunderbird vulnerabilities
4 Mar 202400:00
ubuntu
Gentoo Linux
Mozilla Firefox: Multiple Vulnerabilities
5 May 202400:00
gentoo
Gentoo Linux
Mozilla Thunderbird: Multiple Vulnerabilities
12 May 202400:00
gentoo
OpenVAS
Mozilla Firefox Security Update (mfsa_2024-05) - Mac OS X
21 Feb 202400:00
openvas
OpenVAS
Ubuntu: Security Advisory (USN-6649-2)
6 Mar 202400:00
openvas
Rows per page
# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.1.12.2024.6649.1");
  script_cve_id("CVE-2024-1546", "CVE-2024-1547", "CVE-2024-1548", "CVE-2024-1549", "CVE-2024-1550", "CVE-2024-1551", "CVE-2024-1552", "CVE-2024-1553", "CVE-2024-1554", "CVE-2024-1555", "CVE-2024-1556", "CVE-2024-1557");
  script_tag(name:"creation_date", value:"2024-02-22 10:31:46 +0000 (Thu, 22 Feb 2024)");
  script_version("2025-01-09T06:16:22+0000");
  script_tag(name:"last_modification", value:"2025-01-09 06:16:22 +0000 (Thu, 09 Jan 2025)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2024-12-10 17:46:14 +0000 (Tue, 10 Dec 2024)");

  script_name("Ubuntu: Security Advisory (USN-6649-1)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("Ubuntu Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/ubuntu_linux", "ssh/login/packages", re:"ssh/login/release=UBUNTU20\.04\ LTS");

  script_xref(name:"Advisory-ID", value:"USN-6649-1");
  script_xref(name:"URL", value:"https://ubuntu.com/security/notices/USN-6649-1");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'firefox' package(s) announced via the USN-6649-1 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-1547,
CVE-2024-1548, CVE-2024-1549, CVE-2024-1550, CVE-2024-1553, CVE-2024-1554,
CVE-2024-1555, CVE-2024-1557)

Alfred Peters discovered that Firefox did not properly manage memory when
storing and re-accessing data on a networking channel. An attacker could
potentially exploit this issue to cause a denial of service.
(CVE-2024-1546)

Johan Carlsson discovered that Firefox incorrectly handled Set-Cookie
response headers in multipart HTTP responses. An attacker could
potentially exploit this issue to inject arbitrary cookie values.
(CVE-2024-1551)

Gary Kwong discovered that Firefox incorrectly generated codes on 32-bit
ARM devices, which could lead to unexpected numeric conversions or
undefined behaviour. An attacker could possibly use this issue to cause a
denial of service. (CVE-2024-1552)

Ronald Crane discovered that Firefox did not properly manage memory when
accessing the built-in profiler. An attacker could potentially exploit
this issue to cause a denial of service. (CVE-2024-1556)");

  script_tag(name:"affected", value:"'firefox' package(s) on Ubuntu 20.04.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-deb.inc");

release = dpkg_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "UBUNTU20.04 LTS") {

  if(!isnull(res = isdpkgvuln(pkg:"firefox", ver:"123.0+build3-0ubuntu0.20.04.1", rls:"UBUNTU20.04 LTS"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo