The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-29 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 77.0.3865.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_09_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability exists in Microsoft Excel due to improper disclosure of contents in memory.
    An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to     obtain information for further compromise the system. (CVE-2019-1263)

  - A remote code execution vulnerability exists in Microsoft Excel due to improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute     arbitrary commands. (CVE-2019-1297)

The version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 32.0.0.238. It is therefore affected by multiple arbitrary code execution vulnerabilities.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-27 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-26 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 69.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-25 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 76.0.3809.132.  It is, therefore, affected by use-after-free in Blink as referenced in the 2019_08_stable-channel-update-for-desktop_26 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS   6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL   VPN web portal allows attacker to execute unauthorized malicious   script code via the error or message handling parameters.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 12.1.2 It is, therefore, affected by multiple vulnerabilities in the following components :

  - Safari
  - WebKit

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-24 advisory. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 68.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-24 advisory. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Jamf, enterprise management software for the Apple platform, is installed on the remote macOS / Mac OS X host.

NOTE: Detection only works for the scanning user. The plugin needs to be run for each user suspected of having the install.

The version of Adobe Reader installed on the remote macOS host is a version prior or equal to 2015.006.30497, 2017.011.30142, or 2019.012.20034. It is, therefore, affected by multiple vulnerabilities.

  - Out-of-Bounds Read potentially leading to Information     Disclosure (CVE-2019-8077, CVE-2019-8094, CVE-2019-8095,     CVE-2019-8096, CVE-2019-8102, CVE-2019-8103,     CVE-2019-8104, CVE-2019-8105, CVE-2019-8106,     CVE-2019-8002, CVE-2019-8004, CVE-2019-8005,     CVE-2019-8007, CVE-2019-8010, CVE-2019-8011,     CVE-2019-8012, CVE-2019-8018, CVE-2019-8020,     CVE-2019-8021, CVE-2019-8032, CVE-2019-8035,     CVE-2019-8037, CVE-2019-8040, CVE-2019-8043,     CVE-2019-8052)

  - Out-of-Bounds Write potentially leading to Arbitrary     Code Execution (CVE-2019-8098, CVE-2019-8100, CVE-2019-7965,     CVE-2019-8008, CVE-2019-8009, CVE-2019-8016,     CVE-2019-8022, CVE-2019-8023, CVE-2019-8027)

  - Type Confusion potentially leading to Arbitrary Code     Execution (CVE-2019-8019)

  - Use After Free potentially leading to Arbitrary Code     Execution (CVE-2019-8003, CVE-2019-8013, CVE-2019-8024,     CVE-2019-8025, CVE-2019-8026, CVE-2019-8028,     CVE-2019-8029, CVE-2019-8030, CVE-2019-8031,     CVE-2019-8033, CVE-2019-8034, CVE-2019-8036,     CVE-2019-8038, CVE-2019-8039, CVE-2019-8047,     CVE-2019-8051, CVE-2019-8053, CVE-2019-8054,     CVE-2019-8055, CVE-2019-8056, CVE-2019-8057,     CVE-2019-8058, CVE-2019-8059, CVE-2019-8061)   
  - Command injection potentially leading to Arbitrary Command     Execution (CVE-2019-8060)

  - Heap Overflow potentially leading to Arbitrary Code     Execution (CVE-2019-7832, CVE-2019-8014, CVE-2019-8015,     CVE-2019-8041, CVE-2019-8042, CVE-2019-8046,     CVE-2019-8049, CVE-2019-8050)

  - Buffer Error potentially leading to Arbitrary Code     Execution (CVE-2019-8048)

  - Double Free potentially leading to Arbitrary Code     Execution (CVE-2019-8044)

  - Integer Overflow potentially leading to Arbitrary Code     Execution or Denial of Service (CVE-2019-8099, CVE-2019-8101)

  - Internal IP Disclosure potentially leading to Information     Disclosure (CVE-2019-8097)

  - Type Confusion potentially leading to Arbitrary Code     Execution (CVE-2019-8019)

  - Untrusted Pointer Dereference potentially leading to     Arbitrary Code Execution or Denial of Service (CVE-2019-8006, CVE-2019-8017, CVE-2019-8045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote macOS host is a version prior or equal to 2015.006.30497, 2017.011.30142, or 2019.012.20034. It is, therefore, affected by multiple vulnerabilities.

