The version of thunderbird installed on the remote host is prior to 128.9.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2840 advisory.

    JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-     free. This vulnerability affects Firefox < 137, Firefox ESR < 115.22, Firefox ESR < 128.9, Thunderbird <     137, and Thunderbird < 128.9. (CVE-2025-3028)

    A crafted URL containing specific Unicode characters could have hidden the true origin of the page,     resulting in a potential spoofing attack. This vulnerability affects Firefox < 137, Firefox ESR < 128.9,     Thunderbird < 137, and Thunderbird < 128.9. (CVE-2025-3029)

    Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. This vulnerability affects Firefox < 137, Firefox ESR <     128.9, Thunderbird < 137, and Thunderbird < 128.9. (CVE-2025-3030)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : thunderbird (ALAS-2025-2840)

high Nessus Plugin ID 235021

Version 1.2

Version 1.1

Version 1.2 Oct 30, 2025, 2:57 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202510301457
Version 1.1 May 1, 2025, 5:31 AM New Plugin Feed: 202505010531