| Description: | Summary:
The remote host is missing an update for the 'firefox'
package(s) announced via the referenced advisory.
Vulnerability Insight:
Multiple security issues were discovered in
Firefox. If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit these to read uninitialized memory, obtain
sensitive information, bypass phishing and malware protection, spoof the origin
in modal dialogs, conduct cross-site scripting (XSS) attacks, cause a denial of
service via application crash, or execute arbitrary code. (CVE-2017-7793,
CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814,
CVE-2017-7815, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7822,
CVE-2017-7823, CVE-2017-7824) Martin Thomson discovered that NSS incorrectly
generated handshake hashes. A remote attacker could potentially exploit this to
cause a denial of service via application crash, or execute arbitrary code.
(CVE-2017-7805) Multiple security issues were discovered in WebExtensions. If a
user were tricked in to installing a specially crafted extension, an attacker
could potentially exploit these to download and open non-executable files
without interaction, or obtain elevated privileges. (CVE-2017-7816,
CVE-2017-7821)
Affected Software/OS:
firefox on Ubuntu 17.04,
Ubuntu 16.04 LTS,
Ubuntu 14.04 LTS
Solution:
Please Install the Updated Packages.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
