The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3109:05 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150)
    * Mozilla: Backport critical security fixes in Skia (CVE-2018-5183)
    * Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154)
    * Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155)
    * Mozilla: Same-origin bypass of PDF Viewer to view protected PDF files (CVE-2018-5157)
    * Mozilla: Malicious PDF can inject JavaScript into PDF Viewer (CVE-2018-5158)
    * Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159)
    * Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168)
    * Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension     (CVE-2018-5178)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Gitlab reports :

DoS potential for regex in CI/CD refs

Related branches visible in issues for guests

Persistent XSS at merge request resolve conflicts

Improper authorization control 'move issue'

Guest users of private projects have access to releases

DoS potential on project languages page

Recurity assessment: information exposure through timing discrepancy

Recurity assessment: loginState HMAC issues

Recurity assessment: open redirect

PDF.js vulnerable to CVE-2018-5158

IDOR labels of private projects/groups

EXIF geolocation data not stripped from uploaded images

This update for MozillaFirefox to 68.2.0 ESR fixes the following issues :

Mozilla Firefox was updated to version 68.2.0 ESR (bsc#1154738).

Security issues fixed :

CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).

CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).

CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).

CVE-2019-11759: Fixed a stack-based buffer overflow in HKDF output (bsc#1154738).

CVE-2019-11760: Fixed a stack-based buffer overflow in WebRTC networking (bsc#1154738).

CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738).

CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738).

CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738).

Non-security issues fixed: Firefox 60.7 ESR changed the user interface language (bsc#1137990).

Wrong Firefox GUI Language (bsc#1120374).

Fixed an inadvertent crash report transmission without user opt-in (bsc#1074235).

Firefox hangs randomly when browsing and scrolling (bsc#1043008).

Firefox stops loading page until mouse is moved (bsc#1025108).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for Mozilla Firefox to 52.8.0 ESR fixes the following issues: Security issssue fixed: (bsc#1092548, MFSA 2018-12) :

  - CVE-2018-5183: Backport critical security fixes in Skia

  - CVE-2018-5154: Use-after-free with SVG animations and     clip paths

  - CVE-2018-5155: Use-after-free with SVG animations and     text paths

  - CVE-2018-5157: Same-origin bypass of PDF Viewer to view     protected PDF files

  - CVE-2018-5158: Malicious PDF can inject JavaScript into     PDF Viewer

  - CVE-2018-5159: Integer overflow and out-of-bounds write     in Skia

  - CVE-2018-5168: Lightweight themes can be installed     without user interaction

  - CVE-2018-5178: Buffer overflow during UTF-8 to Unicode     string conversion through legacy extension

  - CVE-2018-5150: Memory safety bugs fixed in Firefox 60     and Firefox ESR 52.8 The following non-security changes     are included :

  - Various stability and regression fixes

  - Performance improvements to the Safe Browsing service to     avoid slowdowns while updating site classification data

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3645-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via application     crash, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, install lightweight     themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code.
    (CVE-2018-5150, CVE-2018-5151, CVE-2018-5153, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158,     CVE-2018-5159, CVE-2018-5160, CVE-2018-5163, CVE-2018-5164, CVE-2018-5168, CVE-2018-5173, CVE-2018-5175,     CVE-2018-5177, CVE-2018-5180)

    Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a     specially crafted extension, an attacker could potentially exploit these to obtain sensitive information,     or bypass security restrictions. (CVE-2018-5152, CVE-2018-5166)

    It was discovered that the web console and JavaScript debugger incorrectly linkified chrome: and     javascript URLs. If a user were tricked in to clicking a specially crafted link, an attacker could     potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5167)

    It was discovered that dragging and dropping link text on to the home button could set the home page to     include chrome pages. If a user were tricked in to dragging and dropping a specially crafted link on to     the home button, an attacker could potentially exploit this bypass security restrictions. (CVE-2018-5169)

    It was discovered that the Live Bookmarks page and PDF viewer would run script pasted from the clipboard.
    If a user were tricked in to copying and pasting specially crafted text, an attacker could potentially     exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5172)

    It was discovered that the JSON viewer incorrectly linkified javascript: URLs. If a user were tricked in     to clicking on a specially crafted link, an attacker could potentially exploit this to obtain sensitive     information. (CVE-2018-5176)

    It was discovered that dragging a file: URL on to a tab that is running in a different process would cause     the file to open in that process. If a user were tricked in to dragging a file: URL, an attacker could     potentially exploit this to bypass intended security policies. (CVE-2018-5181)

    It was discovered that dragging text that is a file: URL on to the addressbar would open the specified     file. If a user were tricked in to dragging specially crafted text on to the addressbar, an attacker could     potentially exploit this to bypass intended security policies. (CVE-2018-5182)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-12 advisory.

  - Mozilla developers backported selected changes in the Skia library to the ESR52 branch of Firefox. These     changes correct memory corruption issues including invalid buffer reads and writes during graphic     operations. (CVE-2018-5183)

  - A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip     paths. This results in a potentially exploitable crash. (CVE-2018-5154)

  - A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths.
    This results in a potentially exploitable crash. (CVE-2018-5155)

  - Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept     messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an     authenticated user on a third-party website. (CVE-2018-5157)

  - The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious     JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions     of the PDF viewer by its worker. (CVE-2018-5158)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox installed on the remote Windows     host is prior to 60. It is, therefore, affected by multiple critical     and high severity vulnerabilities.

ID	名稱	產品	系列	已發布	已更新	嚴重性
289301	MiracleLinux 4 : firefox-52.8.0-1.0.1.AXS4 (AXSA:2018-3109:05)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
123645	FreeBSD : Gitlab -- Multiple vulnerabilities (da459dbc-5586-11e9-abd6-001b217b3468)	Nessus	FreeBSD Local Security Checks	2019/4/3	2024/6/6	high
130450	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2872-1)	Nessus	SuSE Local Security Checks	2019/11/1	2024/4/16	critical
109720	openSUSE Security Update : Mozilla Firefox (openSUSE-2018-452)	Nessus	SuSE Local Security Checks	2018/5/11	2024/10/9	critical
109798	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-3645-1)	Nessus	Ubuntu Local Security Checks	2018/5/14	2024/8/27	critical
109866	Mozilla Firefox ESR < 52.8	Nessus	MacOS X Local Security Checks	2018/5/17	2025/11/18	critical
109869	Mozilla Firefox < 60 Multiple Critical Vulnerabilities	Nessus	Windows	2018/5/17	2026/6/23	critical

偵測

搜尋 Plugin

critical

high

critical

critical

critical

critical

critical