Test ID:	1.3.6.1.4.1.25623.1.0.843432
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3544-1)
Summary:	The remote host is missing an update for the 'firefox' package(s) announced via the USN-3544-1 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the USN-3544-1 advisory. Vulnerability Insight: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, spoof the origin in audio capture prompts, trick the user in to providing HTTP credentials for another origin, spoof the addressbar contents, or execute arbitrary code. (CVE-2018-5089, CVE-2018-5090, CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5109, CVE-2018-5114, CVE-2018-5115, CVE-2018-5117, CVE-2018-5122) Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to gain additional privileges, bypass same-origin restrictions, or execute arbitrary code. (CVE-2018-5105, CVE-2018-5113, CVE-2018-5116) A security issue was discovered with the developer tools. If a user were tricked in to opening a specially crafted website with the developer tools open, an attacker could potentially exploit this to obtain sensitive information from other origins. (CVE-2018-5106) A security issue was discovered with printing. An attacker could potentially exploit this to obtain sensitive information from local files. (CVE-2018-5107) It was discovered that manually entered blob URLs could be accessed by subsequent private browsing tabs. If a user were tricked in to entering a blob URL, an attacker could potentially exploit this to obtain sensitive information from a private browsing context. (CVE-2018-5108) It was discovered that dragging certain specially formatted URLs to the addressbar could cause the wrong URL to be displayed. If a user were tricked in to opening a specially crafted website and dragging a URL to the addressbar, an attacker could potentially exploit this to spoof the addressbar contents. (CVE-2018-5111) It was discovered that WebExtension developer tools panels could open non-relative URLs. If a user were tricked in to installing a specially crafted extension and running the developer tools, an attacker could potentially exploit this to gain additional privileges. (CVE-2018-5112) It was discovered that ActivityStream images can attempt to load local content through file: URLs. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in combination with another vulnerability that allowed sandbox protections to be bypassed, in order to obtain sensitive information from local files. (CVE-2018-5118) It was discovered that the reader view will load cross-origin content in violation of CORS headers. An attacker could exploit this to bypass CORS restrictions. (CVE-2018-5119) Affected Software/OS: 'firefox' package(s) on Ubuntu 14.04, Ubuntu 16.04, Ubuntu 17.10. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-5089 BugTraq ID: 102783 http://www.securityfocus.com/bid/102783 Debian Security Information: DSA-4096 (Google Search) https://www.debian.org/security/2018/dsa-4096 Debian Security Information: DSA-4102 (Google Search) https://www.debian.org/security/2018/dsa-4102 https://lists.debian.org/debian-lts-announce/2018/01/msg00030.html https://lists.debian.org/debian-lts-announce/2018/01/msg00036.html RedHat Security Advisories: RHSA-2018:0122 https://access.redhat.com/errata/RHSA-2018:0122 RedHat Security Advisories: RHSA-2018:0262 https://access.redhat.com/errata/RHSA-2018:0262 http://www.securitytracker.com/id/1040270 https://usn.ubuntu.com/3544-1/ https://usn.ubuntu.com/3688-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-5090 BugTraq ID: 102786 http://www.securityfocus.com/bid/102786 Common Vulnerability Exposure (CVE) ID: CVE-2018-5091 Common Vulnerability Exposure (CVE) ID: CVE-2018-5092 Common Vulnerability Exposure (CVE) ID: CVE-2018-5093 Common Vulnerability Exposure (CVE) ID: CVE-2018-5094 Common Vulnerability Exposure (CVE) ID: CVE-2018-5095 Common Vulnerability Exposure (CVE) ID: CVE-2018-5097 Common Vulnerability Exposure (CVE) ID: CVE-2018-5098 Common Vulnerability Exposure (CVE) ID: CVE-2018-5099 Common Vulnerability Exposure (CVE) ID: CVE-2018-5100 Common Vulnerability Exposure (CVE) ID: CVE-2018-5101 Common Vulnerability Exposure (CVE) ID: CVE-2018-5102 Common Vulnerability Exposure (CVE) ID: CVE-2018-5103 Common Vulnerability Exposure (CVE) ID: CVE-2018-5104 Common Vulnerability Exposure (CVE) ID: CVE-2018-5105 Common Vulnerability Exposure (CVE) ID: CVE-2018-5106 Common Vulnerability Exposure (CVE) ID: CVE-2018-5107 Common Vulnerability Exposure (CVE) ID: CVE-2018-5108 Common Vulnerability Exposure (CVE) ID: CVE-2018-5109 Common Vulnerability Exposure (CVE) ID: CVE-2018-5111 Common Vulnerability Exposure (CVE) ID: CVE-2018-5112 Common Vulnerability Exposure (CVE) ID: CVE-2018-5113 Common Vulnerability Exposure (CVE) ID: CVE-2018-5114 Common Vulnerability Exposure (CVE) ID: CVE-2018-5115 Common Vulnerability Exposure (CVE) ID: CVE-2018-5116 Common Vulnerability Exposure (CVE) ID: CVE-2018-5117 Common Vulnerability Exposure (CVE) ID: CVE-2018-5118 Common Vulnerability Exposure (CVE) ID: CVE-2018-5119 Common Vulnerability Exposure (CVE) ID: CVE-2018-5122
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.