Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.6010.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6010-1)
Summary:	The remote host is missing an update for the 'firefox' package(s) announced via the USN-6010-1 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the USN-6010-1 advisory. Vulnerability Insight: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2023-29537, CVE-2023-29540, CVE-2023-29543, CVE-2023-29544, CVE-2023-29547, CVE-2023-29548, CVE-2023-29549, CVE-2023-29550, CVE-2023-29551) Irvan Kurniawan discovered that Firefox did not properly manage fullscreen notifications using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. An attacker could potentially exploit this issue to perform spoofing attacks. (CVE-2023-29533) Lukas Bernhard discovered that Firefox did not properly manage memory when doing Garbage Collector compaction. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-29535) Zx from qriousec discovered that Firefox did not properly validate the address to free a pointer provided to the memory manager. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-29536) Alexis aka zoracon discovered that Firefox did not properly validate the URI received by the WebExtension during a load request. An attacker could potentially exploits this to obtain sensitive information. (CVE-2023-29538) Trung Pham discovered that Firefox did not properly validate the filename directive in the Content-Disposition header. An attacker could possibly exploit this to perform reflected file download attacks potentially tricking users to install malware. (CVE-2023-29539) Ameen Basha M K discovered that Firefox did not properly validate downloads of files ending in .desktop. An attacker could potentially exploits this issue to execute arbitrary code. (CVE-2023-29541) Affected Software/OS: 'firefox' package(s) on Ubuntu 18.04, Ubuntu 20.04. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-29533 https://bugzilla.mozilla.org/show_bug.cgi?id=1798219 https://bugzilla.mozilla.org/show_bug.cgi?id=1814597 https://www.mozilla.org/security/advisories/mfsa2023-13/ https://www.mozilla.org/security/advisories/mfsa2023-14/ https://www.mozilla.org/security/advisories/mfsa2023-15/ Common Vulnerability Exposure (CVE) ID: CVE-2023-29535 https://bugzilla.mozilla.org/show_bug.cgi?id=1820543 Common Vulnerability Exposure (CVE) ID: CVE-2023-29536 https://bugzilla.mozilla.org/show_bug.cgi?id=1821959 Common Vulnerability Exposure (CVE) ID: CVE-2023-29537 https://bugzilla.mozilla.org/show_bug.cgi?id=1823365 https://bugzilla.mozilla.org/show_bug.cgi?id=1824200 https://bugzilla.mozilla.org/show_bug.cgi?id=1825569 Common Vulnerability Exposure (CVE) ID: CVE-2023-29538 https://bugzilla.mozilla.org/show_bug.cgi?id=1685403 Common Vulnerability Exposure (CVE) ID: CVE-2023-29539 https://bugzilla.mozilla.org/show_bug.cgi?id=1784348 Common Vulnerability Exposure (CVE) ID: CVE-2023-29540 https://bugzilla.mozilla.org/show_bug.cgi?id=1790542 Common Vulnerability Exposure (CVE) ID: CVE-2023-29541 https://bugzilla.mozilla.org/show_bug.cgi?id=1810191 Common Vulnerability Exposure (CVE) ID: CVE-2023-29543 https://bugzilla.mozilla.org/show_bug.cgi?id=1816158 Common Vulnerability Exposure (CVE) ID: CVE-2023-29544 https://bugzilla.mozilla.org/show_bug.cgi?id=1818781 Common Vulnerability Exposure (CVE) ID: CVE-2023-29547 https://bugzilla.mozilla.org/show_bug.cgi?id=1783536 Common Vulnerability Exposure (CVE) ID: CVE-2023-29548 https://bugzilla.mozilla.org/show_bug.cgi?id=1822754 Common Vulnerability Exposure (CVE) ID: CVE-2023-29549 https://bugzilla.mozilla.org/show_bug.cgi?id=1823042 Common Vulnerability Exposure (CVE) ID: CVE-2023-29550 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1720594%2C1812498%2C1814217%2C1818357%2C1751945%2C1818762%2C1819493%2C1820389%2C1820602%2C1821448%2C1822413%2C1824828 Common Vulnerability Exposure (CVE) ID: CVE-2023-29551 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1763625%2C1814314%2C1815798%2C1815890%2C1819239%2C1819465%2C1819486%2C1819492%2C1819957%2C1820514%2C1820776%2C1821838%2C1822175%2C1823547
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.