Vulnerabilities > CVE-2018-18496 - Improper Restriction of Rendered UI Layers or Frames vulnerability in Mozilla Firefox

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL

Summary

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.*. This vulnerability affects Firefox < 64.

Vulnerable Configurations

Part Description Count
Application
Mozilla
453
OS
Microsoft
1

Nessus

  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_D10B49B28D0249E8AFDE0844626317AF.NASL
    descriptionMozilla Foundation reports : CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 CVE-2018-18492: Use-after-free with select element CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs CVE-2018-18495: WebExtension content scripts can be loaded in about: pages CVE-2018-18496: Embedded feed preview page can be abused for clickjacking CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators CVE-2018-18498: Integer overflow when calculating buffer sizes for images CVE-2018-12406: Memory safety bugs fixed in Firefox 64 CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4
    last seen2020-04-30
    modified2018-12-13
    plugin id119636
    published2018-12-13
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119636
    titleFreeBSD : mozilla -- multiple vulnerabilities (d10b49b2-8d02-49e8-afde-0844626317af)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2020 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119636);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/28");
    
      script_cve_id("CVE-2018-12405", "CVE-2018-12406", "CVE-2018-12407", "CVE-2018-17466", "CVE-2018-18492", "CVE-2018-18493", "CVE-2018-18494", "CVE-2018-18495", "CVE-2018-18496", "CVE-2018-18497", "CVE-2018-18498");
    
      script_name(english:"FreeBSD : mozilla -- multiple vulnerabilities (d10b49b2-8d02-49e8-afde-0844626317af)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Foundation reports :
    
    CVE-2018-12407: Buffer overflow with ANGLE library when using
    VertexBuffer11 module
    
    CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE
    library with TextureStorage11
    
    CVE-2018-18492: Use-after-free with select element
    
    CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
    
    CVE-2018-18494: Same-origin policy violation using location attribute
    and performance.getEntries to steal cross-origin URLs
    
    CVE-2018-18495: WebExtension content scripts can be loaded in about:
    pages
    
    CVE-2018-18496: Embedded feed preview page can be abused for
    clickjacking
    
    CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe
    separators
    
    CVE-2018-18498: Integer overflow when calculating buffer sizes for
    images
    
    CVE-2018-12406: Memory safety bugs fixed in Firefox 64
    
    CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR
    60.4"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/"
      );
      # https://vuxml.freebsd.org/freebsd/d10b49b2-8d02-49e8-afde-0844626317af.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?2a43fa4a"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:firefox-esr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:libxul");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:waterfox");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/12/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/12/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"firefox<64.0_3,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"waterfox<56.2.6")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"seamonkey<2.53.0")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-seamonkey<2.53.0")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"firefox-esr<60.4.0,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-firefox<60.4.0,2")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"libxul<60.4.0")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"thunderbird<60.4.0")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-thunderbird<60.4.0")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_64_0.NASL
    descriptionThe version of Mozilla Firefox installed on the remote Windows host is is prior to 64.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-29 advisory. - A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. (CVE-2018-12407) - A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the ANGLE graphics library, used for WebGL content. This results in a potentially exploitable crash. (CVE-2018-17466) - A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. (CVE-2018-18492) - A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. (CVE-2018-18493) - A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same- origin policy violation and could allow for data theft. (CVE-2018-18494) - WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. (CVE-2018-18495) - When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.* (CVE-2018-18496) - Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to opened privileged about: or file: locations. (CVE-2018-18497) - A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This can lead to an out-of-bounds write. (CVE-2018-18498) - The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purposes. This issue allows for a non-persistent denial of service (DOS) attack by a malicious site which links to these pages. (CVE-2018-18510) - Mozilla developers and community members Alex Gaynor, Andr Bargull, Boris Zbarsky, Christian Holler, Jan de Mooij, Jason Kratzer, Philipp, Ronald Crane, Natalia Csoregi, and Paul Theriault reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2018-12406) - Mozilla developers and community members Christian Holler, Diego Calleja, Andrew McCreight, Jon Coppeard, Jed Davis, Natalia Csoregi, Nicolas B. Pierron, and Tyson Smith reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2018-12405) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id119604
    published2018-12-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119604
    titleMozilla Firefox < 64.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    # The descriptive text and package checks in this plugin were
    # extracted from Mozilla Foundation Security Advisory mfsa2018-29.
    # The text itself is copyright (C) Mozilla Foundation.
    
