A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox < 133, Thunderbird < 133, Firefox ESR < 128.7, and Thunderbird < 128.7.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0391-1 advisory.

    * MFSA 2025-09
      * CVE-2025-1009 (bmo#1936613)         Use-after-free in XSLT
      * CVE-2025-1010 (bmo#1936982)         Use-after-free in Custom Highlight
      * CVE-2025-1011 (bmo#1936454)         A bug in WebAssembly code generation could result in a crash
      * CVE-2025-1012 (bmo#1939710)         Use-after-free during concurrent delazification
      * CVE-2024-11704 (bmo#1899402)         Potential double-free vulnerability in PKCS#7 decryption         handling
      * CVE-2025-1013 (bmo#1932555)         Potential opening of private browsing tabs in normal browsing         windows
      * CVE-2025-1014 (bmo#1940804)         Certificate length was not properly checked
      * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,         bmo#1938469, bmo#1939583, bmo#1940994)         Memory safety bugs fixed in Firefox 135, Thunderbird 135,         Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,         and Thunderbird 128.7
      * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)         Memory safety bugs fixed in Firefox 135, Thunderbird 135,         Firefox ESR 128.7, and Thunderbird 128.7

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0405-1 advisory.

    Update to Mozilla Thunderbird 128.7 (MFSA 2025-10, bsc#1236539).

    Security fixes:

      - CVE-2025-1009: use-after-free in XSLT.
      - CVE-2025-1010: use-after-free in Custom Highlight.
      - CVE-2025-1011: a bug in WebAssembly code generation could result in a crash.
      - CVE-2025-1012: use-after-free during concurrent delazification.
      - CVE-2024-11704: potential double-free vulnerability in PKCS#7 decryption handling.
      - CVE-2025-1013: potential opening of private browsing tabs in normal browsing windows.
      - CVE-2025-1014: certificate length was not properly checked.
      - CVE-2025-1015: unsanitized address book fields.
      - CVE-2025-0510: address of e-mail sender can be spoofed by malicious email.
      - CVE-2025-1016: memory safety bugs.
      - CVE-2025-1017: memory safety bugs.

    Other fixes:

      - fixed: images inside links could zoom when clicked instead of opening the link.
      - fixed: compacting an empty folder failed with write error.
      - fixed: compacting of IMAP folder with corrupted local storage failed with write error.
      - fixed: after restart, all restored tabs with opened PDFs showed the same attachment.
      - fixed: exceptions during CalDAV item processing would halt subsequent item handling.
      - fixed: context menu was unable to move email address to a different field.
      - fixed: link at about:rights pointed to Firefox privacy policy instead of Thunderbird's.
      - fixed: POP3 'fetch headers only' and 'get selected messages' could delete messages.
      - fixed: 'Search Online' checkbox in saved search properties was incorrectly disabled.
      - fixed: POP3 status message showed incorrect download count when messages were deleted.
      - fixed: space bar did not always advance to the next unread message.
      - fixed: folder creation or renaming failed due to incorrect preference settings.
      - fixed: forwarding/editing S/MIME drafts/templates unusable due to regression (bsc#1236411).
      - fixed: sort order in 'Search Messages' panel reset after search or on first launch.
      - fixed: reply window added an unnecessary third blank line at the top.
      - fixed: Thunderbird spell check box did not allow ENTER to accept suggested changes.
      - fixed: long email subject lines could overlap window control buttons on macOS.
      - fixed: flathub manifest link was not correct.
      - fixed: 'Prefer client-side email scheduling' needed to be selected twice.
      - fixed: duplicate invitations were sent if CALDAV calendar email case did not match.
      - fixed: visual and UX improvements.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0374-1 advisory.

    * MFSA 2025-09
      * CVE-2025-1009 (bmo#1936613)         Use-after-free in XSLT
      * CVE-2025-1010 (bmo#1936982)         Use-after-free in Custom Highlight
      * CVE-2025-1011 (bmo#1936454)         A bug in WebAssembly code generation could result in a crash
      * CVE-2025-1012 (bmo#1939710)         Use-after-free during concurrent delazification
      * CVE-2024-11704 (bmo#1899402)         Potential double-free vulnerability in PKCS#7 decryption         handling
      * CVE-2025-1013 (bmo#1932555)         Potential opening of private browsing tabs in normal browsing         windows
      * CVE-2025-1014 (bmo#1940804)         Certificate length was not properly checked
      * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,         bmo#1938469, bmo#1939583, bmo#1940994)         Memory safety bugs fixed in Firefox 135, Thunderbird 135,         Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,         and Thunderbird 128.7
      * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)         Memory safety bugs fixed in Firefox 135, Thunderbird 135,         Firefox ESR 128.7, and Thunderbird 128.7

