The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:1414 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 52.8.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150)

    * Mozilla: Backport critical security fixes in Skia (CVE-2018-5183)

    * Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154)

    * Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155)

    * Mozilla: Same-origin bypass of PDF Viewer to view protected PDF files (CVE-2018-5157)

    * Mozilla: Malicious PDF can inject JavaScript into PDF Viewer (CVE-2018-5158)

    * Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159)

    * Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168)

    * Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension     (CVE-2018-5178)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges     Christoph Diehl, Randell Jesup, Tyson Smith, Alex Gaynor, Ronald Crane, Julian Hector, Kannan Vijayan,     Jason Kratzer, Mozilla Developers, Nils, Wladimir Palant, Ivan Fratric, and Root Object as the original     reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update upgrades Firefox to version 52.8.0 ESR.

Security Fix(es) :

  - Mozilla: Memory safety bugs fixed in Firefox 60 and     Firefox ESR 52.8 (CVE-2018-5150)

  - Mozilla: Backport critical security fixes in Skia     (CVE-2018-5183)

  - Mozilla: Use-after-free with SVG animations and clip     paths (CVE-2018-5154)

  - Mozilla: Use-after-free with SVG animations and text     paths (CVE-2018-5155)

  - Mozilla: Same-origin bypass of PDF Viewer to view     protected PDF files (CVE-2018-5157)

  - Mozilla: Malicious PDF can inject JavaScript into PDF     Viewer (CVE-2018-5158)

  - Mozilla: Integer overflow and out-of-bounds write in     Skia (CVE-2018-5159)

  - Mozilla: Lightweight themes can be installed without     user interaction (CVE-2018-5168)

  - Mozilla: Buffer overflow during UTF-8 to Unicode string     conversion through legacy extension (CVE-2018-5178)

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 52.8.0 ESR.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150)

* Mozilla: Backport critical security fixes in Skia (CVE-2018-5183)

* Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154)

* Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155)

* Mozilla: Same-origin bypass of PDF Viewer to view protected PDF files (CVE-2018-5157)

* Mozilla: Malicious PDF can inject JavaScript into PDF Viewer (CVE-2018-5158)

* Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159)

* Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168)

* Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (CVE-2018-5178)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christoph Diehl, Randell Jesup, Tyson Smith, Alex Gaynor, Ronald Crane, Julian Hector, Kannan Vijayan, Jason Kratzer, Mozilla Developers, Nils, Wladimir Palant, Ivan Fratric, and Root Object as the original reporters.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 60.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-11 advisory.

  - Mozilla developers and community members Christoph Diehl, Christian Holler, Jon Coppeard, Jason Kratzer,     Nathan Froyd, Paul Theriault, Ryan VanderMeulen, Tyson Smith, Sebastian Hengst, Byron Campen, Emilio Cobos     lvarez, Ronald Crane, and Phillipp reported memory safety bugs present in Firefox 59. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort that some of these could be     exploited to run arbitrary code. (CVE-2018-5151)

  - An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer     overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable     crash triggerable by web content. (CVE-2018-5159)

  - A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip     paths. This results in a potentially exploitable crash. (CVE-2018-5154)

  - A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths.
    This results in a potentially exploitable crash. (CVE-2018-5155)

  - Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept     messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an     authenticated user on a third-party website. (CVE-2018-5157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox to the ESR 52.8 release fixes the following issues :

Mozil to Firefox ESR 52.8 (bsc#1092548)

Security issues fixed :

MFSA 2018-12/CVE-2018-5159: Integer overflow and out-of-bounds write in Skia

MFSA 2018-12/CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer

MFSA 2018-12/CVE-2018-5168: Lightweight themes can be installed without user interaction

MFSA 2018-12/CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8

MFSA 2018-12/CVE-2018-5155: Use-after-free with SVG animations and text paths

MFSA 2018-12/CVE-2018-5183: Backport critical security fixes in Skia

MFSA 2018-12/CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files

MFSA 2018-12/CVE-2018-5154: Use-after-free with SVG animations and clip paths

MFSA 2018-12/CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox to the 52.9 ESR release fixes the following issues: These security issues were fixed :

  - Firefox ESR 52.9 :

  - CVE-2018-5188 Memory safety bugs fixed in Firefox 60,     Firefox ESR 60.1, and Firefox ESR 52.9 (bsc#1098998).

  - CVE-2018-12368 No warning when opening executable     SettingContent-ms files (bsc#1098998).

  - CVE-2018-12366 Invalid data handling during QCMS     transformations (bsc#1098998).

  - CVE-2018-12365 Compromised IPC child process can list     local filenames (bsc#1098998).

  - CVE-2018-12364 CSRF attacks through 307 redirects and     NPAPI plugins (bsc#1098998).

  - CVE-2018-12363 Use-after-free when appending DOM nodes     (bsc#1098998).

  - CVE-2018-12362 Integer overflow in SSSE3 scaler     (bsc#1098998).

  - CVE-2018-12360 Use-after-free when using focus()     (bsc#1098998).

  - CVE-2018-5156 Media recorder segmentation fault when     track type is changed during capture (bsc#1098998).

  - CVE-2018-12359 Buffer overflow using computed size of     canvas element (bsc#1098998).

  - Firefox ESR 52.8 :

  - CVE-2018-6126: Prevent heap buffer overflow in     rasterizing paths in SVG with Skia (bsc#1096449).

  - CVE-2018-5183: Backport critical security fixes in Skia     (bsc#1092548).

  - CVE-2018-5154: Use-after-free with SVG animations and     clip paths (bsc#1092548).

  - CVE-2018-5155: Use-after-free with SVG animations and     text paths (bsc#1092548).

  - CVE-2018-5157: Same-origin bypass of PDF Viewer to view     protected PDF files (bsc#1092548).

  - CVE-2018-5158: Malicious PDF can inject JavaScript into     PDF Viewer (bsc#1092548).

  - CVE-2018-5159: Integer overflow and out-of-bounds write     in Skia (bsc#1092548).

  - CVE-2018-5168: Lightweight themes can be installed     without user interaction (bsc#1092548).

  - CVE-2018-5178: Buffer overflow during UTF-8 to Unicode     string conversion through legacy extension     (bsc#1092548).

  - CVE-2018-5150: Memory safety bugs fixed in Firefox 60     and Firefox ESR 52.8 (bsc#1092548).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
109834	RHEL 6 : firefox (RHSA-2018:1414)	Nessus	Red Hat Local Security Checks	2018/5/16	2024/11/5	critical
109851	Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20180515)	Nessus	Scientific Linux Local Security Checks	2018/5/16	2024/10/7	critical
109852	Scientific Linux Security Update : firefox on SL7.x x86_64 (20180515)	Nessus	Scientific Linux Local Security Checks	2018/5/16	2024/10/7	critical
109923	CentOS 6 : firefox (CESA-2018:1414)	Nessus	CentOS Local Security Checks	2018/5/21	2024/10/4	critical
275694	Mozilla Firefox < 60.0	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
118254	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:1334-2)	Nessus	SuSE Local Security Checks	2018/10/22	2024/7/30	critical
120074	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2018:2298-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical