Vulnerabilities > CVE-2016-2828 - Multiple Security vulnerability in Mozilla Firefox

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL

Summary

Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>

Vulnerable Configurations

Part Description Count
OS
Canonical
4
OS
Opensuse
3
OS
Debian
1
Application
Mozilla
323

Nessus

  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_8065D37B8E7C4707A6081B0A2B8509C3.NASL
    descriptionMozilla Foundation reports : MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 / rv:45.2) MFSA 2016-50 Buffer overflow parsing HTML5 fragments MFSA 2016-51 Use-after-free deleting tables from a contenteditable document MFSA 2016-52 Addressbar spoofing though the SELECT element MFSA 2016-54 Partial same-origin-policy through setting location.host through data URI MFSA 2016-56 Use-after-free when textures are used in WebGL operations after recycle pool destruction MFSA 2016-57 Incorrect icon displayed on permissions notifications MFSA 2016-58 Entering fullscreen and persistent pointerlock without user permission MFSA 2016-59 Information disclosure of disabled plugins through CSS pseudo-classes MFSA 2016-60 Java applets bypass CSP protections
    last seen2020-06-01
    modified2020-06-02
    plugin id91509
    published2016-06-08
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91509
    titleFreeBSD : mozilla -- multiple vulnerabilities (8065d37b-8e7c-4707-a608-1b0a2b8509c3)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91509);
      script_version("2.11");
      script_cvs_date("Date: 2019/04/11 17:23:06");
    
      script_cve_id("CVE-2016-2815", "CVE-2016-2818", "CVE-2016-2819", "CVE-2016-2821", "CVE-2016-2822", "CVE-2016-2825", "CVE-2016-2828", "CVE-2016-2829", "CVE-2016-2831", "CVE-2016-2832", "CVE-2016-2833");
    
      script_name(english:"FreeBSD : mozilla -- multiple vulnerabilities (8065d37b-8e7c-4707-a608-1b0a2b8509c3)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Foundation reports :
    
    MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 / rv:45.2)
    
    MFSA 2016-50 Buffer overflow parsing HTML5 fragments
    
    MFSA 2016-51 Use-after-free deleting tables from a contenteditable
    document
    
    MFSA 2016-52 Addressbar spoofing though the SELECT element
    
    MFSA 2016-54 Partial same-origin-policy through setting location.host
    through data URI
    
    MFSA 2016-56 Use-after-free when textures are used in WebGL operations
    after recycle pool destruction
    
    MFSA 2016-57 Incorrect icon displayed on permissions notifications
    
    MFSA 2016-58 Entering fullscreen and persistent pointerlock without
    user permission
    
    MFSA 2016-59 Information disclosure of disabled plugins through CSS
    pseudo-classes
    
