The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0080-1 advisory.

    Update to Mozilla Thunderbird ESR 128.6 (MFSA 2025-05, bsc#1234991)

    Security fixes:

      - CVE-2025-0237 (bmo#1915257)         WebChannel APIs susceptible to confused deputy attack
      - CVE-2025-0238 (bmo#1915535)         Use-after-free when breaking lines in text
      - CVE-2025-0239 (bmo#1929156)         Alt-Svc ALPN validation failure when redirected
      - CVE-2025-0240 (bmo#1929623)         Compartment mismatch when parsing JavaScript JSON module
      - CVE-2025-0241 (bmo#1933023)         Memory corruption when using JavaScript Text Segmentation
      - CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,         bmo#1932169)         Memory safety bugs fixed in Firefox 134, Thunderbird 134,         Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,         and Thunderbird 128.6
      - CVE-2025-0243 (bmo#1827142, bmo#1932783)         Memory safety bugs fixed in Firefox 134, Thunderbird 134,         Firefox ESR 128.6, and Thunderbird 128.6

    Other fixes:

      - fixed: New mail notification was not hidden after reading the         new message (bmo#1920077)
      - fixed: New mail notification could show for the wrong folder,         causing repeated alerts (bmo#1926462)
      - fixed: macOS shortcut CMD+1 did not restore the main window         when it was minimized (bmo#1857953)
      - fixed: Clicking the context menu 'Reply' button resulted in         'Reply-All' (bmo#1935883)
      - fixed: Switching from 'All', 'Unread', and 'Threads with         unread' did not work (bmo#1921618)
      - fixed: Downloading message headers from a newsgroup could         cause a hang (bmo#1931661)
      - fixed: Message list performance slow when many updates         happened at once (bmo#1933104)
      - fixed: 'mailto:' links did not apply the compose format of         the current identity (bmo#550414)
      - fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did         not fall back to USERPASS (bmo#1928026)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2025:0080-1)

high Nessus Plugin ID 214049

Version 1.2

Version 1.1

Version 1.2 Jan 31, 2025, 9:25 AM CVSS metrics ("CVSSv3 score" set to 7.7) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L") CVSSv3 score source (set to "CVE-2025-0241") CVSSv3 severity (based on CVE-2025-0241, severity increased from "Medium" to "High") Plugin Feed: 202501310925
Version 1.1 Jan 14, 2025, 7:12 AM New Plugin Feed: 202501140712