Test ID:	1.3.6.1.4.1.25623.1.1.10.2023.0235
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2023-0235)
Summary:	The remote host is missing an update for the 'firefox, firefox-l10n, nss' package(s) announced via the MGASA-2023-0235 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox, firefox-l10n, nss' package(s) announced via the MGASA-2023-0235 advisory. Vulnerability Insight: An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS (CVE-2023-37201). Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free in SpiderMonkey (CVE-2023-37202). A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks (CVE-2023-37207). When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code (CVE-2023-37208). Memory safety bugs present in Firefox ESR 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2023-37211). Affected Software/OS: 'firefox, firefox-l10n, nss' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-37201 Debian Security Information: DSA-5450 (Google Search) https://www.debian.org/security/2023/dsa-5450 Debian Security Information: DSA-5451 (Google Search) https://www.debian.org/security/2023/dsa-5451 https://bugzilla.mozilla.org/show_bug.cgi?id=1826002 https://www.mozilla.org/security/advisories/mfsa2023-22/ https://www.mozilla.org/security/advisories/mfsa2023-23/ https://www.mozilla.org/security/advisories/mfsa2023-24/ https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html Common Vulnerability Exposure (CVE) ID: CVE-2023-37202 https://bugzilla.mozilla.org/show_bug.cgi?id=1834711 Common Vulnerability Exposure (CVE) ID: CVE-2023-37207 https://bugzilla.mozilla.org/show_bug.cgi?id=1816287 Common Vulnerability Exposure (CVE) ID: CVE-2023-37208 https://bugzilla.mozilla.org/show_bug.cgi?id=1837675 Common Vulnerability Exposure (CVE) ID: CVE-2023-37211 Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1832306%2C1834862%2C1835886%2C1836550%2C1837450
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.