    MFSA 2016-60 Java applets bypass CSP protections"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-49/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-49/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-50/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-50/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-51/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-51/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-52/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-52/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-54/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-54/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-56/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-56/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-57/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-57/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-58/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-58/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-59/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-59/"
      );
      # https://www.mozilla.org/security/advisories/mfsa2016-60/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2016-60/"
      );
      # https://vuxml.freebsd.org/freebsd/8065d37b-8e7c-4707-a608-1b0a2b8509c3.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?ebb97f1d"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:firefox-esr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:libxul");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:thunderbird");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/06/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/06/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/08");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"firefox<47.0,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"seamonkey<2.44")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-seamonkey<2.44")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"firefox-esr<45.2.0,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-firefox<45.2.0,2")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"libxul<45.2.0")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"thunderbird<45.2.0")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-thunderbird<45.2.0")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-714.NASL
    descriptionThis update to Mozilla Firefox 47 fixes the following issues (boo#983549) : Security fixes : - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety hazards (boo#983638 MFSA 2016-49) - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (boo#983655 MFSA 2016-50) - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (boo#983653 MFSA 2016-51) - CVE-2016-2822: Addressbar spoofing though the SELECT element (boo#983652 MFSA 2016-52) - CVE-2016-2824: Out-of-bounds write with WebGL shader (boo#983651 MFSA 2016-53) - CVE-2016-2825: Partial same-origin-policy through setting location.host through data URI (boo#983649 MFSA 2016-54) - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (boo#983646 MFSA 2016-56) - CVE-2016-2829: Incorrect icon displayed on permissions notifications (boo#983644 MFSA 2016-57) - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (boo#983643 MFSA 2016-58) - CVE-2016-2832: Information disclosure of disabled plugins through CSS pseudo-classes (boo#983632 MFSA 2016-59) - CVE-2016-2833: Java applets bypass CSP protections (boo#983640 MFSA 2016-60) Mozilla NSS was updated to 3.23 to address the following vulnerabilities : - CVE-2016-2834: Memory safety bugs (boo#983639 MFSA-2016-61) The following non-security changes are included : - Enable VP9 video codec for users with fast machines - Embedded YouTube videos now play with HTML5 video if Flash is not installed - View and search open tabs from your smartphone or another computer in a sidebar - Allow no-cache on back/forward navigations for https resources The following packaging changes are included : - boo#981695: cleanup configure options, notably removing GStreamer support which is gone from FF - boo#980384: enable build with PIE and full relro on x86_64 The following new functionality is provided : - ChaCha20/Poly1305 cipher and TLS cipher suites now supported - The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers
    last seen2020-06-05
    modified2016-06-14
    plugin id91589
    published2016-06-14
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91589
    titleopenSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-714)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2016-714.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91589);
      script_version("2.9");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-1950", "CVE-2016-2815", "CVE-2016-2818", "CVE-2016-2819", "CVE-2016-2821", "CVE-2016-2822", "CVE-2016-2824", "CVE-2016-2825", "CVE-2016-2828", "CVE-2016-2829", "CVE-2016-2831", "CVE-2016-2832", "CVE-2016-2833", "CVE-2016-2834");
    
      script_name(english:"openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-714)");
      script_summary(english:"Check for the openSUSE-2016-714 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update to Mozilla Firefox 47 fixes the following issues
    (boo#983549) :
    
    Security fixes :
    
      - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety
        hazards (boo#983638 MFSA 2016-49)
    
      - CVE-2016-2819: Buffer overflow parsing HTML5 fragments
        (boo#983655 MFSA 2016-50)
    
      - CVE-2016-2821: Use-after-free deleting tables from a
        contenteditable document (boo#983653 MFSA 2016-51)
    
      - CVE-2016-2822: Addressbar spoofing though the SELECT
        element (boo#983652 MFSA 2016-52)
    
      - CVE-2016-2824: Out-of-bounds write with WebGL shader
        (boo#983651 MFSA 2016-53)
    
      - CVE-2016-2825: Partial same-origin-policy through
        setting location.host through data URI (boo#983649 MFSA
        2016-54)
    
      - CVE-2016-2828: Use-after-free when textures are used in
        WebGL operations after recycle pool destruction
        (boo#983646 MFSA 2016-56)
    
      - CVE-2016-2829: Incorrect icon displayed on permissions
        notifications (boo#983644 MFSA 2016-57)
    
      - CVE-2016-2831: Entering fullscreen and persistent
        pointerlock without user permission (boo#983643 MFSA
        2016-58)
    
      - CVE-2016-2832: Information disclosure of disabled
        plugins through CSS pseudo-classes (boo#983632 MFSA
        2016-59)
    
      - CVE-2016-2833: Java applets bypass CSP protections
        (boo#983640 MFSA 2016-60)
    
    Mozilla NSS was updated to 3.23 to address the following
    vulnerabilities :
    
      - CVE-2016-2834: Memory safety bugs (boo#983639
        MFSA-2016-61)
    
        The following non-security changes are included :
    
      - Enable VP9 video codec for users with fast machines
    
      - Embedded YouTube videos now play with HTML5 video if
        Flash is not installed
    
      - View and search open tabs from your smartphone or
        another computer in a sidebar
    
      - Allow no-cache on back/forward navigations for https
        resources
    
        The following packaging changes are included :
    
      - boo#981695: cleanup configure options, notably removing
        GStreamer support which is gone from FF
    
      - boo#980384: enable build with PIE and full relro on
        x86_64
    
        The following new functionality is provided :
    
