The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2050 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 68.8.0.

    Security Fix(es):

    * Mozilla: Use-after-free during worker shutdown (CVE-2020-12387)

    * Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395)

    * usrsctp: Buffer overflow in AUTH chunk input validation (CVE-2020-6831)

    * Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392)

    * Mozilla: Sender Email Address Spoofing using encoded Unicode characters (CVE-2020-12397)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaThunderbird fixes the following issues :

  - Update to 68.8.0 ESR MFSA 2020-18 (bsc#1171186)

  - CVE-2020-12397 (bmo#1617370) Sender Email Address     Spoofing using encoded Unicode characters

  - CVE-2020-12387 (bmo#1545345) Use-after-free during     worker shutdown

  - CVE-2020-6831 (bmo#1632241) Buffer overflow in SCTP     chunk input validation

  - CVE-2020-12392 (bmo#1614468) Arbitrary local file access     with 'Copy as cURL'

  - CVE-2020-12393 (bmo#1615471) Devtools' 'Copy as cURL'     feature did not fully escape website-controlled data,     potentially leading to command injection

  - CVE-2020-12395 (bmo#1595886, bmo#1611482, bmo#1614704,     bmo#1624098, bmo#1625749, bmo#1626382, bmo#1628076,     bmo#1631508) Memory safety bugs fixed in Thunderbird     68.8.0

This update was imported from the SUSE:SLE-15:Update update project.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2064 advisory.

  - Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6464)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or information disclosure.

For Debian 8 'Jessie', these problems have been fixed in version 68.8.0esr-1~deb8u1.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2050 advisory.

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,     and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. This vulnerability     affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender     email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0. (CVE-2020-12397)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2036 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.8.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free during worker shutdown (CVE-2020-12387)

    * Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395)

    * Mozilla: Buffer overflow in SCTP chunk input validation (CVE-2020-6831)

    * Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:2046 advisory.

  - Mozilla: Use-after-free during worker shutdown (CVE-2020-12387)

  - Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392)

  - Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395)

  - Mozilla: Sender Email Address Spoofing using encoded Unicode characters (CVE-2020-12397)

  - usrsctp: Buffer overflow in AUTH chunk input validation (CVE-2020-6831)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2032 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.8.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free during worker shutdown (CVE-2020-12387)

    * Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395)

    * Mozilla: Buffer overflow in SCTP chunk input validation (CVE-2020-6831)

    * Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

Update to version 68.8.0 ESR (bsc#1171186) :

CVE-2020-12387: Use-after-free during worker shutdown

CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens

CVE-2020-12389: Sandbox escape with improperly separated process types

CVE-2020-6831: Buffer overflow in SCTP chunk input validation

CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'

CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4353-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, bypass security     restrictions, spoof the URL bar, or execute arbitrary code. (CVE-2020-6831, CVE-2020-12387,     CVE-2020-12390, CVE-2020-12391, CVE-2020-12394, CVE-2020-12395, CVE-2020-12396)

    It was discovered that the Devtools Copy as cURL feature did not properly escape the HTTP POST     data of a request. If a user were tricked in to using the Copy as cURL feature to copy and paste a     command with specially crafted data in to a terminal, an attacker could potentially exploit this to obtain     sensitive information from local files. (CVE-2020-12392)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for opera fixes the following issues :

Opera was updated to version 68.0.3618.104

  - CHR-7909 Update chromium on desktop-stable-81-3618 to     81.0.4044.138

  - CVE-2020-6831, CVE-2020-6464

  - DNA-85609 [Mac] Tabs shrinking & disappearing

  - DNA-85629 Crash at     opera::DownloadButtonPanel::ShouldShowCancelButton()

  - DNA-85669 Add mocking of AddressDropdownModel in     AddressBarControllerTest

  - DNA-85678 Wrong badge icon on pages with mixed content     on desktop-stable-81-3618

  - DNA-85820 Flags are blue in default [D] state after     restart

  - DNA-85822 Full screen snap on pkobp.pl

  - DNA-86077 Problem to upload .JPG file as an wallpaper

  - DNA-86165 Downloads list doesn&rsquo;t returns to its     original state after clearing search filter

  - DNA-86236 [Mac] Plus button click area too small

  - DNA-86241 X tab button is not visible

  - DNA-86217 Fix performance issue with Background Worker

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2031 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.8.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free during worker shutdown (CVE-2020-12387)

    * Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395)

    * Mozilla: Buffer overflow in SCTP chunk input validation (CVE-2020-6831)

    * Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2037 advisory.

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,     and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. This vulnerability     affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in Thunderbird which could result in spoofing the displayed sender email address, denial of service or potentially the execution of arbitrary code.

ID	Name	Product	Family	Published	Updated	Severity
136475	RHEL 7 : thunderbird (RHSA-2020:2050)	Nessus	Red Hat Local Security Checks	5/11/2020	11/7/2024	critical
136461	openSUSE Security Update : MozillaThunderbird (openSUSE-2020-643)	Nessus	SuSE Local Security Checks	5/11/2020	3/13/2024	critical
208496	CentOS 6 : chromium-browser (RHSA-2020:2064)	Nessus	CentOS Local Security Checks	10/9/2024	10/9/2024	critical
136427	Debian DLA-2205-1 : firefox-esr security update	Nessus	Debian Local Security Checks	5/11/2020	3/13/2024	critical
136776	CentOS 7 : thunderbird (RHSA-2020:2050)	Nessus	CentOS Local Security Checks	5/22/2020	10/9/2024	critical
136354	RHEL 6 : firefox (RHSA-2020:2036)	Nessus	Red Hat Local Security Checks	5/6/2020	11/7/2024	critical
145906	CentOS 8 : thunderbird (CESA-2020:2046)	Nessus	CentOS Local Security Checks	2/1/2021	1/24/2024	critical
136343	RHEL 8 : firefox (RHSA-2020:2032)	Nessus	Red Hat Local Security Checks	5/6/2020	11/7/2024	critical
136654	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:1218-1)	Nessus	SuSE Local Security Checks	5/15/2020	3/12/2024	critical
136420	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4353-1)	Nessus	Ubuntu Local Security Checks	5/8/2020	8/27/2024	critical
136888	openSUSE Security Update : opera (openSUSE-2020-709)	Nessus	SuSE Local Security Checks	5/26/2020	8/14/2020	critical
136342	RHEL 8 : firefox (RHSA-2020:2031)	Nessus	Red Hat Local Security Checks	5/6/2020	11/7/2024	critical
136773	CentOS 7 : firefox (RHSA-2020:2037)	Nessus	CentOS Local Security Checks	5/22/2020	10/9/2024	critical
136431	Debian DSA-4683-1 : thunderbird - security update	Nessus	Debian Local Security Checks	5/11/2020	3/13/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical