In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability affects Firefox < 139 and Thunderbird < 139.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-34badbe9b9 advisory.

    - New upstream version (139.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a470ac63-3d7c-11f0-9a55-b42e991fc52e advisory.

    security@mozilla.org reports:
    In certain cases, SNI could have been sent unencrypted               even when encrypted DNS was enabled.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-45 advisory.

  - In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.
    (CVE-2025-5270)

  - A double-free could have occurred in `vpxcodecencinitmulti` after a failed allocation when initializing     the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash.
    (CVE-2025-5262)

  - Error handling for script execution was incorrectly isolated from web content, which could have allowed     cross-origin leak attacks. (CVE-2025-5263)

  - Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    (CVE-2025-5264)

  - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    This bug only affects Firefox for Windows. Other versions of Firefox are unaffected. (CVE-2025-5265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-45 advisory.

  - In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.
    (CVE-2025-5270)

  - A double-free could have occurred in `vpxcodecencinitmulti` after a failed allocation when initializing     the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash.
    (CVE-2025-5262)

  - Error handling for script execution was incorrectly isolated from web content, which could have allowed     cross-origin leak attacks. (CVE-2025-5263)

  - Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    (CVE-2025-5264)

  - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    This bug only affects Firefox for Windows. Other versions of Firefox are unaffected. (CVE-2025-5265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-42 advisory.

  - In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.
    (CVE-2025-5270)

  - A double-free could have occurred in `vpxcodecencinitmulti` after a failed allocation when initializing     the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash.
    (CVE-2025-5283)

  - Error handling for script execution was incorrectly isolated from web content, which could have allowed     cross-origin leak attacks. (CVE-2025-5263)

  - Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    (CVE-2025-5264)

  - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    This bug only affects Firefox for Windows. Other versions of Firefox are unaffected. (CVE-2025-5265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-42 advisory.

  - In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.
    (CVE-2025-5270)

  - A double-free could have occurred in `vpxcodecencinitmulti` after a failed allocation when initializing     the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash.
    (CVE-2025-5283)

  - Error handling for script execution was incorrectly isolated from web content, which could have allowed     cross-origin leak attacks. (CVE-2025-5263)

  - Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    (CVE-2025-5264)

  - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    This bug only affects Firefox for Windows. Other versions of Firefox are unaffected. (CVE-2025-5265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238073	Fedora 42 : firefox (2025-34badbe9b9)	Nessus	Fedora Local Security Checks	high
237615	FreeBSD : Firefox -- unencrypted SNI (a470ac63-3d7c-11f0-9a55-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	high
237386	Mozilla Thunderbird < 139.0	Nessus	MacOS X Local Security Checks	high
237385	Mozilla Thunderbird < 139.0	Nessus	Windows	high
237299	Mozilla Firefox < 139.0	Nessus	MacOS X Local Security Checks	high
237298	Mozilla Firefox < 139.0	Nessus	Windows	high

Detections

Analytics

CVE-2025-5270

high

Tenable Plugins

high

high

high

high

high

high