  - Out-of-Bounds Read potentially leading to Information     Disclosure (CVE-2019-8077, CVE-2019-8094, CVE-2019-8095,     CVE-2019-8096, CVE-2019-8102, CVE-2019-8103,     CVE-2019-8104, CVE-2019-8105, CVE-2019-8106,     CVE-2019-8002, CVE-2019-8004, CVE-2019-8005,     CVE-2019-8007, CVE-2019-8010, CVE-2019-8011,     CVE-2019-8012, CVE-2019-8018, CVE-2019-8020,     CVE-2019-8021, CVE-2019-8032, CVE-2019-8035,     CVE-2019-8037, CVE-2019-8040, CVE-2019-8043,     CVE-2019-8052)

  - Out-of-Bounds Write potentially leading to Arbitrary     Code Execution (CVE-2019-8098, CVE-2019-8100, CVE-2019-7965,     CVE-2019-8008, CVE-2019-8009, CVE-2019-8016,     CVE-2019-8022, CVE-2019-8023, CVE-2019-8027)

  - Type Confusion potentially leading to Arbitrary Code     Execution (CVE-2019-8019)

  - Use After Free potentially leading to Arbitrary Code     Execution (CVE-2019-8003, CVE-2019-8013, CVE-2019-8024,     CVE-2019-8025, CVE-2019-8026, CVE-2019-8028,     CVE-2019-8029, CVE-2019-8030, CVE-2019-8031,     CVE-2019-8033, CVE-2019-8034, CVE-2019-8036,     CVE-2019-8038, CVE-2019-8039, CVE-2019-8047,     CVE-2019-8051, CVE-2019-8053, CVE-2019-8054,     CVE-2019-8055, CVE-2019-8056, CVE-2019-8057,     CVE-2019-8058, CVE-2019-8059, CVE-2019-8061)   
  - Command injection potentially leading to Arbitrary Command     Execution (CVE-2019-8060)

  - Heap Overflow potentially leading to Arbitrary Code     Execution (CVE-2019-7832, CVE-2019-8014, CVE-2019-8015,     CVE-2019-8041, CVE-2019-8042, CVE-2019-8046,     CVE-2019-8049, CVE-2019-8050)

  - Buffer Error potentially leading to Arbitrary Code     Execution (CVE-2019-8048)

  - Double Free potentially leading to Arbitrary Code     Execution (CVE-2019-8044)

  - Integer Overflow potentially leading to Arbitrary Code     Execution or Denial of Service (CVE-2019-8099, CVE-2019-8101)

  - Internal IP Disclosure potentially leading to Information     Disclosure (CVE-2019-8097)

  - Type Confusion potentially leading to Arbitrary Code     Execution (CVE-2019-8019)

  - Untrusted Pointer Dereference potentially leading to     Arbitrary Code Execution or Denial of Service (CVE-2019-8006, CVE-2019-8017, CVE-2019-8045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Photoshop CC installed on the remote macOS or Mac OS X host is equal or prior to 19.1.8 (2018.1.8), 20.0.5 (2019.0.5). It is, therefore, affected by the vulnerabilities as referenced in the apsb19-15 advisory.