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119604);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/01");
    
      script_cve_id(
        "CVE-2018-12405",
        "CVE-2018-12406",
        "CVE-2018-12407",
        "CVE-2018-17466",
        "CVE-2018-18492",
        "CVE-2018-18493",
        "CVE-2018-18494",
        "CVE-2018-18495",
        "CVE-2018-18496",
        "CVE-2018-18497",
        "CVE-2018-18498",
        "CVE-2018-18510"
      );
      script_xref(name:"MFSA", value:"2018-29");
    
      script_name(english:"Mozilla Firefox < 64.0 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Firefox.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web browser installed on the remote Windows host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Mozilla Firefox installed on the remote Windows host is
    is prior to 64.0. It is, therefore, affected by multiple
    vulnerabilities as referenced in the mfsa2018-29 advisory.
    
      - A buffer overflow occurs when drawing and validating
        elements with the ANGLE graphics library, used for WebGL
        content, when working with the
        VertexBuffer11 module. This results in a
        potentially exploitable crash. (CVE-2018-12407)
    
      - A buffer overflow and out-of-bounds read can occur in
        TextureStorage11 within the ANGLE graphics
        library, used for WebGL content. This results in a
        potentially exploitable crash. (CVE-2018-17466)
    
      - A use-after-free vulnerability can occur after deleting
        a selection element due to a weak reference to the
        select element in the options
        collection. This results in a potentially exploitable
        crash. (CVE-2018-18492)
    
      - A buffer overflow can occur in the Skia library during
        buffer offset calculations with hardware accelerated
        canvas 2D actions due to the use of 32-bit calculations
        instead of 64-bit. This results in a potentially
        exploitable crash. (CVE-2018-18493)
    
      - A same-origin policy violation allowing the theft of
        cross-origin URL entries when using the Javascript
        location property to cause a redirection to
        another site using
        performance.getEntries(). This is a same-
        origin policy violation and could allow for data theft.
        (CVE-2018-18494)
    
      - WebExtension content scripts can be loaded into
        about: pages in some circumstances, in
        violation of the permissions granted to extensions. This
        could allow an extension to interfere with the loading
        and usage of these pages and use capabilities that were
        intended to be restricted from extensions.
        (CVE-2018-18495)
    
      - When the RSS Feed preview about:feeds page
        is framed within another page, it can be used in concert
        with scripted content for a clickjacking attack that
        confuses users into downloading and executing an
        executable file from a temporary directory. *Note:
        This issue only affects Windows operating systems. Other
        operating systems are not affected.* (CVE-2018-18496)
    
      - Limitations on the URIs allowed to WebExtensions by the
        browser.windows.create API can be bypassed
        when a pipe in the URL field is used within the
        extension to load multiple pages as a single argument.
        This could allow a malicious WebExtension to opened
        privileged about: or file:
        locations. (CVE-2018-18497)
    
      - A potential vulnerability leading to an integer overflow
        can occur during buffer size calculations for images
        when a raw value is used instead of the checked value.
        This can lead to an out-of-bounds write.
        (CVE-2018-18498)
    
      - The about:crashcontent and
        about:crashparent pages can be triggered by
        web content. These pages are used to crash the loaded
        page or the browser for test purposes. This issue allows
        for a non-persistent denial of service (DOS) attack by a
        malicious site which links to these pages.
        (CVE-2018-18510)
    
