CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
49.9%
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7a4026e363 advisory.
A compromised content process could have provided malicious data to FilterNodeD2D1
resulting in an out- of-bounds write, leading to a potentially exploitable crash in a privileged process. This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5168)
A compromised content process could have provided malicious data in a PathRecording
resulting in an out- of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5169)
In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memory leak of a privileged process. This memory leak could be used to effect a sandbox escape if the correct data was leaked. This vulnerability affects Firefox < 118. (CVE-2023-5170)
During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5171)
A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 118.
(CVE-2023-5172)
In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly under influence of a local unprivileged webpage), leading to an out-of-bounds write to privileged process memory. This bug only affects Firefox if a non-standard preference allowing non-HTTPS Alternate Services (network.http.altsvc.oe
) is enabled. This vulnerability affects Firefox < 118.
(CVE-2023-5173)
If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations (such as using runas
). Other operating systems are unaffected. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5174)
During process shutdown, it was possible that an ImageBitmap
was created that would later be used after being freed from a different codepath, leading to a potentially exploitable crash. This vulnerability affects Firefox < 118. (CVE-2023-5175)
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5176)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2023-7a4026e363
#
include('compat.inc');
if (description)
{
script_id(182395);
script_version("1.2");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/29");
script_cve_id(
"CVE-2023-5168",
"CVE-2023-5169",
"CVE-2023-5170",
"CVE-2023-5171",
"CVE-2023-5172",
"CVE-2023-5173",
"CVE-2023-5174",
"CVE-2023-5175",
"CVE-2023-5176"
);
script_xref(name:"FEDORA", value:"2023-7a4026e363");
script_xref(name:"IAVA", value:"2023-A-0507-S");
script_name(english:"Fedora 37 : firefox (2023-7a4026e363)");
script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the
FEDORA-2023-7a4026e363 advisory.
- A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-
of-bounds write, leading to a potentially exploitable crash in a privileged process. *This bug only
affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox <
118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5168)
- A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-
of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability
affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5169)
- In canvas rendering, a compromised content process could have caused a surface to change unexpectedly,
leading to a memory leak of a privileged process. This memory leak could be used to effect a sandbox
escape if the correct data was leaked. This vulnerability affects Firefox < 118. (CVE-2023-5170)
- During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing
an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects
Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5171)
- A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading
to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 118.
(CVE-2023-5172)
- In a non-standard configuration of Firefox, an integer overflow could have occurred based on network
traffic (possibly under influence of a local unprivileged webpage), leading to an out-of-bounds write to
privileged process memory. *This bug only affects Firefox if a non-standard preference allowing non-HTTPS
Alternate Services (`network.http.altsvc.oe`) is enabled.* This vulnerability affects Firefox < 118.
(CVE-2023-5173)
- If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently
freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. *This bug only
affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other
operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and
Thunderbird < 115.3. (CVE-2023-5174)
- During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after
being freed from a different codepath, leading to a potentially exploitable crash. This vulnerability
affects Firefox < 118. (CVE-2023-5175)
- Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs
showed evidence of memory corruption and we presume that with enough effort some of these could have been
exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and
Thunderbird < 115.3. (CVE-2023-5176)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2023-7a4026e363");
script_set_attribute(attribute:"solution", value:
"Update the affected firefox package.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-5176");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2023/09/26");
script_set_attribute(attribute:"patch_publication_date", value:"2023/09/27");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/09/30");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:37");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:firefox");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Fedora Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Fedora' >!< os_release) audit(AUDIT_OS_NOT, 'Fedora');
var os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
os_ver = os_ver[1];
if (! preg(pattern:"^37([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Fedora 37', 'Fedora ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);
var pkgs = [
{'reference':'firefox-118.0-1.fc37', 'release':'FC37', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE}
];
var flag = 0;
foreach package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (reference && _release) {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'firefox');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5168
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5169
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5170
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5171
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5172
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5173
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5174
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5175
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5176
bodhi.fedoraproject.org/updates/FEDORA-2023-7a4026e363
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
49.9%