  - An heap-overflow flaw exists that allows remote attackers     to execute arbitrary commands via unspecified means.
    (CVE-2019-7978, CVE-2019-7980, CVE-2019-7985,     CVE-2019-7990, CVE-2019-7993)

  - A type-confusion flaw exists that allows remote attackers     to execute arbitrary commands via unspecified means.
    (CVE-2019-7969, CVE-2019-7970, CVE-2019-7971,     CVE-2019-7972, CVE-2019-7973, CVE-2019-7974,     CVE-2019-7975)

  - An out-of-bounds read flaw exists that allows remote attackers     to execute arbitrary commands via unspecified means.
    (CVE-2019-7977, CVE-2019-7981, CVE-2019-7987,     CVE-2019-7991, CVE-2019-7992, CVE-2019-7995,     CVE-2019-7996, CVE-2019-7997, CVE-2019-7998,     CVE-2019-7999, CVE-2019-8000, CVE-2019-8001)

  - A command injection flaw exists that allows remote attackers     to execute arbitrary commands via unspecified means.
    (CVE-2019-7968, CVE-2019-7989)

  - An out-of-bounds write flaw exists that allows remote attackers     to execute arbitrary commands via unspecified means.
    (CVE-2019-7976, CVE-2019-7979, CVE-2019-7982,     CVE-2019-7983, CVE-2019-7984, CVE-2019-7986,     CVE-2019-7988, CVE-2019-7994)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Creative Cloud installed on the remote Mac OS X host is equal or prior to 4.6.1.393. It is, therefore, affected by multiple vulnerabilities. The most critical of which allows an attacker to perform arbitrary code execution in the context of the current user.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists in Microsoft Word due to improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute     arbitrary commands in the security context of the current user. (CVE-2019-1201, CVE-2019-1205)

  - An information disclosure vulnerability exists in Microsoft Windows Graphics due to improper handling of objects in     memory. An authenticated, local attacker can exploit this, by running a specially crafted application to obtain     information for further compromise of the system. (CVE-2019-1148, CVE-2019-1153)

  - A remote code execution vulnerability exists in Windows font library due to improper handling of embedded fonts. An     unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or     open a specially crafted file, to execute arbitrary commands. (CVE-2019-1149, CVE-2019-1151)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.0.x prior to 10.1.6 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities.  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 76.0.3809.100. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_08_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having   non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with   invalid display names, which, when added to conversations, remain invisible. This security update addresses the   issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names   correctly in Microsoft Outlook clients. (CVE-2019-1084)

  - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly    handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in   the context of the current user. If the current user is logged on with administrative user rights, an attacker   could take control of the affected system. An attacker could then install programs; view, change, or delete data;
  or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on   the system could be less impacted than users who operate with administrative user rights. Exploitation of the   vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Excel.
  In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file   to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a   website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially   crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the   website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement   in an email or instant message, and then convince them to open the specially crafted file. The security update   addresses the vulnerability by correcting how Microsoft Excel handles objects in memory.
  (CVE-2019-1110, CVE-2019-1111)

The version of Google Chrome installed on the remote macOS host is prior to 76.0.3809.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_07_stable-channel-update-for-desktop_30 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote macOS host is prior to 6.2.5. It is, therefore, affected by multiple vulnerabilities :

  - An arbitrary script execution vulnerability exists due     to a flaw allowing event-based execution of python     scripts within a document. Note, LibreLogo must be     installed for this vulnerability to be exploitable.
    LibreLogo is frequently bundled with LibreOffice.
    (CVE-2019-9848)

  - An information disclosure vulnerability exists due to how     bullet graphics are handled when in 'stealth mode'. An     unauthenticated, remote, attacker could utilize this     vulnerability to cause LibreOffice to perform remote     requests when they would typically not be permitted.
    (CVE-2019-9849)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running Mac OS X 10.12.6 or Mac OS X 10.13.6 and is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - An application may be able to read restricted memory     (CVE-2019-8691, CVE-2019-8692, CVE-2019-8693)

  - Extracting a zip file containing a symbolic link to an     endpoint in an NFS mount that is attacker controlled may     bypass Gatekeeper (CVE-2019-8656)

  - A remote attacker may be able to cause arbitrary code     execution (CVE-2019-8648, CVE-2018-19860, CVE-2019-8661)

  - A remote attacker may be able to leak memory     (CVE-2019-8646, CVE-2019-8663)

  - A remote attacker may be able to cause unexpected     application termination or arbitrary code execution     ( CVE-2019-8641, CVE-2019-8660)

