An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:6683 advisory.

    * thunderbird: 115.15/128.2 ()
    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)
    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6681 advisory.

    * firefox: 115.15/128.2 ESR ()
    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
    * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)
    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:6684 advisory.

    * thunderbird: 115.15/128.2 ()
    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)
    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:6682 advisory.

    * firefox: 115.15/128.2 ESR ()
    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
    * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)
    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6892 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6891 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6838 advisory.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7-ELS Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6816 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-6684 advisory.

    [128.2.0-1.0.2]
    - Fix prefs for new nss [Orabug: 37079820]

    [128.2.0-1.0.1]
    - Add Oracle prefs file

    [128.2.0]
    - Add OpenELA debranding

    [128.2.0-1]
    - Update to 128.2.0

    [128.1.1-2]
    - Update to 128.1.1

    [128.0-1]
    - Update to 128.0 final

    [128.0b4-1]
    - Update to 128.0b4

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-6682 advisory.

    [128.2.0-1.0.2]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789]

    [128.2.0-1.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding OpenELA file

    [128.2.0]
    - Add debranding patches (Mustafa Gezen)
    - Add OpenELA default preferences (Louis Abel)

    [128.2.0-1]
    - Update to 128.2.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6681 advisory.

    [128.2.0-1.0.2]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773]

    [128.2.0-1.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [128.2.0]
    - Add debranding patches (Mustafa Gezen)
    - Add OpenELA default preferences (Louis Abel)

    [128.2.0-1]
    - Update to 128.2.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-6683 advisory.

    [128.2.0-1.0.2]
    - Fix prefs for new nss [Orabug: 37079813]

    [128.2.0-1.0.1]
    - Add Oracle prefs

    [128.2.0]
    - Add OpenELA debranding

    [128.2.0-1]
    - Update to 128.2.0

    [128.1.1-2]
    - Update to 128.1.1

    [128.0-1]
    - Update to 128.0 final

    [128.0b4-1]
    - Update to 128.0b4

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6722 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6719 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6721 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6723 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6720 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6684 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6682 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: 115.15/128.2 ESR ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6681 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: 115.15/128.2 ESR ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6683 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6684 advisory.

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6682 advisory.

    * firefox: 115.15/128.2 ESR ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7ade3c38-6d1f-11ef-ae11-b42e991fc52e advisory.

    security@mozilla.org reports:
    An error in the ECMA-262 specification relating to Async Generators             could have resulted in a type confusion, potentially leading to             memory corruption and an exploitable crash.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fc815ee65f advisory.

    - Updated to latest upstream (128.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f9e8f7d3a7 advisory.

    - Updated to latest upstream (128.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207536	AlmaLinux 9 : thunderbird (ALSA-2024:6683)	Nessus	Alma Linux Local Security Checks	critical
207535	AlmaLinux 9 : firefox (ALSA-2024:6681)	Nessus	Alma Linux Local Security Checks	critical
207530	AlmaLinux 8 : thunderbird (ALSA-2024:6684)	Nessus	Alma Linux Local Security Checks	critical
207527	AlmaLinux 8 : firefox (ALSA-2024:6682)	Nessus	Alma Linux Local Security Checks	critical
207476	RHEL 8 : firefox update (Important) (RHSA-2024:6892)	Nessus	Red Hat Local Security Checks	critical
207474	RHEL 8 : firefox update (Important) (RHSA-2024:6891)	Nessus	Red Hat Local Security Checks	critical
207446	RHEL 7 : firefox update (Important) (RHSA-2024:6838)	Nessus	Red Hat Local Security Checks	critical
207438	RHEL 8 : thunderbird (RHSA-2024:6816)	Nessus	Red Hat Local Security Checks	critical
207435	Oracle Linux 8 : thunderbird (ELSA-2024-6684)	Nessus	Oracle Linux Local Security Checks	critical
207434	Oracle Linux 8 : firefox (ELSA-2024-6682)	Nessus	Oracle Linux Local Security Checks	critical
207432	Oracle Linux 9 : firefox (ELSA-2024-6681)	Nessus	Oracle Linux Local Security Checks	critical
207431	Oracle Linux 9 : thunderbird (ELSA-2024-6683)	Nessus	Oracle Linux Local Security Checks	critical
207357	RHEL 9 : thunderbird (RHSA-2024:6722)	Nessus	Red Hat Local Security Checks	critical
207355	RHEL 8 : thunderbird (RHSA-2024:6719)	Nessus	Red Hat Local Security Checks	critical
207354	RHEL 8 : thunderbird (RHSA-2024:6721)	Nessus	Red Hat Local Security Checks	critical
207353	RHEL 8 : thunderbird (RHSA-2024:6723)	Nessus	Red Hat Local Security Checks	critical
207352	RHEL 9 : thunderbird (RHSA-2024:6720)	Nessus	Red Hat Local Security Checks	critical
207322	RHEL 8 : thunderbird (RHSA-2024:6684)	Nessus	Red Hat Local Security Checks	critical
207321	RHEL 8 : firefox (RHSA-2024:6682)	Nessus	Red Hat Local Security Checks	critical
207319	RHEL 9 : firefox (RHSA-2024:6681)	Nessus	Red Hat Local Security Checks	critical
207318	RHEL 9 : thunderbird (RHSA-2024:6683)	Nessus	Red Hat Local Security Checks	critical
207314	Rocky Linux 8 : thunderbird (RLSA-2024:6684)	Nessus	Rocky Linux Local Security Checks	critical
207303	Rocky Linux 8 : firefox (RLSA-2024:6682)	Nessus	Rocky Linux Local Security Checks	critical
206770	FreeBSD : firefox -- Potential memory corruption and exploitable crash (7ade3c38-6d1f-11ef-ae11-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	high
202162	Fedora 39 : firefox (2024-fc815ee65f)	Nessus	Fedora Local Security Checks	high
202047	Fedora 40 : firefox (2024-f9e8f7d3a7)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2024-7652

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high