Test ID:	1.3.6.1.4.1.25623.1.0.843521
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3645-1)
Summary:	The remote host is missing an update for the 'firefox' package(s) announced via the USN-3645-1 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the USN-3645-1 advisory. Vulnerability Insight: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, install lightweight themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code. (CVE-2018-5150, CVE-2018-5151, CVE-2018-5153, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5160, CVE-2018-5163, CVE-2018-5164, CVE-2018-5168, CVE-2018-5173, CVE-2018-5175, CVE-2018-5177, CVE-2018-5180) Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to obtain sensitive information, or bypass security restrictions. (CVE-2018-5152, CVE-2018-5166) It was discovered that the web console and JavaScript debugger incorrectly linkified chrome: and javascript URLs. If a user were tricked in to clicking a specially crafted link, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5167) It was discovered that dragging and dropping link text on to the home button could set the home page to include chrome pages. If a user were tricked in to dragging and dropping a specially crafted link on to the home button, an attacker could potentially exploit this bypass security restrictions. (CVE-2018-5169) It was discovered that the Live Bookmarks page and PDF viewer would run script pasted from the clipboard. If a user were tricked in to copying and pasting specially crafted text, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5172) It was discovered that the JSON viewer incorrectly linkified javascript: URLs. If a user were tricked in to clicking on a specially crafted link, an attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5176) It was discovered that dragging a file: URL on to a tab that is running in a different process would cause the file to open in that process. If a user were tricked in to dragging a file: URL, an attacker could potentially exploit this to bypass intended security policies. (CVE-2018-5181) It was discovered that dragging text that is a file: URL on to the addressbar would open the specified file. If a user were tricked in to dragging specially crafted text on to the addressbar, an attacker could potentially exploit this to bypass intended security policies. (CVE-2018-5182) Affected Software/OS: 'firefox' package(s) on Ubuntu 14.04, Ubuntu 16.04, Ubuntu 17.10, Ubuntu 18.04. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-5150 BugTraq ID: 104136 http://www.securityfocus.com/bid/104136 Debian Security Information: DSA-4199 (Google Search) https://www.debian.org/security/2018/dsa-4199 Debian Security Information: DSA-4209 (Google Search) https://www.debian.org/security/2018/dsa-4209 https://security.gentoo.org/glsa/201810-01 https://security.gentoo.org/glsa/201811-13 https://lists.debian.org/debian-lts-announce/2018/05/msg00007.html https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html RedHat Security Advisories: RHSA-2018:1414 https://access.redhat.com/errata/RHSA-2018:1414 RedHat Security Advisories: RHSA-2018:1415 https://access.redhat.com/errata/RHSA-2018:1415 RedHat Security Advisories: RHSA-2018:1725 https://access.redhat.com/errata/RHSA-2018:1725 RedHat Security Advisories: RHSA-2018:1726 https://access.redhat.com/errata/RHSA-2018:1726 http://www.securitytracker.com/id/1040896 https://usn.ubuntu.com/3645-1/ https://usn.ubuntu.com/3660-1/ https://usn.ubuntu.com/3688-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-5151 BugTraq ID: 104139 http://www.securityfocus.com/bid/104139 Common Vulnerability Exposure (CVE) ID: CVE-2018-5152 Common Vulnerability Exposure (CVE) ID: CVE-2018-5153 Common Vulnerability Exposure (CVE) ID: CVE-2018-5154 Common Vulnerability Exposure (CVE) ID: CVE-2018-5155 Common Vulnerability Exposure (CVE) ID: CVE-2018-5157 Common Vulnerability Exposure (CVE) ID: CVE-2018-5158 Common Vulnerability Exposure (CVE) ID: CVE-2018-5159 https://www.exploit-db.com/exploits/44759/ Common Vulnerability Exposure (CVE) ID: CVE-2018-5160 Common Vulnerability Exposure (CVE) ID: CVE-2018-5163 Common Vulnerability Exposure (CVE) ID: CVE-2018-5164 Common Vulnerability Exposure (CVE) ID: CVE-2018-5166 Common Vulnerability Exposure (CVE) ID: CVE-2018-5167 Common Vulnerability Exposure (CVE) ID: CVE-2018-5168 Common Vulnerability Exposure (CVE) ID: CVE-2018-5169 Common Vulnerability Exposure (CVE) ID: CVE-2018-5172 Common Vulnerability Exposure (CVE) ID: CVE-2018-5173 Common Vulnerability Exposure (CVE) ID: CVE-2018-5175 Common Vulnerability Exposure (CVE) ID: CVE-2018-5176 Common Vulnerability Exposure (CVE) ID: CVE-2018-5177 Common Vulnerability Exposure (CVE) ID: CVE-2018-5180 Common Vulnerability Exposure (CVE) ID: CVE-2018-5181 Common Vulnerability Exposure (CVE) ID: CVE-2018-5182
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.