      - ChaCha20/Poly1305 cipher and TLS cipher suites now
        supported
    
      - The list of TLS extensions sent in the TLS handshake has
        been reordered to increase compatibility of the Extended
        Master Secret with with servers"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1025267"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1193093"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1206283"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1221620"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1223810"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1234147"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1241034"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1241037"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1241896"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1242798"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1243466"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1245528"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1245743"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1248329"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1248580"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1256493"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1256739"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1256968"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1261230"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1261752"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1261933"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1263384"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1264300"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1264575"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1265577"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1267130"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1269729"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1270381"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1271037"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1271460"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1273129"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1273202"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1273701"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=908933"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=980384"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=981695"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983549"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983632"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983638"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983639"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983640"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983643"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983644"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983646"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983649"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983651"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983652"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983653"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=983655"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected MozillaFirefox / mozilla-nss packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-branding-upstream");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libfreebl3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libfreebl3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libfreebl3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libfreebl3-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsoftokn3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsoftokn3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsoftokn3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsoftokn3-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-certs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-certs-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-certs-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-certs-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-sysinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-sysinit-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-sysinit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-sysinit-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/06/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/14");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-47.0-116.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-branding-upstream-47.0-116.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-buildsymbols-47.0-116.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-debuginfo-47.0-116.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-debugsource-47.0-116.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-devel-47.0-116.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-translations-common-47.0-116.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"MozillaFirefox-translations-other-47.0-116.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libfreebl3-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libfreebl3-debuginfo-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libsoftokn3-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libsoftokn3-debuginfo-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-certs-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-certs-debuginfo-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-debuginfo-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-debugsource-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-devel-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-sysinit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-sysinit-debuginfo-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-tools-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mozilla-nss-tools-debuginfo-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libfreebl3-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libfreebl3-debuginfo-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libsoftokn3-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libsoftokn3-debuginfo-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"mozilla-nss-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"mozilla-nss-certs-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"mozilla-nss-certs-debuginfo-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"mozilla-nss-debuginfo-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"mozilla-nss-sysinit-32bit-3.23-80.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"mozilla-nss-sysinit-debuginfo-32bit-3.23-80.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MozillaFirefox / MozillaFirefox-branding-upstream / etc");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2016-1217.NASL
    descriptionAn update for firefox is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0 ESR. Security Fix(es) : * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-2818, CVE-2016-2819, CVE-2016-2821, CVE-2016-2822, CVE-2016-2828, CVE-2016-2831) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges sushi Anton Larsson, firehack, Jordi Chancel, Christian Holler, Sylvestre Ledru, Tyson Smith, jomo, Jesse Ruderman, Julian Seward, Timothy Nikkel, Karl Tomlinson, Olli Pettay, and Gary Kwong as the original reporters.
    last seen2020-06-01
    modified2020-06-02
    plugin id91635
    published2016-06-17
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91635
    titleCentOS 5 / 6 / 7 : firefox (CESA-2016:1217)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2016:1217 and 
    # CentOS Errata and Security Advisory 2016:1217 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91635);
      script_version("2.14");
      script_cvs_date("Date: 2020/02/18");
    
      script_cve_id("CVE-2016-2818", "CVE-2016-2819", "CVE-2016-2821", "CVE-2016-2822", "CVE-2016-2828", "CVE-2016-2831");
      script_xref(name:"RHSA", value:"2016:1217");
    
      script_name(english:"CentOS 5 / 6 / 7 : firefox (CESA-2016:1217)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for firefox is now available for Red Hat Enterprise Linux 5,
    Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Critical. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Mozilla Firefox is an open source web browser.
    
    This update upgrades Firefox to version 45.2.0 ESR.
    