  - An application may be able to execute arbitrary code     with system privileges (CVE-2019-8695, CVE-2019-8697)

  - An issue existed in Samba that may allow attackers to     perform unauthorized actions by intercepting     communications between services (CVE-2018-16860)

  - An application may be able to execute arbitrary code     with kernel privileges (CVE-2019-8694)

  - A remote attacker may be able to view sensitive     information (CVE-2019-13118)

  - An attacker may be able to trigger a use-after-free in     an application deserializing an untrusted NSDictionary     (CVE-2019-8662)

  - Visiting a malicious website may lead to address bar     spoofing (CVE-2019-8670)

  - The encryption status of a Time Machine backup may be     incorrect (CVE-2019-8667)

  - Parsing a maliciously crafted office document may lead     to an unexpected application termination or arbitrary     code execution (CVE-2019-8657)

  - Processing maliciously crafted web content may lead to     universal cross site scripting (CVE-2019-8649,     CVE-2019-8658, CVE-2019-8690)

  - Processing maliciously crafted web content may lead to     arbitrary code execution (CVE-2019-8644, CVE-2019-8666,     CVE-2019-8669, CVE-2019-8671, CVE-2019-8672,     CVE-2019-8673, CVE-2019-8676, CVE-2019-8677,     CVE-2019-8678, CVE-2019-8679, CVE-2019-8680,     CVE-2019-8681, CVE-2019-8683, CVE-2019-8684,     CVE-2019-8685, CVE-2019-8686, CVE-2019-8687,     CVE-2019-8688, CVE-2019-8689)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.6. It is, therefore, affected by multiple vulnerabilities :

  - An application may be able to read restricted memory     (CVE-2019-8691, CVE-2019-8692, CVE-2019-8693)

  - Extracting a zip file containing a symbolic link to an     endpoint in an NFS mount that is attacker controlled may     bypass Gatekeeper (CVE-2019-8656)

  - A remote attacker may be able to cause arbitrary code     execution (CVE-2019-8648, CVE-2018-19860, CVE-2019-8661)

  - A remote attacker may be able to leak memory     (CVE-2019-8646, CVE-2019-8663)

  - A remote attacker may be able to cause unexpected     application termination or arbitrary code execution     (CVE-2019-8641, CVE-2019-8660)

  - An application may be able to execute arbitrary code     with system privileges (CVE-2019-8695, CVE-2019-8697)

  - An issue existed in Samba that may allow attackers to     perform unauthorized actions by intercepting     communications between services (CVE-2018-16860)

  - An application may be able to execute arbitrary code     with kernel privileges (CVE-2019-8694)

  - A remote attacker may be able to view sensitive     information (CVE-2019-13118)

  - An attacker may be able to trigger a use-after-free in     an application deserializing an untrusted NSDictionary     (CVE-2019-8662)

  - Visiting a malicious website may lead to address bar     spoofing (CVE-2019-8670)

  - The encryption status of a Time Machine backup may be     incorrect (CVE-2019-8667)

  - Parsing a maliciously crafted office document may lead     to an unexpected application termination or arbitrary     code execution (CVE-2019-8657)

  - Processing maliciously crafted web content may lead to     universal cross site scripting (CVE-2019-8690,     CVE-2019-8649, CVE-2019-8658)

  - Processing maliciously crafted web content may lead to     arbitrary code execution (CVE-2019-8644, CVE-2019-8666,     CVE-2019-8669, CVE-2019-8671, CVE-2019-8672,     CVE-2019-8673, CVE-2019-8676, CVE-2019-8677,     CVE-2019-8678, CVE-2019-8679, CVE-2019-8680,     CVE-2019-8681, CVE-2019-8683, CVE-2019-8684,     CVE-2019-8685, CVE-2019-8686, CVE-2019-8687,     CVE-2019-8688, CVE-2019-8689)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is 2.4.x prior to 2.4.16. It is, therefore, affected by a vulnerability as referenced in the wireshark-2.4.16 advisory.

