The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3899-1 advisory.

    Firefox Extended Support Release 128.4.0 ESR (bsc#1231879):

    - CVE-2024-10458: Permission leak via embed or object elements
    - CVE-2024-10459: Use-after-free in layout with accessibility
    - CVE-2024-10460: Confusing display of origin for external protocol handler prompt
    - CVE-2024-10461: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response
    - CVE-2024-10462: Origin of permission prompt could be spoofed by long URL
    - CVE-2024-10463: Cross origin video frame leak
    - CVE-2024-10464: History interface could have been used to cause a Denial of Service condition in the     browser
    - CVE-2024-10465: Clipboard 'paste' button persisted across tabs
    - CVE-2024-10466: DOM push subscription message could hang Firefox
    - CVE-2024-10467: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and     Thunderbird 128.4

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2024:3899-1)

high Nessus Plugin ID 210291

Version 1.1