      - Mozilla developers and community members Alex Gaynor,
        Andr Bargull, Boris Zbarsky, Christian Holler, Jan de
        Mooij, Jason Kratzer, Philipp, Ronald Crane, Natalia
        Csoregi, and Paul Theriault reported memory safety bugs
        present in Firefox 63. Some of these bugs showed
        evidence of memory corruption and we presume that with
        enough effort that some of these could be exploited to
        run arbitrary code. (CVE-2018-12406)
    
      - Mozilla developers and community members Christian
        Holler, Diego Calleja, Andrew McCreight, Jon Coppeard,
        Jed Davis, Natalia Csoregi, Nicolas B. Pierron, and
        Tyson Smith reported memory safety bugs present in
        Firefox 63 and Firefox ESR 60.3. Some of these bugs
        showed evidence of memory corruption and we presume that
        with enough effort that some of these could be exploited
        to run arbitrary code. (CVE-2018-12405)
    
    Note that Nessus has not tested for this issue but has instead relied
    only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1422231");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1427585");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1434490");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1456947");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1458129");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1475669");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1481745");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1487964");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1488180");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1488295");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1494752");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1498765");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1499198");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1499861");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500011");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500064");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500310");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500696");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500759");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1502013");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1502886");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1503082");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1503326");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1504365");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1504452");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1504816");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1505181");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1505973");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1506640");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1507702");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1510471");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Mozilla Firefox version 64.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-18498");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/12/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/12/12");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Firefox/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    
    port = get_kb_item("SMB/transport");
    if (!port) port = 445;
    
    installs = get_kb_list("SMB/Mozilla/Firefox/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Firefox");
    
    mozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'64.0', severity:SECURITY_HOLE);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_64_0.NASL
    descriptionThe version of Mozilla Firefox installed on the remote macOS host is prior to 64.0. It is, therefore, affected by multiple vulnerabilities as noted in Mozilla Firefox stable channel update release notes for 2018/12/11. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.
    last seen2019-02-21
    modified2019-01-31
    plugin id119603
    published2018-12-12
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=119603
    titleMozilla Firefox < 64.0 Multiple Vulnerabilities (macOS)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # @DEPRECATED@
    #
    # Disabled on 2019/05/08. Deprecated by macos_firefox_64_0.nasl
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119603);
      script_version("1.4");
      script_cvs_date("Date: 2019/05/08 12:46:36");
    
      script_cve_id(
        "CVE-2018-12405",
        "CVE-2018-12406",
        "CVE-2018-12407",
        "CVE-2018-17466",
        "CVE-2018-18492",
        "CVE-2018-18493",
        "CVE-2018-18494",
        "CVE-2018-18495",
        "CVE-2018-18496",
        "CVE-2018-18497",
        "CVE-2018-18498"
      );
    
      script_name(english:"Mozilla Firefox < 64.0 Multiple Vulnerabilities (macOS) (deprecated)");
      script_summary(english:"Checks the version of Firefox.");
    
      script_set_attribute(attribute:"synopsis", value:
    "This plugin has been deprecated.");
      script_set_attribute(attribute:"description", value:
    "This plugin is a duplicate of plugin ID 122192 and has been
    deprecated.");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1422231
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?39cf90b2");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1427585
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?49133ad0");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1434490
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2e2ade34");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1456947
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d0ce18e5");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1458129
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ea477541");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1475669
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1620e461");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1481745
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b42f7123");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1487964
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bfb534bf");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1488180
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c97806f0");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1488295
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?073e58a5");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1494752
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2d00e047");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1498765
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e4de96e6");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1499198
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?82d76ead");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1499861
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20902119");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1500011
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cee5fb79");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1500064
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a2d4d47b");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1500310
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f4a48a6c");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1500696
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4dfc8a45");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1500759
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9b6def6c");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1502013
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9c1b25bb");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1502886
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?393f22fe");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1503082
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?74015e4e");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1503326
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?56acb454");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1504365
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7d52ad8b");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1504452
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c09a06dc");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1504816
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4b722444");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1505181
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d477b15c");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1505973
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5a4b622a");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1506640
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59cea44c");
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1510471
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7e37f4f1");
      # https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?43f8626d");
      script_set_attribute(attribute:"solution", value:"n/a");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-12405");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/12/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/12/12");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_firefox_installed.nasl");
      script_require_keys("MacOSX/Firefox/Installed");
    