  - The ASN.1 BER and related dissectors could crash. It may     be possible to make Wireshark crash by injecting a     malformed packet onto the wire or by convincing someone     to read a malformed packet trace file. (CVE-2019-13619)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is 2.6.x prior to 2.6.10. It is, therefore, affected by a vulnerability as referenced in the wireshark-2.6.10 advisory.

  - The ASN.1 BER and related dissectors could crash. It may     be possible to make Wireshark crash by injecting a     malformed packet onto the wire or by convincing someone     to read a malformed packet trace file. (CVE-2019-13619)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is 3.0.x prior to 3.0.3. It is, therefore, affected by a DoS vulnerability as referenced in the wireshark-3.0.3 advisory.

  - The ASN.1 BER and related dissectors could crash. It may     be possible to make Wireshark crash by injecting a     malformed packet onto the wire or by convincing someone     to read a malformed packet trace file. (CVE-2019-13619)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 75.0.3770.142. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_07_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-23 advisory.

  - As part of his winning Pwn2Own entry, Niklas Baumstark     demonstrated a sandbox escape by installing a malicious     language pack and then opening a browser feature that     used the compromised translation. (CVE-2019-9811)

  - When an inner window is reused, it does not consider the     use of document.domain for cross-origin     protections. If pages on different subdomains ever     cooperatively use document.domain, then     either page can abuse this to inject script into     arbitrary pages on the other subdomain, even those that     did not use document.domain to relax their     origin security. (CVE-2019-11711)

  - POST requests made by NPAPI plugins, such as Flash, that     receive a status 308 redirect response can bypass CORS     requirements. This can allow an attacker to perform     Cross-Site Request Forgery (CSRF) attacks.
    (CVE-2019-11712)

  - A use-after-free vulnerability can occur in HTTP/2 when     a cached HTTP/2 stream is closed while still in use,     resulting in a potentially exploitable crash.
    (CVE-2019-11713)

  - Empty or malformed p256-ECDH public keys may trigger a     segmentation fault due values being improperly sanitized     before being copied into memory and used.
    (CVE-2019-11729)

  - Due to an error while parsing page content, it is     possible for properly sanitized user input to be     misinterpreted and lead to XSS hazards on web sites in     certain circumstances. (CVE-2019-11715)

  - A vulnerability exists where the caret (^) character     is improperly escaped constructing some URIs due to it     being used as a separator, allowing for possible     spoofing of origin attributes. (CVE-2019-11717)

  - When importing a curve25519 private key in PKCS#8format     with leading 0x00 bytes, it is possible to trigger an     out-of-bounds read in the Network Security Services     (NSS) library. This could lead to information     disclosure. (CVE-2019-11719)

  - A vulnerability exists where if a user opens a locally     saved HTML file, this file can use file:
    URIs to access other files in the same directory or sub-     directories if the names are known or guessed. The Fetch     API can then be used to read the contents of any files     stored in these directories and they may uploaded to a     server. Luigi Gubello demonstrated that in combination     with a popular Android messaging app, if a malicious     HTML attachment is sent to a user and they opened that     attachment in Firefox, due to that app's predictable     pattern for locally-saved file names, it is possible to     read attachments the victim received from other     correspondents. (CVE-2019-11730)

  - Mozilla developers and community members Andreea Pavel,     Christian Holler, Honza Bambas, Jason Kratzer, and Jeff     Gilbert reported memory safety bugs present in Firefox     67, Firefox ESR 60.7, and Thunderbird 60.7. Some of     these bugs showed evidence of memory corruption and we     presume that with enough effort that some of these could     be exploited to run arbitrary code. (CVE-2019-11709)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-22 advisory.