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4044 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4044-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     February 07, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : firefox-esr     Version        : 128.7.0esr-1~deb11u1     CVE ID         : CVE-2024-11704 CVE-2025-1009 CVE-2025-1010 CVE-2025-1011                      CVE-2025-1012 CVE-2025-1013 CVE-2025-1014 CVE-2025-1016                      CVE-2025-1017

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code.

    For Debian 11 bullseye, these problems have been fixed in version     128.7.0esr-1~deb11u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4045 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4045-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     February 07, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:128.7.0esr-1~deb11u1     CVE ID         : CVE-2024-11704 CVE-2025-1009 CVE-2025-1010 CVE-2025-1011                      CVE-2025-1012 CVE-2025-1013 CVE-2025-1014 CVE-2025-1016                      CVE-2025-1017

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For Debian 11 bullseye, these problems have been fixed in version     1:128.7.0esr-1~deb11u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5858 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5858-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 05, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : firefox-esr     CVE ID         : CVE-2024-11704 CVE-2025-1009 CVE-2025-1010 CVE-2025-1011                      CVE-2025-1012 CVE-2025-1013 CVE-2025-1014 CVE-2025-1016                      CVE-2025-1017

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code.

    For the stable distribution (bookworm), these problems have been fixed in     version 128.7.0esr-1~deb12u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of mozilla-firefox installed on the remote host is prior to 128.7.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-035-01 advisory.

    New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-firefox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-10 advisory.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6,     Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-1016)

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 128.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-10 advisory.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6,     Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-1016)

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 128.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-09 advisory.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6,     Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-1016)

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-09 advisory.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6,     Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-1016)

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202501-10 (Mozilla Firefox: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7134-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information across domains, or execute arbitrary code. (CVE-2024-11692, CVE-2024-11694,     CVE-2024-11695, CVE-2024-11696, CVE-2024-11697, CVE-2024-11699, CVE-2024-11701, CVE-2024-11704,     CVE-2024-11705, CVE-2024-11706, CVE-2024-11708)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-b266d38c44 advisory.

    Update NSS to 3.106.0     Update to Firefox 133.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-ea7b2e66a1 advisory.

    Update NSS to 3.106.0     Update to Firefox 133.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 133.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-63 advisory.

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

  - Malicious websites may have been able to perform user intent confirmation through tapjacking. This could     have led to users unknowingly approving the launch of external applications, potentially exposing them to     underlying vulnerabilities. (CVE-2024-11700)

  - An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. (CVE-2024-11692)

  - The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.
    This could have led to user confusion and possible spoofing attacks. (CVE-2024-11701)

  - Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have     inadvertently stored data in the cloud-based clipboard history if enabled. (CVE-2024-11702)

  - The executable file warning was not presented when downloading .library-ms files.   Note: This issue only     affected Windows operating systems. Other operating systems are unaffected. (CVE-2024-11693)

  - Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and     DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have     exposed users to malicious frames masquerading as legitimate content. (CVE-2024-11694)

  - A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the     page, resulting in a potential spoofing attack. (CVE-2024-11695)

  - On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN     authentication. (CVE-2024-11703)

  - The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on     signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have     caused runtime errors that disrupted the signature validation process. As a result, the enforcement of     signature validation for unrelated add-ons may have been bypassed.  Signature validation in this context     is used to ensure that third-party applications on the user's computer have not tampered with the user's     extensions, limiting the impact of this issue. (CVE-2024-11696)

  - When handling keypress events, an attacker may have been able to trick a user into bypassing the Open     Executable File? confirmation dialog. This could have led to malicious code execution. (CVE-2024-11697)

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in     fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit     fullscreen mode using standard actions like pressing Esc or accessing right-click menus, resulting in a     disrupted browsing experience until the browser is restarted.   This bug only affects the application when     running on macOS. Other operating systems are unaffected. (CVE-2024-11698)

  - <code>NSCDeriveKey</code> inadvertently assumed that the <code>phKey</code> parameter is always non-NULL.
    When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior     conflicted with the PKCS#11 v3.0 specification, which allows <code>phKey</code> to be NULL for certain     mechanisms. (CVE-2024-11705)

  - A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the     <code>SECASN1DecodeItemUtil</code> function, when handling malformed or improperly formatted input files.
    (CVE-2024-11706)

  - Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams     structure. (CVE-2024-11708)

  - Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2024-11699)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 133.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-63 advisory.

