The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-444:04 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and     portability.
    Security issues fixed with this release:
    CVE-2011-0083     Use-after-free vulnerability in the nsSVGPathSegList::ReplaceItem function in the implementation of SVG     element lists in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14     allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary     code via vectors involving a user-supplied callback.
    CVE-2011-0085     Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox before 3.6.18,     Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code     via a crafted XUL document that dequeues the current command updater.
    CVE-2011-2362     Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish     between cookies for two domain names that differ only in a trailing dot, which allows remote web servers     to bypass the Same Origin Policy via Set-Cookie headers.
    CVE-2011-2363     Use-after-free vulnerability in the nsSVGPointList::AppendElement function in the implementation of SVG     element lists in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14     allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary     code via vectors involving a user-supplied callback.
    CVE-2011-2364     Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird     before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than     CVE-2011-2365.
    CVE-2011-2365     Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird     before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than     CVE-2011-2364.
    CVE-2011-2371     Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1,     Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code     via vectors involving a long JavaScript Array object.
    CVE-2011-2373     Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before     3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute     arbitrary code via a crafted XUL document.
    CVE-2011-2374     Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and 4.x     through 4.0.1, and Thunderbird before 3.1.11, allow remote attackers to cause a denial of service (memory     corruption and application crash) or possibly execute arbitrary code via unknown vectors.
    CVE-2011-2375     Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 5.0 and Thunderbird     through 3.1.11 allow remote attackers to cause a denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unknown vectors.
    CVE-2011-2376     Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and     Thunderbird before 3.1.11 allow remote attackers to cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code via unknown vectors.
    CVE-2011-2377     Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through     2.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or     possibly execute arbitrary code via a multipart/x-mixed-replace image.
    CVE-2011-2605     CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in     netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird     before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a n     (newline) character, which is not properly handled in a JavaScript document.cookie = expression, a     different vulnerability than CVE-2011-2374.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MiracleLinux 4 : firefox-3.6.22-1.0.1.AXS4, xulrunner-1.9.2.22-1.0.1.AXS4 (AXSA:2011-444:04)

high Nessus Plugin ID 283988

Version 1.2

Version 1.1

Version 1.2 Feb 12, 2026, 3:03 PM Exploit attributes ("Exploit framework metasploit" set to "True") Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202602121503
Version 1.1 Jan 14, 2026, 9:57 PM New Plugin Feed: 202601142157