      exit(0);
    }
    
    # DEPRECATED 08 MAY 2019 / use plugin ID
    exit(0, "This plugin has been deprecated. Use macos_firefox_64_0.nasl (plugin ID 122192) instead.");
    
    include("mozilla_version.inc");
    
    kb_base = "MacOSX/Firefox";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    if (get_kb_item(kb_base + '/is_esr')) exit(0, 'The Mozilla Firefox installation is in the ESR branch.');
    
    mozilla_check_version(product:'firefox', version:version, path:path, esr:FALSE, fix:'64.0', severity:SECURITY_HOLE);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_FIREFOX_64_0.NASL
    descriptionThe version of Firefox installed on the remote macOS or Mac OS X host is prior to 64.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-29 advisory. - A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. (CVE-2018-12407) - A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the ANGLE graphics library, used for WebGL content. This results in a potentially exploitable crash. (CVE-2018-17466) - A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. (CVE-2018-18492) - A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. (CVE-2018-18493) - A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same- origin policy violation and could allow for data theft. (CVE-2018-18494) - WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. (CVE-2018-18495) - When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.* (CVE-2018-18496) - Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to opened privileged about: or file: locations. (CVE-2018-18497) - A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This can lead to an out-of-bounds write. (CVE-2018-18498) - The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purposes. This issue allows for a non-persistent denial of service (DOS) attack by a malicious site which links to these pages. (CVE-2018-18510) - Mozilla developers and community members Alex Gaynor, Andr Bargull, Boris Zbarsky, Christian Holler, Jan de Mooij, Jason Kratzer, Philipp, Ronald Crane, Natalia Csoregi, and Paul Theriault reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2018-12406) - Mozilla developers and community members Christian Holler, Diego Calleja, Andrew McCreight, Jon Coppeard, Jed Davis, Natalia Csoregi, Nicolas B. Pierron, and Tyson Smith reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2018-12405) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id122192
    published2019-02-14
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122192
    titleMozilla Firefox < 64.0
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    # The descriptive text and package checks in this plugin were
    # extracted from Mozilla Foundation Security Advisory mfsa2018-29.
    # The text itself is copyright (C) Mozilla Foundation.
    
    
    include("compat.inc");
    
    if (description)
    {
      script_id(122192);
      script_version("1.2");
      script_cvs_date("Date: 2019/10/31 15:18:51");
    
      script_cve_id(
        "CVE-2018-12405",
        "CVE-2018-12406",
        "CVE-2018-12407",
        "CVE-2018-17466",
        "CVE-2018-18492",
        "CVE-2018-18493",
        "CVE-2018-18494",
        "CVE-2018-18495",
        "CVE-2018-18496",
        "CVE-2018-18497",
        "CVE-2018-18498",
        "CVE-2018-18510"
      );
      script_xref(name:"MFSA", value:"2018-29");
    
      script_name(english:"Mozilla Firefox < 64.0");
      script_summary(english:"Checks the version of Firefox.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web browser installed on the remote macOS or Mac OS X host is
    affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Firefox installed on the remote macOS or Mac OS X host
    is prior to 64.0. It is, therefore, affected by multiple
    vulnerabilities as referenced in the mfsa2018-29 advisory.
    
