Ubuntu: Security Advisory (USN-6747-2)

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.1.12.2024.6747.2");
  script_cve_id("CVE-2024-3302", "CVE-2024-3852", "CVE-2024-3853", "CVE-2024-3854", "CVE-2024-3855", "CVE-2024-3856", "CVE-2024-3857", "CVE-2024-3858", "CVE-2024-3859", "CVE-2024-3860", "CVE-2024-3861", "CVE-2024-3862", "CVE-2024-3864", "CVE-2024-3865");
  script_tag(name:"creation_date", value:"2024-05-02 11:46:08 +0000 (Thu, 02 May 2024)");
  script_version("2024-05-03T05:05:25+0000");
  script_tag(name:"last_modification", value:"2024-05-03 05:05:25 +0000 (Fri, 03 May 2024)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");

  script_name("Ubuntu: Security Advisory (USN-6747-2)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("Ubuntu Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/ubuntu_linux", "ssh/login/packages", re:"ssh/login/release=UBUNTU20\.04\ LTS");

  script_xref(name:"Advisory-ID", value:"USN-6747-2");
  script_xref(name:"URL", value:"https://ubuntu.com/security/notices/USN-6747-2");
  script_xref(name:"URL", value:"https://launchpad.net/bugs/2064553");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'firefox' package(s) announced via the USN-6747-2 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"USN-6747-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.

Original advisory details:

 Multiple security issues were discovered in Firefox. If a user were
 tricked into opening a specially crafted website, an attacker could
 potentially exploit these to cause a denial of service, obtain sensitive
 information across domains, or execute arbitrary code. (CVE-2024-3852,
 CVE-2024-3864, CVE-2024-3865)

 Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2
 CONTINUATION frames. An attacker could potentially exploit this issue to
 cause a denial of service. (CVE-2024-3302)

 Gary Kwong discovered that Firefox did not properly manage memory when
 running garbage collection during realm initialization. An attacker could
 potentially exploit this issue to cause a denial of service, or execute
 arbitrary code. (CVE-2024-3853)

 Lukas Bernhard discovered that Firefox did not properly manage memory
 during JIT optimisations, leading to an out-of-bounds read vulnerability.
 An attacker could possibly use this issue to cause a denial of service or
 expose sensitive information. (CVE-2024-3854, CVE-2024-3855)

 Nan Wang discovered that Firefox did not properly manage memory during
 WASM garbage collection. An attacker could potentially exploit this issue
 to cause a denial of service, or execute arbitrary code. (CVE-2024-3856)

 Lukas Bernhard discovered that Firefox did not properly manage memory
 when handling JIT created code during garbage collection. An attacker
 could potentially exploit this issue to cause a denial of service, or
 execute arbitrary code. (CVE-2024-3857)

 Lukas Bernhard discovered that Firefox did not properly manage memory when
 tracing in JIT. An attacker could potentially exploit this issue to cause
 a denial of service. (CVE-2024-3858)

 Ronald Crane discovered that Firefox did not properly manage memory in the
 OpenType sanitizer on 32-bit devices, leading to an out-of-bounds read
 vulnerability. An attacker could possibly use this issue to cause a denial
 of service or expose sensitive information. (CVE-2024-3859)

 Garry Kwong discovered that Firefox did not properly manage memory when
 tracing empty shape lists in JIT. An attacker could potentially exploit
 this issue to cause a denial of service. (CVE-2024-3860)

 Ronald Crane discovered that Firefox did not properly manage memory when
 handling an AlignedBuffer. An attacker could potentially exploit this
 issue to cause denial of service, or execute arbitrary code.
 (CVE-2024-3861)

 Ronald Crane discovered that Firefox did not properly manage memory when
 handling code in MarkStack. An attacker could possibly use this issue to
 cause a denial of service or execute arbitrary code. (CVE-2024-3862)");

  script_tag(name:"affected", value:"'firefox' package(s) on Ubuntu 20.04.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-deb.inc");

release = dpkg_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "UBUNTU20.04 LTS") {

  if(!isnull(res = isdpkgvuln(pkg:"firefox", ver:"125.0.3+build1-0ubuntu0.20.04.1", rls:"UBUNTU20.04 LTS"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);