The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0823 advisory.

  - Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP (CVE-2023-0616)

  - Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)

  - Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)

  - Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)

  - Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)

  - Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)

  - Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)

  - Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)

  - Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

  - Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)

  - Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)

  - Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 9 : thunderbird (RHSA-2023:0823)

high Nessus Plugin ID 171655

Version 1.6

Version 1.5

Version 1.4

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.6 Apr 28, 2024, 2:25 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202404281425
Version 1.5 Jan 26, 2024, 11:18 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401262318
Version 1.4 Aug 2, 2023, 8:10 PM CVSS metrics ("CVSSv2 score" changed from 7.6 to 10.0. "CVSSv3 score" changed from 7.5 to 8.8. "CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H". "CVSSv2 vector" changed from "CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv3 score source (set to "CVE-2023-25746") Plugin Feed: 202308022010
Version 1.4 Jan 26, 2024, 9:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401262100
Version 1.3 May 24, 2023, 8:43 PM Logic Changes (Added support for ppc64le architecture) Plugin Feed: 202305242043
Version 1.2 Mar 17, 2023, 2:09 PM IAVM reference Plugin Feed: 202303171409
Version 1.1 Feb 24, 2023, 4:10 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202302241610
Version 1.0 Feb 21, 2023, 1:55 AM New Plugin Feed: 202302210155