The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2378 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.9.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405)

    * Mozilla: JavaScript Type confusion with NativeTypes (CVE-2020-12406)

    * Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 (CVE-2020-12410)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14389-1 advisory.

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox     ESR < 68.9. (CVE-2020-12405)

  - Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12406)

  - Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and     Firefox ESR < 68.9. (CVE-2020-12410)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
143075	RHEL 6 : firefox (RHSA-2020:2378)	Nessus	Red Hat Local Security Checks	11/19/2020	11/7/2024	high
147312	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0002)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	4/25/2023	critical
150602	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2020:14389-1)	Nessus	SuSE Local Security Checks	6/10/2021	12/26/2023	high

Detections

Analytics

Plugins Search

high

critical

high