Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.6201.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6201-1)
Summary:	The remote host is missing an update for the 'firefox' package(s) announced via the USN-6201-1 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox' package(s) announced via the USN-6201-1 advisory. Vulnerability Insight: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2023-37201, CVE-2023-37202, CVE-2023-37205, CVE-2023-37207, CVE-2023-37209, CVE-2023-37210, CVE-2023-37211, CVE-2023-37212) Martin Hostettler discovered that Firefox did not properly block storage of all cookies when configured. An attacker could potentially exploits this issue to store tracking data without permission in localstorage. (CVE-2023-3482) Paul Nickerson discovered that Firefox did have insufficient validation in the Drag and Drop API. If a user were tricked into creating a shortcut to local system files, an attacker could execute arbitrary code. (CVE-2023-37203) Irvan Kurniawan discovered that Firefox did not properly manage fullscreen notifications using an option element having an expensive computational function. An attacker could potentially exploit this issue to perform spoofing attacks. (CVE-2023-37204) Ameen Basha M K discovered that Firefox did not properly validate symlinks in the FileSystem API. If a user were tricked into uploading a symlinked file to a malicious website, an attacker could obtain sensitive information. (CVE-2023-37206) Puf discovered that Firefox did not properly provide warning when opening Diagcab files. If a user were tricked into opening a malicicous Diagcab file, an attacker could execute arbitrary code. (CVE-2023-37208) Affected Software/OS: 'firefox' package(s) on Ubuntu 20.04. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-3482 https://security.gentoo.org/glsa/202401-10 https://bugzilla.mozilla.org/show_bug.cgi?id=1839464 https://www.mozilla.org/security/advisories/mfsa2023-22/ Common Vulnerability Exposure (CVE) ID: CVE-2023-37201 Debian Security Information: DSA-5450 (Google Search) https://www.debian.org/security/2023/dsa-5450 Debian Security Information: DSA-5451 (Google Search) https://www.debian.org/security/2023/dsa-5451 https://bugzilla.mozilla.org/show_bug.cgi?id=1826002 https://www.mozilla.org/security/advisories/mfsa2023-23/ https://www.mozilla.org/security/advisories/mfsa2023-24/ https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html Common Vulnerability Exposure (CVE) ID: CVE-2023-37202 https://bugzilla.mozilla.org/show_bug.cgi?id=1834711 Common Vulnerability Exposure (CVE) ID: CVE-2023-37203 https://bugzilla.mozilla.org/show_bug.cgi?id=291640 Common Vulnerability Exposure (CVE) ID: CVE-2023-37204 https://bugzilla.mozilla.org/show_bug.cgi?id=1832195 Common Vulnerability Exposure (CVE) ID: CVE-2023-37205 https://bugzilla.mozilla.org/show_bug.cgi?id=1704420 Common Vulnerability Exposure (CVE) ID: CVE-2023-37206 https://bugzilla.mozilla.org/show_bug.cgi?id=1813299 Common Vulnerability Exposure (CVE) ID: CVE-2023-37207 https://bugzilla.mozilla.org/show_bug.cgi?id=1816287 Common Vulnerability Exposure (CVE) ID: CVE-2023-37208 https://bugzilla.mozilla.org/show_bug.cgi?id=1837675 Common Vulnerability Exposure (CVE) ID: CVE-2023-37209 https://bugzilla.mozilla.org/show_bug.cgi?id=1837993 Common Vulnerability Exposure (CVE) ID: CVE-2023-37210 https://bugzilla.mozilla.org/show_bug.cgi?id=1821886 Common Vulnerability Exposure (CVE) ID: CVE-2023-37211 Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1832306%2C1834862%2C1835886%2C1836550%2C1837450 Common Vulnerability Exposure (CVE) ID: CVE-2023-37212 Memory safety bugs fixed in Firefox 115 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1750870%2C1825552%2C1826206%2C1827076%2C1828690%2C1833503%2C1835710%2C1838587
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.