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

  - Malicious websites may have been able to perform user intent confirmation through tapjacking. This could     have led to users unknowingly approving the launch of external applications, potentially exposing them to     underlying vulnerabilities. (CVE-2024-11700)

  - An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. (CVE-2024-11692)

  - The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.
    This could have led to user confusion and possible spoofing attacks. (CVE-2024-11701)

  - Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have     inadvertently stored data in the cloud-based clipboard history if enabled. (CVE-2024-11702)

  - The executable file warning was not presented when downloading .library-ms files.   Note: This issue only     affected Windows operating systems. Other operating systems are unaffected. (CVE-2024-11693)

  - Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and     DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have     exposed users to malicious frames masquerading as legitimate content. (CVE-2024-11694)

  - A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the     page, resulting in a potential spoofing attack. (CVE-2024-11695)

  - On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN     authentication. (CVE-2024-11703)

  - The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on     signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have     caused runtime errors that disrupted the signature validation process. As a result, the enforcement of     signature validation for unrelated add-ons may have been bypassed.  Signature validation in this context     is used to ensure that third-party applications on the user's computer have not tampered with the user's     extensions, limiting the impact of this issue. (CVE-2024-11696)

  - When handling keypress events, an attacker may have been able to trick a user into bypassing the Open     Executable File? confirmation dialog. This could have led to malicious code execution. (CVE-2024-11697)

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in     fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit     fullscreen mode using standard actions like pressing Esc or accessing right-click menus, resulting in a     disrupted browsing experience until the browser is restarted.   This bug only affects the application when     running on macOS. Other operating systems are unaffected. (CVE-2024-11698)

  - <code>NSCDeriveKey</code> inadvertently assumed that the <code>phKey</code> parameter is always non-NULL.
    When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior     conflicted with the PKCS#11 v3.0 specification, which allows <code>phKey</code> to be NULL for certain     mechanisms. (CVE-2024-11705)

  - A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the     <code>SECASN1DecodeItemUtil</code> function, when handling malformed or improperly formatted input files.
    (CVE-2024-11706)

  - Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams     structure. (CVE-2024-11708)

  - Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2024-11699)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 133.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-67 advisory.

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

  - Malicious websites may have been able to perform user intent confirmation through tapjacking. This could     have led to users unknowingly approving the launch of external applications, potentially exposing them to     underlying vulnerabilities. (CVE-2024-11700)

  - An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. (CVE-2024-11692)

  - The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.
    This could have led to user confusion and possible spoofing attacks. (CVE-2024-11701)

  - Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have     inadvertently stored data in the cloud-based clipboard history if enabled. (CVE-2024-11702)

  - The executable file warning was not presented when downloading .library-ms files.   Note: This issue only     affected Windows operating systems. Other operating systems are unaffected. (CVE-2024-11693)

  - Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and     DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have     exposed users to malicious frames masquerading as legitimate content. (CVE-2024-11694)

  - A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the     page, resulting in a potential spoofing attack. (CVE-2024-11695)

  - The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on     signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have     caused runtime errors that disrupted the signature validation process. As a result, the enforcement of     signature validation for unrelated add-ons may have been bypassed.  Signature validation in this context     is used to ensure that third-party applications on the user's computer have not tampered with the user's     extensions, limiting the impact of this issue. (CVE-2024-11696)

  - When handling keypress events, an attacker may have been able to trick a user into bypassing the Open     Executable File? confirmation dialog. This could have led to malicious code execution. (CVE-2024-11697)

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in     fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit     fullscreen mode using standard actions like pressing Esc or accessing right-click menus, resulting in a     disrupted browsing experience until the browser is restarted.   This bug only affects the application when     running on macOS. Other operating systems are unaffected. (CVE-2024-11698)

  - <code>NSCDeriveKey</code> inadvertently assumed that the <code>phKey</code> parameter is always non-NULL.
    When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior     conflicted with the PKCS#11 v3.0 specification, which allows <code>phKey</code> to be NULL for certain     mechanisms. (CVE-2024-11705)

  - A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the     <code>SECASN1DecodeItemUtil</code> function, when handling malformed or improperly formatted input files.
    (CVE-2024-11706)

  - Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams     structure. (CVE-2024-11708)

  - Memory safety bugs present in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2024-11699)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 133.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-67 advisory.