    Security Fix(es) :
    
    * Multiple flaws were found in the processing of malformed web
    content. A web page containing malicious content could cause Firefox
    to crash or, potentially, execute arbitrary code with the privileges
    of the user running Firefox. (CVE-2016-2818, CVE-2016-2819,
    CVE-2016-2821, CVE-2016-2822, CVE-2016-2828, CVE-2016-2831)
    
    Red Hat would like to thank the Mozilla project for reporting these
    issues. Upstream acknowledges sushi Anton Larsson, firehack, Jordi
    Chancel, Christian Holler, Sylvestre Ledru, Tyson Smith, jomo, Jesse
    Ruderman, Julian Seward, Timothy Nikkel, Karl Tomlinson, Olli Pettay,
    and Gary Kwong as the original reporters."
      );
      # https://lists.centos.org/pipermail/centos-announce/2016-June/021906.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?faa698f6"
      );
      # https://lists.centos.org/pipermail/centos-announce/2016-June/021907.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?1383813c"
      );
      # https://lists.centos.org/pipermail/centos-announce/2016-June/021908.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7aed388c"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected firefox package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-2818");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:firefox");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/06/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/06/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/17");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x / 6.x / 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-5", reference:"firefox-45.2.0-1.el5.centos", allowmaj:TRUE)) flag++;
    
    if (rpm_check(release:"CentOS-6", reference:"firefox-45.2.0-1.el6.centos", allowmaj:TRUE)) flag++;
    
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"firefox-45.2.0-1.el7.centos", allowmaj:TRUE)) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3600.NASL
    descriptionMultiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or spoofing. Wait, Firefox? No more references to Iceweasel? That
    last seen2020-06-01
    modified2020-06-02
    plugin id91550
    published2016-06-10
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91550
    titleDebian DSA-3600-1 : firefox-esr - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3600. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91550);
      script_version("2.15");
      script_cvs_date("Date: 2019/07/15 14:20:30");
    
      script_cve_id("CVE-2016-2818", "CVE-2016-2819", "CVE-2016-2821", "CVE-2016-2822", "CVE-2016-2828", "CVE-2016-2831");
      script_xref(name:"DSA", value:"3600");
    
      script_name(english:"Debian DSA-3600-1 : firefox-esr - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple security issues have been found in the Mozilla Firefox web
    browser: Multiple memory safety errors, buffer overflows and other
    implementation errors may lead to the execution of arbitrary code or
    spoofing.
    
    Wait, Firefox? No more references to Iceweasel? That's right, Debian
    no longer applies a custom branding. Please see these links for
    further information: https://glandium.org/blog/?p=3622,
    https://en.wikipedia.org/wiki/Mozilla_software_rebranded_by_Debian
    
    Debian follows the extended support releases (ESR) of Firefox. Support
    for the 38.x series has ended, so starting with this update we're now
    following the 45.x releases and this update to the next ESR is also
    the point where we reapply the original branding.
    
    Transition packages for the iceweasel packages are provided which
    automatically upgrade to the new version. Since new binary packages
    need to be installed, make sure to allow that in your upgrade
    procedure (e.g. by using 'apt-get dist-upgrade' instead of 'apt-get
    upgrade')."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://glandium.org/blog/?p=3622"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://en.wikipedia.org/wiki/Mozilla_software_rebranded_by_Debian"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/firefox-esr"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2016/dsa-3600"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the firefox-esr packages.
    
