This update for MozillaFirefox fixes the following issues :

  - Firefox Extended Support Release 78.6.0 ESR

  - Fixed: Various stability, functionality, and security     fixes MFSA 2020-55 (bsc#1180039)

  - CVE-2020-16042 (bmo#1679003) Operations on a BigInt     could have caused uninitialized memory to be exposed

  - CVE-2020-26971 (bmo#1663466) Heap buffer overflow in     WebGL

  - CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed     incorrect sanitization

  - CVE-2020-26974 (bmo#1681022) Incorrect cast of     StyleGenericFlexBasis resulted in a heap use-after-free

  - CVE-2020-26978 (bmo#1677047) Internal network hosts     could have been probed by a malicious webpage

  - CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did     not catch view-source URLs

  - CVE-2020-35112 (bmo#1661365) Opening an extension-less     download may have inadvertently launched an executable     instead

  - CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety     bugs fixed in Firefox 84 and Firefox ESR 78.6

This update was imported from the SUSE:SLE-15:Update update project.

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or information leak.

For Debian 9 stretch, these problems have been fixed in version 1:78.6.0-1~deb9u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5618 advisory.

  - chromium-browser: Uninitialized Use in V8 (CVE-2020-16042)

  - Mozilla: Heap buffer overflow in WebGL (CVE-2020-26971)

  - Mozilla: CSS Sanitizer performed incorrect sanitization (CVE-2020-26973)

  - Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free (CVE-2020-26974)

  - Mozilla: Internal network hosts could have been probed by a malicious webpage (CVE-2020-26978)

  - Mozilla: The proxy.onRequest API did not catch view-source URLs (CVE-2020-35111)

  - Mozilla: Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 (CVE-2020-35113)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5562 advisory.

  - chromium-browser: Uninitialized Use in V8 (CVE-2020-16042)

  - Mozilla: Heap buffer overflow in WebGL (CVE-2020-26971)

  - Mozilla: CSS Sanitizer performed incorrect sanitization (CVE-2020-26973)

  - Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free (CVE-2020-26974)

  - Mozilla: Internal network hosts could have been probed by a malicious webpage (CVE-2020-26978)

  - Mozilla: The proxy.onRequest API did not catch view-source URLs (CVE-2020-35111)

  - Mozilla: Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 (CVE-2020-35113)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5644 advisory.

  - chromium-browser: Uninitialized Use in V8 (CVE-2020-16042)

  - Mozilla: Stack overflow due to incorrect parsing of SMTP server response codes (CVE-2020-26970)

  - Mozilla: Heap buffer overflow in WebGL (CVE-2020-26971)

  - Mozilla: CSS Sanitizer performed incorrect sanitization (CVE-2020-26973)

  - Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free (CVE-2020-26974)

  - Mozilla: Internal network hosts could have been probed by a malicious webpage (CVE-2020-26978)

  - Mozilla: The proxy.onRequest API did not catch view-source URLs (CVE-2020-35111)

  - Mozilla: Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 (CVE-2020-35113)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were discovered in the Chromium web browser, which could result in the execution of arbitrary code, denial of service or information disclosure.

The remote NewStart CGSL host, running version MAIN 6.02, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR <     78.6. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6,     and Firefox ESR < 78.6. (CVE-2020-26973)

  - When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly     cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially     exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
    (CVE-2020-26974)

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - Using techniques that built on the slipstream research, a malicious webpage could have exposed both an     internal network's hosts as well as services running on the user's local machine. This vulnerability     affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. (CVE-2020-26978)

  - When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback     was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening     View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84,     Thunderbird < 78.6, and Firefox ESR < 78.6. (CVE-2020-35111)

  - Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and     Firefox ESR < 78.6. (CVE-2020-35113)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. This vulnerability affects Firefox <     85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects     Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23954)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox     ESR < 78.7. (CVE-2021-23960)

  - Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and     Firefox ESR < 78.7. (CVE-2021-23964)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If that's not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,     and the content of that error may have revealed information about the resource. This vulnerability affects     Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. (CVE-2021-23973)

  - Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and     Firefox ESR < 78.8. (CVE-2021-23978)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
    (CVE-2021-23982)

  - A malicious extension could have opened a popup window lacking an address bar. The title of the popup     lacking an address bar should not be fully controllable, but in this situation was. This could have been     used to spoof a website and attempt to trick the user into providing credentials. This vulnerability     affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23984)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR     78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9,     Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23987)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - chromium-browser: Heap buffer overflow in clipboard (CVE-2020-16025)

  - chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

  - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace     nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or     possibly have unspecified other impact via a crafted document. (CVE-2016-1683)

  - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format     token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or     resource consumption) or possibly have unspecified other impact via a crafted document. (CVE-2016-1684)

  - Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++     before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote     attacker to perform an out of bounds memory read via a crafted HTML page. (CVE-2017-15422)

  - An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is     affected. The issue involves the SQLite component. It allows remote attackers to execute arbitrary code     or cause a denial of service (memory corruption and application crash) via a crafted web site.
    (CVE-2017-7000)

  - Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16014)

  - Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16015)

  - Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16018)

  - Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16019)

  - Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass discretionary access control via a     malicious file. (CVE-2020-16020)

  - Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had     compromised the browser process to perform OS-level privilege escalation via a malicious file.
    (CVE-2020-16021)

  - Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to potentially bypass firewall controls via a crafted HTML page. (CVE-2020-16022)

  - Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16023)

  - Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16024)

  - Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-16026)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an     attacker who convinced a user to install a malicious extension to obtain potentially sensitive information     from the user's disk via a crafted Chrome Extension. (CVE-2020-16027)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16028)

  - Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     bypass navigation restrictions via a crafted PDF file. (CVE-2020-16029)

  - Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (CVE-2020-16030)

  - Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16031)

  - Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16032)

  - Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof security UI via a crafted HTML page. (CVE-2020-16033)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to     bypass policy restrictions via a crafted HTML page. (CVE-2020-16034)

  - Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16035)

  - Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to bypass cookie restrictions via a crafted HTML page. (CVE-2020-16036)

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Chrome Releases reports :

This release contains 8 security fixes, including :

- [1142331] High CVE-2020-16037: Use after free in clipboard. Reported by Ryoya Tsukasaki on 2020-10-26

- [1138683] High CVE-2020-16038: Use after free in media. Reported by Khalil Zhani on 2020-10-14

- [1149177] High CVE-2020-16039: Use after free in extensions.
Reported by Anonymous on 2020-11-15

- [1150649] High CVE-2020-16040: Insufficient data validation in V8.
Reported by Lucas Pinheiro, Microsoft Browser Vulnerability Research on 2020-11-19

- [1151865] Medium CVE-2020-16041: Out of bounds read in networking.
Reported by Sergei Glazunov and Mark Brand of Google Project Zero on 2020-11-23

- [1151890] Medium CVE-2020-16042: Uninitialized Use in V8. Reported by Andre Bargull on 2020-11-2

The version of Microsoft Edge installed on the remote Windows host is prior to 87.0.664.57. It is, therefore, affected by multiple vulnerabilities as referenced in the ADV200002-12-7-2020 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

Update to 87.0.4280.88 boo#1179576

  - CVE-2020-16037: Use after free in clipboard

  - CVE-2020-16038: Use after free in media

  - CVE-2020-16039: Use after free in extensions

  - CVE-2020-16040: Insufficient data validation in V8

  - CVE-2020-16041: Out of bounds read in networking

  - CVE-2020-16042: Uninitialized Use in V8

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4671-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
145294	openSUSE Security Update : MozillaFirefox (openSUSE-2020-2325)	Nessus	SuSE Local Security Checks	1/25/2021	1/26/2024	high
144439	Debian DLA-2497-1 : thunderbird security update	Nessus	Debian Local Security Checks	12/18/2020	2/1/2024	high
144386	RHEL 7 : thunderbird (RHSA-2020:5618)	Nessus	Red Hat Local Security Checks	12/18/2020	4/28/2024	high
144422	RHEL 8 : firefox (RHSA-2020:5562)	Nessus	Red Hat Local Security Checks	12/18/2020	4/28/2024	high
144512	RHEL 8 : thunderbird (RHSA-2020:5644)	Nessus	Red Hat Local Security Checks	12/22/2020	4/28/2024	high
144672	Debian DSA-4824-1 : chromium - security update	Nessus	Debian Local Security Checks	1/4/2021	1/31/2024	critical
154475	NewStart CGSL MAIN 6.02 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0119)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	11/27/2023	high
196882	RHEL 6 : chromium-browser (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
143517	FreeBSD : chromium -- multiple vulnerabilities (01ffd06a-36ed-11eb-b655-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	12/7/2020	2/6/2024	high
143588	Microsoft Edge (Chromium) < 87.0.664.57 Multiple Vulnerabilities	Nessus	Windows	12/9/2020	4/20/2021	high
144020	openSUSE Security Update : chromium (openSUSE-2020-2216)	Nessus	SuSE Local Security Checks	12/10/2020	2/2/2024	high
144299	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4671-1)	Nessus	Ubuntu Local Security Checks	12/16/2020	10/20/2023	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high

critical

high

high

high

critical