In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7991-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute     arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This     vulnerability was fixed in Firefox 139 and Thunderbird 139. (CVE-2025-5270)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-34badbe9b9 advisory.

    - New upstream version (139.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a470ac63-3d7c-11f0-9a55-b42e991fc52e advisory.

    security@mozilla.org reports:
    In certain cases, SNI could have been sent unencrypted               even when encrypted DNS was enabled.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-45 advisory.

  - Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-5268)

  - A double-free could have occurred in `vpxcodecencinitmulti` after a failed allocation when initializing     the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash.
    (CVE-2025-5283)

  - Error handling for script execution was incorrectly isolated from web content, which could have allowed     cross-origin leak attacks. (CVE-2025-5263)

  - Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    (CVE-2025-5264)

  - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker     could trick a user into using this command, potentially leading to local code execution on the user's     system. This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.
    (CVE-2025-5265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-45 advisory.

  - Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-5268)

  - A double-free could have occurred in `vpxcodecencinitmulti` after a failed allocation when initializing     the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash.
    (CVE-2025-5283)

  - Error handling for script execution was incorrectly isolated from web content, which could have allowed     cross-origin leak attacks. (CVE-2025-5263)

  - Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    (CVE-2025-5264)

  - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker     could trick a user into using this command, potentially leading to local code execution on the user's     system. This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.
    (CVE-2025-5265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-42 advisory.

  - Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-5268)

  - A double-free could have occurred in `vpxcodecencinitmulti` after a failed allocation when initializing     the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash.
    (CVE-2025-5283)

  - Error handling for script execution was incorrectly isolated from web content, which could have allowed     cross-origin leak attacks. (CVE-2025-5263)

  - Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    (CVE-2025-5264)

  - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker     could trick a user into using this command, potentially leading to local code execution on the user's     system. This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.
    (CVE-2025-5265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-42 advisory.

  - Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-5268)

  - A double-free could have occurred in `vpxcodecencinitmulti` after a failed allocation when initializing     the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash.
    (CVE-2025-5283)

  - Error handling for script execution was incorrectly isolated from web content, which could have allowed     cross-origin leak attacks. (CVE-2025-5263)

  - Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could     trick a user into using this command, potentially leading to local code execution on the user's system.
    (CVE-2025-5264)

  - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker     could trick a user into using this command, potentially leading to local code execution on the user's     system. This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.
    (CVE-2025-5265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
297659	Ubuntu 22.04 LTS : Thunderbird vulnerabilities (USN-7991-1)	Nessus	Ubuntu Local Security Checks	Local	medium
247103	Linux Distros Unpatched Vulnerability : CVE-2025-5270	Nessus	Misc.	Local	high
238073	Fedora 42 : firefox (2025-34badbe9b9)	Nessus	Fedora Local Security Checks	Local	high
237615	FreeBSD : Firefox -- unencrypted SNI (a470ac63-3d7c-11f0-9a55-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	Local	high
237386	Mozilla Thunderbird < 139.0	Nessus	MacOS X Local Security Checks	Local	high
237385	Mozilla Thunderbird < 139.0	Nessus	Windows	Local	high
237299	Mozilla Firefox < 139.0	Nessus	MacOS X Local Security Checks	Local	high
237298	Mozilla Firefox < 139.0	Nessus	Windows	Local	high

Detections

Analytics

CVE-2025-5270

high

Tenable Plugins

medium

high

high

high

high

high

high

high