  - As part of his winning Pwn2Own entry, Niklas Baumstark     demonstrated a sandbox escape by installing a malicious     language pack and then opening a browser feature that     used the compromised translation. (CVE-2019-9811)

  - When an inner window is reused, it does not consider the     use of document.domain for cross-origin     protections. If pages on different subdomains ever     cooperatively use document.domain, then     either page can abuse this to inject script into     arbitrary pages on the other subdomain, even those that     did not use document.domain to relax their     origin security. (CVE-2019-11711)

  - POST requests made by NPAPI plugins, such as Flash, that     receive a status 308 redirect response can bypass CORS     requirements. This can allow an attacker to perform     Cross-Site Request Forgery (CSRF) attacks.
    (CVE-2019-11712)

  - A use-after-free vulnerability can occur in HTTP/2 when     a cached HTTP/2 stream is closed while still in use,     resulting in a potentially exploitable crash.
    (CVE-2019-11713)

  - Empty or malformed p256-ECDH public keys may trigger a     segmentation fault due values being improperly sanitized     before being copied into memory and used.
    (CVE-2019-11729)

  - Due to an error while parsing page content, it is     possible for properly sanitized user input to be     misinterpreted and lead to XSS hazards on web sites in     certain circumstances. (CVE-2019-11715)

  - A vulnerability exists where the caret (^) character     is improperly escaped constructing some URIs due to it     being used as a separator, allowing for possible     spoofing of origin attributes. (CVE-2019-11717)

  - When importing a curve25519 private key in PKCS#8format     with leading 0x00 bytes, it is possible to trigger an     out-of-bounds read in the Network Security Services     (NSS) library. This could lead to information     disclosure. (CVE-2019-11719)

  - A vulnerability exists where if a user opens a locally     saved HTML file, this file can use file:
    URIs to access other files in the same directory or sub-     directories if the names are known or guessed. The Fetch     API can then be used to read the contents of any files     stored in these directories and they may uploaded to a     server. Luigi Gubello demonstrated that in combination     with a popular Android messaging app, if a malicious     HTML attachment is sent to a user and they opened that     attachment in Firefox, due to that app's predictable     pattern for locally-saved file names, it is possible to     read attachments the victim received from other     correspondents. (CVE-2019-11730)

  - Mozilla developers and community members Andreea Pavel,     Christian Holler, Honza Bambas, Jason Kratzer, and Jeff     Gilbert reported memory safety bugs present in Firefox     67 and Firefox ESR 60.7. Some of these bugs showed     evidence of memory corruption and we presume that with     enough effort that some of these could be exploited to     run arbitrary code. (CVE-2019-11709)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 68.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-21 advisory.

  - As part of his winning Pwn2Own entry, Niklas Baumstark     demonstrated a sandbox escape by installing a malicious     language pack and then opening a browser feature that     used the compromised translation. (CVE-2019-9811)

  - When an inner window is reused, it does not consider the     use of document.domain for cross-origin     protections. If pages on different subdomains ever     cooperatively use document.domain, then     either page can abuse this to inject script into     arbitrary pages on the other subdomain, even those that     did not use document.domain to relax their     origin security. (CVE-2019-11711)

  - POST requests made by NPAPI plugins, such as Flash, that     receive a status 308 redirect response can bypass CORS     requirements. This can allow an attacker to perform     Cross-Site Request Forgery (CSRF) attacks.
    (CVE-2019-11712)

  - A use-after-free vulnerability can occur in HTTP/2 when     a cached HTTP/2 stream is closed while still in use,     resulting in a potentially exploitable crash.
    (CVE-2019-11713)

  - Necko can access a child on the wrong thread during UDP     connections, resulting in a potentially exploitable     crash in some instances. (CVE-2019-11714)

  - Empty or malformed p256-ECDH public keys may trigger a     segmentation fault due values being improperly sanitized     before being copied into memory and used.
    (CVE-2019-11729)

  - Due to an error while parsing page content, it is     possible for properly sanitized user input to be     misinterpreted and lead to XSS hazards on web sites in     certain circumstances. (CVE-2019-11715)

  - Until explicitly accessed by script,     window.globalThis is not enumerable and, as     a result, is not visible to code such as     Object.getOwnPropertyNames(window). Sites     that deploy a sandboxing that depends on enumerating and     freezing access to the window object may miss this,     allowing their sandboxes to be bypassed.
    (CVE-2019-11716)

