Test ID:	1.3.6.1.4.1.25623.1.0.884323
Category:	CentOS Local Security Checks
Title:	CentOS: Security Advisory for firefox (CESA-2024:0026)
Summary:	The remote host is missing an update for the 'firefox'; package(s) announced via the CESA-2024:0026 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the CESA-2024:0026 advisory. Vulnerability Insight: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This Update upgrades Firefox to version 115.6.0 ESR. Security Fix(es): * Mozilla: Heap-buffer-overflow affecting WebGL <, code>, DrawElementsInstanced<, /code>, method with Mesa VM driver (CVE-2023-6856) * Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 (CVE-2023-6864) * Mozilla: Potential exposure of uninitialized data in <, code>, EncryptingOutputStream<, /code>, (CVE-2023-6865) * Mozilla: Symlinks may resolve to smaller than expected buffers (CVE-2023-6857) * Mozilla: Heap buffer overflow in <, code>, nsTextFragment<, /code>, (CVE-2023-6858) * Mozilla: Use-after-free in PR_GetIdentitiesLayer (CVE-2023-6859) * Mozilla: Potential sandbox escape due to <, code>, VideoBridge<, /code>, lack of texture validation (CVE-2023-6860) * Mozilla: Heap buffer overflow affected <, code>, nsWindow::PickerOpen(void)<, /code>, in headless mode (CVE-2023-6861) * Mozilla: Use-after-free in <, code>, nsDNSService<, /code>, (CVE-2023-6862) * Mozilla: Clickjacking permission prompts using the popup transition (CVE-2023-6867) * Mozilla: Undefined behavior in <, code>, ShutdownObserver()<, /code>, (CVE-2023-6863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Affected Software/OS: 'firefox' package(s) on CentOS 7. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-6856 Debian Security Information: DSA-5581 (Google Search) https://www.debian.org/security/2023/dsa-5581 Debian Security Information: DSA-5582 (Google Search) https://www.debian.org/security/2023/dsa-5582 https://security.gentoo.org/glsa/202401-10 https://bugzilla.mozilla.org/show_bug.cgi?id=1843782 https://www.mozilla.org/security/advisories/mfsa2023-54/ https://www.mozilla.org/security/advisories/mfsa2023-55/ https://www.mozilla.org/security/advisories/mfsa2023-56/ https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html Common Vulnerability Exposure (CVE) ID: CVE-2023-6864 Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1736385%2C1810805%2C1846328%2C1856090%2C1858033%2C1858509%2C1862089%2C1862777%2C1864015 Common Vulnerability Exposure (CVE) ID: CVE-2023-6865 https://bugzilla.mozilla.org/show_bug.cgi?id=1864123 Common Vulnerability Exposure (CVE) ID: CVE-2023-6857 https://bugzilla.mozilla.org/show_bug.cgi?id=1796023 Common Vulnerability Exposure (CVE) ID: CVE-2023-6858 https://bugzilla.mozilla.org/show_bug.cgi?id=1826791 Common Vulnerability Exposure (CVE) ID: CVE-2023-6859 https://bugzilla.mozilla.org/show_bug.cgi?id=1840144 Common Vulnerability Exposure (CVE) ID: CVE-2023-6860 https://bugzilla.mozilla.org/show_bug.cgi?id=1854669 Common Vulnerability Exposure (CVE) ID: CVE-2023-6861 https://bugzilla.mozilla.org/show_bug.cgi?id=1864118 Common Vulnerability Exposure (CVE) ID: CVE-2023-6862 https://bugzilla.mozilla.org/show_bug.cgi?id=1868042 Common Vulnerability Exposure (CVE) ID: CVE-2023-6867 https://bugzilla.mozilla.org/show_bug.cgi?id=1863863 Common Vulnerability Exposure (CVE) ID: CVE-2023-6863 https://bugzilla.mozilla.org/show_bug.cgi?id=1868901
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.