The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:7700 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: 115.16/128.3 ESR ()

    * firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service     (CVE-2024-9399)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and Thunderbird 131 (CVE-2024-9403)

    * firefox: thunderbird: Potential directory upload bypass via clickjacking (CVE-2024-9397)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3,     Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9401)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and     Thunderbird 128.3 (CVE-2024-9402)

    * firefox: thunderbird: External protocol handlers could be enumerated via popups (CVE-2024-9398)

    * firefox: thunderbird: Potential memory corruption during JIT compilation (CVE-2024-9400)

    * firefox: thunderbird: Potential memory corruption may occur when cloning certain objects (CVE-2024-9396)

    * firefox: thunderbird: Cross-origin access to PDF contents through multipart responses (CVE-2024-9393)

    * firefox: thunderbird: Cross-origin access to JSON contents through multipart responses (CVE-2024-9394)

    * firefox: thunderbird: Compromised content process can bypass site isolation (CVE-2024-9392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:7700 advisory.

    * firefox: 115.16/128.3 ESR ()
    * firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service     (CVE-2024-9399)
    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and Thunderbird 131 (CVE-2024-9403)
    * firefox: thunderbird: Potential directory upload bypass via clickjacking (CVE-2024-9397)
    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3,     Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9401)
    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and     Thunderbird 128.3 (CVE-2024-9402)
    * firefox: thunderbird: External protocol handlers could be enumerated via popups (CVE-2024-9398)
    * firefox: thunderbird: Potential memory corruption during JIT compilation (CVE-2024-9400)
    * firefox: thunderbird: Potential memory corruption may occur when cloning certain objects (CVE-2024-9396)
    * firefox: thunderbird: Cross-origin access to PDF contents through multipart responses (CVE-2024-9393)
    * firefox: thunderbird: Cross-origin access to JSON contents through multipart responses (CVE-2024-9394)
    * firefox: thunderbird: Compromised content process can bypass site isolation (CVE-2024-9392)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3629-1 advisory.

    Update to Mozilla Thunderbird 128.3.1 (MFSA 2024-51, bsc#1231413):

    - CVE-2024-9680: Use-after-free in Animation timeline

    Update to Mozilla Thunderbird 128.3 (MFSA 2024-49, bsc#1230979):

    - CVE-2024-9392: Compromised content process can bypass site isolation
    - CVE-2024-9393: Cross-origin access to PDF contents through multipart responses
    - CVE-2024-9394: Cross-origin access to JSON contents through multipart responses
    - CVE-2024-8900: Clipboard write permission bypass
    - CVE-2024-9396: Potential memory corruption may occur when cloning certain objects
    - CVE-2024-9397: Potential directory upload bypass via clickjacking
    - CVE-2024-9398: External protocol handlers could be enumerated via popups
    - CVE-2024-9399: Specially crafted WebTransport requests could lead to denial of service
    - CVE-2024-9400: Potential memory corruption during JIT compilation
    - CVE-2024-9401: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3,     Thunderbird 131, and Thunderbird 128.3
    - CVE-2024-9402: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and     Thunderbird 128.3

    Other fixes:

    - fixed: Opening an EML file with a 'mailto:' link did not work
    - fixed: Collapsed POP3 account folder was expanded after emptying trash on exit
    - fixed: 'Mark Folder Read' on a cross-folder search marked all underlying folders read
    - fixed: Unable to open/view attached OpenPGP encrypted messages
    - fixed: Unable to 'Decrypt and Open' an attached OpenPGP key file
    - fixed: Subject could disappear when replying to a message saved in an EML file
    - fixed: OAuth2 authentication method was not available when adding SMTP server
    - fixed: Unable to subscribe to .ics calendars in some situations
    - fixed: Visual and UX improvements

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:8169 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.16/128.3 ()

    * firefox: thunderbird: Specially crafted WebTransport requests could lead     to denial of service (CVE-2024-9399)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and     Thunderbird 131 (CVE-2024-9403)

    * firefox: thunderbird: Potential directory upload bypass via clickjacking     (CVE-2024-9397)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox     ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3     (CVE-2024-9401)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox     ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9402)

    * firefox: thunderbird: External protocol handlers could be enumerated via     popups (CVE-2024-9398)

    * firefox: thunderbird: Potential memory corruption during JIT compilation     (CVE-2024-9400)

    * firefox: thunderbird: Potential memory corruption may occur when cloning     certain objects (CVE-2024-9396)

    * firefox: thunderbird: Cross-origin access to PDF contents through     multipart responses (CVE-2024-9393)

    * firefox: thunderbird: Cross-origin access to JSON contents through     multipart responses (CVE-2024-9394)

    * firefox: thunderbird: Compromised content process can bypass site     isolation (CVE-2024-9392)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3913 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3913-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     October 08, 2024                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : firefox-esr     Version        : 128.3.0esr-1~deb11u2     CVE ID         : CVE-2024-9392 CVE-2024-9393 CVE-2024-9394 CVE-2024-9401

    Multiple security issues have been found in the Mozilla Firefox     web browser, which could potentially result in the execution     of arbitrary code.

    Debian follows the extended support releases (ESR) of Firefox.
    Starting with this update we're now following the 128.x releases.

    Between 115.x and 128.x, Firefox has seen a number of feature     updates. For more information please refer to     https://www.mozilla.org/en-US/firefox/128.0esr/releasenotes/

    For Debian 11 bullseye, these problems have been fixed in version     128.3.0esr-1~deb11u2.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
208242	RHEL 8 : firefox (RHSA-2024:7700)	Nessus	Red Hat Local Security Checks	10/7/2024	11/5/2024	high
208429	AlmaLinux 8 : firefox (ALSA-2024:7700)	Nessus	Alma Linux Local Security Checks	10/9/2024	10/14/2024	high
209081	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2024:3629-1)	Nessus	SuSE Local Security Checks	10/16/2024	10/17/2024	critical
209113	RHEL 8 : thunderbird (RHSA-2024:8169)	Nessus	Red Hat Local Security Checks	10/16/2024	10/16/2024	high
208270	Debian dla-3913 : firefox-esr - security update	Nessus	Debian Local Security Checks	10/8/2024	2/17/2025	high

Detections

Analytics

Plugins Search

high

high

critical

high

high