  - A vulnerability exists where the caret (^) character     is improperly escaped constructing some URIs due to it     being used as a separator, allowing for possible     spoofing of origin attributes. (CVE-2019-11717)

  - Activity Stream can display content from sent from the     Snippet Service website. This content is written to     innerHTML on the Activity Stream page     without sanitization, allowing for a potential access to     other information available to the Activity Stream, such     as browsing history, if the Snipper Service were     compromised. (CVE-2019-11718)

  - When importing a curve25519 private key in PKCS#8format     with leading 0x00 bytes, it is possible to trigger an     out-of-bounds read in the Network Security Services     (NSS) library. This could lead to information     disclosure. (CVE-2019-11719)

  - Some unicode characters are incorrectly treated as     whitespace during the parsing of web content instead of     triggering parsing errors. This allows malicious code to     then be processed, evading cross-site scripting (XSS)     filtering. (CVE-2019-11720)

  - The unicode latin 'kra' character can be used to spoof a     standard 'k' character in the addressbar. This allows     for domain spoofing attacks as do not display as     punycode text, allowing for user confusion.
    (CVE-2019-11721)

  - A vulnerability exists where if a user opens a locally     saved HTML file, this file can use file:
    URIs to access other files in the same directory or sub-     directories if the names are known or guessed. The Fetch     API can then be used to read the contents of any files     stored in these directories and they may uploaded to a     server. Luigi Gubello demonstrated that in combination     with a popular Android messaging app, if a malicious     HTML attachment is sent to a user and they opened that     attachment in Firefox, due to that app's predictable     pattern for locally-saved file names, it is possible to     read attachments the victim received from other     correspondents. (CVE-2019-11730)

  - A vulnerability exists during the installation of add-     ons where the initial fetch ignored the origin     attributes of the browsing context. This could leak     cookies in private browsing mode or across different     containers for people who use the Firefox Multi-     Account Containers Web Extension. (CVE-2019-11723)

  - Application permissions give additional remote     troubleshooting permission to the site     input.mozilla.org, which has been retired and now     redirects to another site. This additional permission is     unnecessary and is a potential vector for malicious     attacks. (CVE-2019-11724)

  - When a user navigates to site marked as unsafe by the     Safebrowsing API, warning messages are displayed and     navigation is interrupted but resources from the same     site loaded through websockets are not blocked, leading     to the loading of unsafe resources and bypassing     safebrowsing protections. (CVE-2019-11725)

  - A vulnerability exists where it possible to force     Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5     signatures when those are the only ones advertised by     server in CertificateRequest in TLS 1.3.
    PKCS#1 v1.5 signatures should not be used for TLS 1.3     messages. (CVE-2019-11727)

  - The HTTP Alternative Services header, Alt-     Svc, can be used by a malicious site to scan all     TCP ports of any host that the accessible to a user when     web content is loaded. (CVE-2019-11728)

  - Mozilla developers and community members Andr Bargull,     Christian Holler, Natalia Csoregi, Raul Gurzau, Daniel     Varga, Jon Coppeard, Marcia Knous, Gary Kwong, Randell     Jesup, David Bolter, Jeff Gilbert, and Deian Stefan     reported memory safety bugs present in Firefox 67. Some     of these bugs showed evidence of memory corruption and     we presume that with enough effort that some of these     could be exploited to run arbitrary code.
    (CVE-2019-11710)

  - Mozilla developers and community members Andreea Pavel,     Christian Holler, Honza Bambas, Jason Kratzer, and Jeff     Gilbert reported memory safety bugs present in Firefox     67 and Firefox ESR 60.7. Some of these bugs showed     evidence of memory corruption and we presume that with     enough effort that some of these could be exploited to     run arbitrary code. (CVE-2019-11709)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Zoom Client for Meetings installed on the remote macOS host is 4.x prior to 4.4.53932.0709. It is, therefore, affected by a webcam hijacking vulnerability. An unauthenticated, remote attacker can exploit this, by convincing a user to visit an attacker controlled website, to force a user to join an attacker controlled video call with their video camera active.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 11.1.1 It is, therefore, affected by multiple vulnerabilities.