      - A buffer overflow occurs when drawing and validating
        elements with the ANGLE graphics library, used for WebGL
        content, when working with the
        VertexBuffer11 module. This results in a
        potentially exploitable crash. (CVE-2018-12407)
    
      - A buffer overflow and out-of-bounds read can occur in
        TextureStorage11 within the ANGLE graphics
        library, used for WebGL content. This results in a
        potentially exploitable crash. (CVE-2018-17466)
    
      - A use-after-free vulnerability can occur after deleting
        a selection element due to a weak reference to the
        select element in the options
        collection. This results in a potentially exploitable
        crash. (CVE-2018-18492)
    
      - A buffer overflow can occur in the Skia library during
        buffer offset calculations with hardware accelerated
        canvas 2D actions due to the use of 32-bit calculations
        instead of 64-bit. This results in a potentially
        exploitable crash. (CVE-2018-18493)
    
      - A same-origin policy violation allowing the theft of
        cross-origin URL entries when using the Javascript
        location property to cause a redirection to
        another site using
        performance.getEntries(). This is a same-
        origin policy violation and could allow for data theft.
        (CVE-2018-18494)
    
      - WebExtension content scripts can be loaded into
        about: pages in some circumstances, in
        violation of the permissions granted to extensions. This
        could allow an extension to interfere with the loading
        and usage of these pages and use capabilities that were
        intended to be restricted from extensions.
        (CVE-2018-18495)
    
      - When the RSS Feed preview about:feeds page
        is framed within another page, it can be used in concert
        with scripted content for a clickjacking attack that
        confuses users into downloading and executing an
        executable file from a temporary directory. *Note:
        This issue only affects Windows operating systems. Other
        operating systems are not affected.* (CVE-2018-18496)
    
      - Limitations on the URIs allowed to WebExtensions by the
        browser.windows.create API can be bypassed
        when a pipe in the URL field is used within the
        extension to load multiple pages as a single argument.
        This could allow a malicious WebExtension to opened
        privileged about: or file:
        locations. (CVE-2018-18497)
    
      - A potential vulnerability leading to an integer overflow
        can occur during buffer size calculations for images
        when a raw value is used instead of the checked value.
        This can lead to an out-of-bounds write.
        (CVE-2018-18498)
    
      - The about:crashcontent and
        about:crashparent pages can be triggered by
        web content. These pages are used to crash the loaded
        page or the browser for test purposes. This issue allows
        for a non-persistent denial of service (DOS) attack by a
        malicious site which links to these pages.
        (CVE-2018-18510)
    
      - Mozilla developers and community members Alex Gaynor,
        Andr Bargull, Boris Zbarsky, Christian Holler, Jan de
        Mooij, Jason Kratzer, Philipp, Ronald Crane, Natalia
        Csoregi, and Paul Theriault reported memory safety bugs
        present in Firefox 63. Some of these bugs showed
        evidence of memory corruption and we presume that with
        enough effort that some of these could be exploited to
        run arbitrary code. (CVE-2018-12406)
    
      - Mozilla developers and community members Christian
        Holler, Diego Calleja, Andrew McCreight, Jon Coppeard,
        Jed Davis, Natalia Csoregi, Nicolas B. Pierron, and
        Tyson Smith reported memory safety bugs present in
        Firefox 63 and Firefox ESR 60.3. Some of these bugs
        showed evidence of memory corruption and we presume that
        with enough effort that some of these could be exploited
        to run arbitrary code. (CVE-2018-12405)
    
    Note that Nessus has not tested for this issue but has instead relied
    only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1505973");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1488295");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1499861");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1504452");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1487964");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1427585");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1422231");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1488180");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500011");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1507702");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1456947");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1475669");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1504816");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1502886");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500064");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500310");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500696");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1499198");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1434490");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1481745");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1458129");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1494752");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1498765");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1503326");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1505181");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1500759");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1504365");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1506640");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1503082");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1502013");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=1510471");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Mozilla Firefox version 64.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-18498");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/12/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_firefox_installed.nasl");
      script_require_keys("MacOSX/Firefox/Installed");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    
    kb_base = "MacOSX/Firefox";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    is_esr = get_kb_item(kb_base+"/is_esr");
    if (is_esr) exit(0, 'The Mozilla Firefox installation is in the ESR branch.');
    
    mozilla_check_version(version:version, path:path, product:'firefox', esr:FALSE, fix:'64.0', severity:SECURITY_HOLE);