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

  - Malicious websites may have been able to perform user intent confirmation through tapjacking. This could     have led to users unknowingly approving the launch of external applications, potentially exposing them to     underlying vulnerabilities. (CVE-2024-11700)

  - An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. (CVE-2024-11692)

  - The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.
    This could have led to user confusion and possible spoofing attacks. (CVE-2024-11701)

  - Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have     inadvertently stored data in the cloud-based clipboard history if enabled. (CVE-2024-11702)

  - The executable file warning was not presented when downloading .library-ms files.   Note: This issue only     affected Windows operating systems. Other operating systems are unaffected. (CVE-2024-11693)

  - Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and     DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have     exposed users to malicious frames masquerading as legitimate content. (CVE-2024-11694)

  - A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the     page, resulting in a potential spoofing attack. (CVE-2024-11695)

  - The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on     signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have     caused runtime errors that disrupted the signature validation process. As a result, the enforcement of     signature validation for unrelated add-ons may have been bypassed.  Signature validation in this context     is used to ensure that third-party applications on the user's computer have not tampered with the user's     extensions, limiting the impact of this issue. (CVE-2024-11696)

  - When handling keypress events, an attacker may have been able to trick a user into bypassing the Open     Executable File? confirmation dialog. This could have led to malicious code execution. (CVE-2024-11697)

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in     fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit     fullscreen mode using standard actions like pressing Esc or accessing right-click menus, resulting in a     disrupted browsing experience until the browser is restarted.   This bug only affects the application when     running on macOS. Other operating systems are unaffected. (CVE-2024-11698)

  - <code>NSCDeriveKey</code> inadvertently assumed that the <code>phKey</code> parameter is always non-NULL.
    When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior     conflicted with the PKCS#11 v3.0 specification, which allows <code>phKey</code> to be NULL for certain     mechanisms. (CVE-2024-11705)

  - A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the     <code>SECASN1DecodeItemUtil</code> function, when handling malformed or improperly formatted input files.
    (CVE-2024-11706)

  - Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams     structure. (CVE-2024-11708)

  - Memory safety bugs present in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2024-11699)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216207	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2025:0391-1)	Nessus	SuSE Local Security Checks	critical
216192	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2025:0405-1)	Nessus	SuSE Local Security Checks	critical
215182	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaFirefox (SUSE-SU-2025:0374-1)	Nessus	SuSE Local Security Checks	critical
215143	Debian dla-4044 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
215142	Debian dla-4045 : thunderbird - security update	Nessus	Debian Local Security Checks	critical
215021	Debian dsa-5858 : firefox-esr - security update	Nessus	Debian Local Security Checks	critical
214968	Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2025-035-01)	Nessus	Slackware Local Security Checks	critical
214963	Mozilla Thunderbird < 128.7	Nessus	MacOS X Local Security Checks	critical
214962	Mozilla Thunderbird < 128.7	Nessus	Windows	critical
214957	Mozilla Firefox ESR < 128.7	Nessus	Windows	critical
214956	Mozilla Firefox ESR < 128.7	Nessus	MacOS X Local Security Checks	critical
214554	GLSA-202501-10 : Mozilla Firefox: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
212017	Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-7134-1)	Nessus	Ubuntu Local Security Checks	critical
211970	Fedora 41 : firefox / nss (2024-b266d38c44)	Nessus	Fedora Local Security Checks	critical
211949	Fedora 40 : firefox / nss (2024-ea7b2e66a1)	Nessus	Fedora Local Security Checks	critical
211873	Mozilla Firefox < 133.0	Nessus	MacOS X Local Security Checks	critical
211872	Mozilla Firefox < 133.0	Nessus	Windows	critical
211869	Mozilla Thunderbird < 133.0	Nessus	MacOS X Local Security Checks	critical
211868	Mozilla Thunderbird < 133.0	Nessus	Windows	critical

Detections

Analytics

CVE-2024-11704

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical