Test ID:	1.3.6.1.4.1.25623.1.0.884337
Category:	CentOS Local Security Checks
Title:	CentOS: Security Advisory for firefox (CESA-2024:1486)
Summary:	The remote host is missing an update for the 'firefox'; package(s) announced via the CESA-2024:1486 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the CESA-2024:1486 advisory. Vulnerability Insight: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This Update upgrades Firefox to version 115.9.1 ESR. Security Fix(es): * nss: timing attack against RSA decryption (CVE-2023-5388) * Mozilla: Crash in NSS TLS method (CVE-2024-0743) * Mozilla: JIT code failed to save return registers on Armv7-A (CVE-2024-2607) * Mozilla: Integer overflow could have led to out of bounds write (CVE-2024-2608) * Mozilla: Improve handling of out-of-memory conditions in ICU (CVE-2024-2616) * Mozilla: Improper handling of html and body tags enabled CSP nonce leakage (CVE-2024-2610) * Mozilla: Clickjacking vulnerability could have led to a user accidentally granting permissions (CVE-2024-2611) * Mozilla: Self referencing object could have potentially led to a use-after-free (CVE-2024-2612) * Mozilla: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9 (CVE-2024-2614) * Mozilla: Privileged JavaScript Execution via Event Handlers (CVE-2024-29944) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Affected Software/OS: 'firefox' package(s) on CentOS 7. Solution: Please install the updated package(s). CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-5388 https://bugzilla.mozilla.org/show_bug.cgi?id=1780432 https://www.mozilla.org/security/advisories/mfsa2024-12/ https://www.mozilla.org/security/advisories/mfsa2024-13/ https://www.mozilla.org/security/advisories/mfsa2024-14/ https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html Common Vulnerability Exposure (CVE) ID: CVE-2024-0743 https://bugzilla.mozilla.org/show_bug.cgi?id=1867408 https://lists.debian.org/debian-lts-announce/2024/03/msg00010.html https://www.mozilla.org/security/advisories/mfsa2024-01/ Common Vulnerability Exposure (CVE) ID: CVE-2024-2607 https://bugzilla.mozilla.org/show_bug.cgi?id=1879939 Common Vulnerability Exposure (CVE) ID: CVE-2024-2608 https://bugzilla.mozilla.org/show_bug.cgi?id=1880692 Common Vulnerability Exposure (CVE) ID: CVE-2024-2616 https://bugzilla.mozilla.org/show_bug.cgi?id=1846197 Common Vulnerability Exposure (CVE) ID: CVE-2024-2610 https://bugzilla.mozilla.org/show_bug.cgi?id=1871112 Common Vulnerability Exposure (CVE) ID: CVE-2024-2611 https://bugzilla.mozilla.org/show_bug.cgi?id=1876675 Common Vulnerability Exposure (CVE) ID: CVE-2024-2612 https://bugzilla.mozilla.org/show_bug.cgi?id=1879444 Common Vulnerability Exposure (CVE) ID: CVE-2024-2614 Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685358%2C1861016%2C1880405%2C1881093 Common Vulnerability Exposure (CVE) ID: CVE-2024-29944 https://bugzilla.mozilla.org/show_bug.cgi?id=1886852 https://www.mozilla.org/security/advisories/mfsa2024-15/ https://www.mozilla.org/security/advisories/mfsa2024-16/ http://www.openwall.com/lists/oss-security/2024/03/23/1
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.