    For the stable distribution (jessie), these problems have been fixed
    in version 45.2.0esr-1~deb8u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:firefox-esr");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/06/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/06/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/10");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"firefox-esr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-dbg", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-dev", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ach", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-af", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-all", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-an", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ar", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-as", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ast", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-az", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-be", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-bg", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-bn-bd", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-bn-in", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-br", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-bs", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ca", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-cs", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-cy", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-da", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-de", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-dsb", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-el", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-en-gb", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-en-za", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-eo", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-es-ar", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-es-cl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-es-es", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-es-mx", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-et", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-eu", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-fa", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ff", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-fi", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-fr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-fy-nl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ga-ie", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-gd", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-gl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-gn", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-gu-in", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-he", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-hi-in", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-hr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-hsb", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-hu", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-hy-am", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-id", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-is", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-it", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ja", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-kk", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-km", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-kn", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ko", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-lij", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-lt", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-lv", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-mai", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-mk", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ml", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-mr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ms", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-nb-no", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-nl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-nn-no", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-or", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-pa-in", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-pl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-pt-br", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-pt-pt", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-rm", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ro", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ru", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-si", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-sk", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-sl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-son", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-sq", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-sr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-sv-se", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-ta", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-te", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-th", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-tr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-uk", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-uz", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-vi", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-xh", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-zh-cn", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"firefox-esr-l10n-zh-tw", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-dbg", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-dev", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ach", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-af", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-all", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-an", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ar", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-as", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ast", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-az", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-be", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-bg", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-bn-bd", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-bn-in", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-br", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-bs", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ca", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-cs", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-cy", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-da", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-de", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-dsb", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-el", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-en-gb", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-en-za", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-eo", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-es-ar", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-es-cl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-es-es", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-es-mx", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-et", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-eu", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-fa", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ff", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-fi", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-fr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-fy-nl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ga-ie", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-gd", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-gl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-gn", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-gu-in", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-he", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-hi-in", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-hr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-hsb", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-hu", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-hy-am", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-id", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-is", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-it", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ja", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-kk", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-km", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-kn", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ko", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-lij", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-lt", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-lv", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-mai", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-mk", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ml", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-mr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ms", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-nb-no", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-nl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-nn-no", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-or", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-pa-in", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-pl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-pt-br", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-pt-pt", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-rm", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ro", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ru", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-si", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-sk", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-sl", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-son", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-sq", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-sr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-sv-se", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-ta", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-te", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-th", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-tr", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-uk", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-uz", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-vi", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-xh", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-zh-cn", reference:"45.2.0esr-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"iceweasel-l10n-zh-tw", reference:"45.2.0esr-1~deb8u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_47.NASL
    descriptionThe version of Firefox installed on the remote Mac OS X host is prior to 47. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-2815, CVE-2016-2818) - An overflow condition exists that is triggered when handling HTML5 fragments in foreign contexts (e.g., under <svg> nodes). An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-2819) - A use-after-free error exists that is triggered when deleting DOM table elements in
    last seen2020-06-01
    modified2020-06-02
    plugin id91545
    published2016-06-09
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91545
    titleFirefox < 47 Multiple Vulnerabilities (Mac OS X)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-1217.NASL
    descriptionAn update for firefox is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0 ESR. Security Fix(es) : * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-2818, CVE-2016-2819, CVE-2016-2821, CVE-2016-2822, CVE-2016-2828, CVE-2016-2831) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges sushi Anton Larsson, firehack, Jordi Chancel, Christian Holler, Sylvestre Ledru, Tyson Smith, jomo, Jesse Ruderman, Julian Seward, Timothy Nikkel, Karl Tomlinson, Olli Pettay, and Gary Kwong as the original reporters.
    last seen2020-05-31
    modified2016-06-09
    plugin id91536
    published2016-06-09
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91536
    titleRHEL 5 / 6 / 7 : firefox (RHSA-2016:1217)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1799-1.NASL
    descriptionMozillaFirefox, MozillaFirefox-branding-SLE and mozilla-nss were updated to fix nine security issues. Mozilla Firefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1. These security issues were fixed : - CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639). - CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651). - CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652). - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653). - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655). - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646). - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643). - CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-31
    modified2016-08-29
    plugin id93182
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93182
    titleSUSE SLES11 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE / mozilla-nss (SUSE-SU-2016:1799-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20160608_FIREFOX_ON_SL5_X.NASL
    descriptionThis update upgrades Firefox to version 45.2.0 ESR. Security Fix(es) : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-2818, CVE-2016-2819, CVE-2016-2821, CVE-2016-2822, CVE-2016-2828, CVE-2016-2831)
    last seen2020-03-18
    modified2016-06-17
    plugin id91648
    published2016-06-17
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91648
    titleScientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20160608)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_47.NASL
    descriptionThe version of Firefox installed on the remote Windows host is prior to 47. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-2815, CVE-2016-2818) - An overflow condition exists that is triggered when handling HTML5 fragments in foreign contexts (e.g., under <svg> nodes). An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-2819) - A use-after-free error exists that is triggered when deleting DOM table elements in
    last seen2020-06-01
    modified2020-06-02
    plugin id91547
    published2016-06-09
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91547
    titleFirefox < 47 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-2061-1.NASL
    descriptionMozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr and mozilla-nss were updated to fix nine security issues. Mozilla Firefox was updated to version 45.3.0 ESR. mozilla-nss was updated to version 3.21.1, mozilla-nspr to version 4.12. These security issues were fixed in 45.3.0ESR : - CVE-2016-2835/CVE-2016-2836: Miscellaneous memory safety hazards (rv:48.0 / rv:45.3) (MFSA 2016-62) - CVE-2016-2830: Favicon network connection can persist when page is closed (MFSA 2016-63) - CVE-2016-2838: Buffer overflow rendering SVG with bidirectional content (MFSA 2016-64) - CVE-2016-2839: Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 (MFSA 2016-65) - CVE-2016-5252: Stack underflow during 2D graphics rendering (MFSA 2016-67) - CVE-2016-5254: Use-after-free when using alt key and toplevel menus (MFSA 2016-70) - CVE-2016-5258: Use-after-free in DTLS during WebRTC session shutdown (MFSA 2016-72) - CVE-2016-5259: Use-after-free in service workers with nested sync events (MFSA 2016-73) - CVE-2016-5262: Scripts on marquee tag can execute in sandboxed iframes (MFSA 2016-76) - CVE-2016-2837: Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback (MFSA 2016-77) - CVE-2016-5263: Type confusion in display transformation (MFSA 2016-78) - CVE-2016-5264: Use-after-free when applying SVG effects (MFSA 2016-79) - CVE-2016-5265: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-80) - CVE-2016-6354: Fix for possible buffer overrun (bsc#990856) Security issues fixed in 45.2.0.ESR : - CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639). - CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651). - CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652). - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653). - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655). - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646). - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643). - CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-31
    modified2016-09-02
    plugin id93288
    published2016-09-02
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93288
    titleSUSE SLES11 Security Update : MozillaFirefox, MozillaFirefox-branding-SLED, mozilla-nspr / mozilla-nss (SUSE-SU-2016:2061-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1691-1.NASL
    descriptionMozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss and mozilla-nspr were updated to fix nine security issues. Mozilla Firefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1. These security issues were fixed : - CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639). - CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651). - CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652). - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653). - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655). - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646). - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643). - CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id93166
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93166
    titleSUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss (SUSE-SU-2016:1691-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2993-1.NASL
    descriptionChristian Holler, Gary Kwong, Jesse Ruderman, Tyson Smith, Timothy Nikkel, Sylvestre Ledru, Julian Seward, Olli Pettay, Karl Tomlinson, Christoph Diehl, Julian Hector, Jan de Mooij, Mats Palmgren, and Tooru Fujisawa discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2815, CVE-2016-2818) A buffer overflow was discovered when parsing HTML5 fragments in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2819) A use-after-free was discovered in contenteditable mode in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2821) Jordi Chancel discovered a way to use a persistent menu within a <select> element and place this in an arbitrary location. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to spoof the addressbar contents. (CVE-2016-2822) Armin Razmdjou that the location.host property can be set to an arbitrary string after creating an invalid data: URI. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass some same-origin protections. (CVE-2016-2825) A use-after-free was discovered when processing WebGL content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2828) Tim McCormack discovered that the permissions notification can show the wrong icon when a page requests several permissions in quick succession. An attacker could potentially exploit this by tricking the user in to giving consent for access to the wrong resource. (CVE-2016-2829) It was discovered that a pointerlock can be created in a fullscreen window without user consent in some circumstances, and this pointerlock cannot be cancelled without quitting Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service or conduct clickjacking attacks. (CVE-2016-2831) John Schoenick discovered that CSS pseudo-classes can leak information about plugins that are installed but disabled. An attacker could potentially exploit this to fingerprint users. (CVE-2016-2832) Matt Wobensmith discovered that Content Security Policy (CSP) does not block the loading of cross-domain Java applets when specified by policy. An attacker could potentially exploit this to bypass CSP protections and conduct cross-site scripting (XSS) attacks. (CVE-2016-2833) In addition, multiple unspecified security issues were discovered in NSS. (CVE-2016-2834). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id91557
    published2016-06-10
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91557
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : firefox vulnerabilities (USN-2993-1)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_45_2_ESR.NASL
    descriptionThe version of Firefox ESR installed on the remote Windows host is 45.x prior to 45.2. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-2818) - An overflow condition exists that is triggered when handling HTML5 fragments in foreign contexts (e.g., under <svg> nodes). An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-2819) - A use-after-free error exists that is triggered when deleting DOM table elements in
    last seen2020-06-01
    modified2020-06-02
    plugin id91546
    published2016-06-09
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91546
    titleFirefox ESR 45.x < 45.2 Multiple Vulnerabilities
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2016-1217.NASL
    descriptionFrom Red Hat Security Advisory 2016:1217 : An update for firefox is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0 ESR. Security Fix(es) : * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-2818, CVE-2016-2819, CVE-2016-2821, CVE-2016-2822, CVE-2016-2828, CVE-2016-2831) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges sushi Anton Larsson, firehack, Jordi Chancel, Christian Holler, Sylvestre Ledru, Tyson Smith, jomo, Jesse Ruderman, Julian Seward, Timothy Nikkel, Karl Tomlinson, Olli Pettay, and Gary Kwong as the original reporters.
    last seen2020-05-31
    modified2016-06-09
    plugin id91535
    published2016-06-09
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91535
    titleOracle Linux 5 / 6 / 7 : firefox (ELSA-2016-1217)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_45_2_ESR.NASL
    descriptionThe version of Firefox ESR installed on the remote Mac OS X host is 45.x prior to 45.2. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-2818) - An overflow condition exists that is triggered when handling HTML5 fragments in foreign contexts (e.g., under <svg> nodes). An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2016-2819) - A use-after-free error exists that is triggered when deleting DOM table elements in
    last seen2020-06-01
    modified2020-06-02
    plugin id91544
    published2016-06-09
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91544
    titleFirefox ESR 45.x < 45.2 Multiple Vulnerabilities (Mac OS X)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-704.NASL
    descriptionThis update to Mozilla Firefox 47 fixes the following issues (boo#983549) : Security fixes : - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety hazards (boo#983638 MFSA 2016-49) - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (boo#983655 MFSA 2016-50) - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (boo#983653 MFSA 2016-51) - CVE-2016-2822: Addressbar spoofing though the SELECT element (boo#983652 MFSA 2016-52) - CVE-2016-2824: Out-of-bounds write with WebGL shader (boo#983651 MFSA 2016-53) - CVE-2016-2825: Partial same-origin-policy through setting location.host through data URI (boo#983649 MFSA 2016-54) - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (boo#983646 MFSA 2016-56) - CVE-2016-2829: Incorrect icon displayed on permissions notifications (boo#983644 MFSA 2016-57) - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (boo#983643 MFSA 2016-58) - CVE-2016-2832: Information disclosure of disabled plugins through CSS pseudo-classes (boo#983632 MFSA 2016-59) - CVE-2016-2833: Java applets bypass CSP protections (boo#983640 MFSA 2016-60) Mozilla NSS was updated to 3.23 to address the following vulnerabilities : - CVE-2016-2834: Memory safety bugs (boo#983639 MFSA-2016-61) The following non-security changes are included : - Enable VP9 video codec for users with fast machines - Embedded YouTube videos now play with HTML5 video if Flash is not installed - View and search open tabs from your smartphone or another computer in a sidebar - Allow no-cache on back/forward navigations for https resources The following packaging changes are included : - boo#981695: cleanup configure options, notably removing GStreamer support which is gone from FF - boo#980384: enable build with PIE and full relro on x86_64 The following new functionality is provided : - ChaCha20/Poly1305 cipher and TLS cipher suites now supported - The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers
    last seen2020-06-05
    modified2016-06-14
    plugin id91586
    published2016-06-14
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91586
    titleopenSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-704)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-521.NASL
    descriptionMultiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or spoofing. Wait, Firefox? No more references to Iceweasel? That
    last seen2020-03-17
    modified2016-06-20
    plugin id91691
    published2016-06-20
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91691
    titleDebian DLA-521-1 : firefox-esr security update

Redhat

advisories
rhsa
idRHSA-2016:1217
rpms
  • firefox-0:45.2.0-1.el5_11
  • firefox-0:45.2.0-1.el6_8
  • firefox-0:45.2.0-1.el7_2
  • firefox-debuginfo-0:45.2.0-1.el5_11
  • firefox-debuginfo-0:45.2.0-1.el6_8
  • firefox-debuginfo-0:45.2.0-1.el7_2