- A remote code execution vulnerability exists in WebKit due to improper memory handling.
  An unauthenticated, remote attacker can exploit this, via a specifically crafted   web page to to execute arbitrary code or cause a denial of service   (CVE-2018-4199, CVE-2018-4201, CVE-2018-4218, CVE-2018-4233).

- An information disclosure vulnerability exists in WebKit. An unauthenticated,   remote attacker can exploit this, via a specifically crafted web page,   to disclose potentially sensitive information (CVE-2018-4190).

- An out-of-bounds read error exists in WebKit due to improper input validation.
  An unauthenticated, remote attacker can exploit this, via a specifically crafted web page   that leverages a getWasmBufferFromValue  during WebAssembly compilation to execute arbitrary   code (CVE-2018-4222).

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.7.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-20 advisory.

   - A denial of service (DoS) vulnerability exists in the Arrays.pop component due to a type confusion vulnerability.     An unauthenticated, remote attacker can exploit this issue, by manipulating JavaScript objects, to cause the     application to stop responding (CVE-2019-11707).

  - A remote command execution vulnerability exists in Thunderbird's Prompt:Open IPC component due to insufficient     validation of user-supplied data. An unauthenticated, remote attacker can exploit this to escape a child process'     sandbox and execute arbitrary commands with the priviliges of the user running the main Thunderbird process     (CVE-2019-11708).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 67.0.4. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-19 advisory.

  - Insufficient vetting of parameters passed with the     Prompt:Open IPC message between child and     parent processes can result in the non-sandboxed parent     process opening web content chosen by a compromised     child process. When combined with additional     vulnerabilities this could result in executing arbitrary     code on the user's computer. (CVE-2019-11708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.7.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-19 advisory.

  - Insufficient vetting of parameters passed with the     Prompt:Open IPC message between child and     parent processes can result in the non-sandboxed parent     process opening web content chosen by a compromised     child process. When combined with additional     vulnerabilities this could result in executing arbitrary     code on the user's computer. (CVE-2019-11708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 67.0.3. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-18 advisory.

  - A type confusion vulnerability can occur when     manipulating JavaScript objects due to issues in     Array.pop. This can allow for an     exploitable crash. We are aware of targeted attacks in     the wild abusing this flaw. (CVE-2019-11707)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.7.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-18 advisory.

  - A type confusion vulnerability can occur when     manipulating JavaScript objects due to issues in     Array.pop. This can allow for an     exploitable crash. We are aware of targeted attacks in     the wild abusing this flaw. (CVE-2019-11707)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by remote code execution vulnerabilities in the Microsoft Word software due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary commands.

The version of Google Chrome installed on the remote macOS host is prior to 75.0.3770.90. It is, therefore, affected by a vulnerability as referenced in the 2019_06_stable-channel-update-for-desktop_13 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.7.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-17 advisory.

  - A flaw in Thunderbird's implementation of iCal causes a     heap buffer overflow in parsergetnextchar     when processing certain email messages, resulting in a     potentially exploitable crash. (CVE-2019-11703)

  - A flaw in Thunderbird's implementation of iCal causes a     heap buffer overflow in     icalmemorystrdupanddequote when processing     certain email messages, resulting in a potentially     exploitable crash. (CVE-2019-11704)

  - A flaw in Thunderbird's implementation of iCal causes a     stack buffer overflow in     icalrecuraddbydayrules when processing     certain email messages, resulting in a potentially     exploitable crash. (CVE-2019-11705)

  - A flaw in Thunderbird's implementation of iCal causes a     type confusion in     icaltimezonegetvtimezoneproperties when     processing certain email messages, resulting in a crash.
    (CVE-2019-11706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Mac OS X host is running a version of FortiOS prior to 6.0.5. It is, therefore, affected by a host header redirection vulnerability in the SSL VPN web portal due to a failure to properly validate HTTP request headers. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request to redirect SSL VPN web portal users to arbitrary web domains.

The remote Mac OS X host is running a version of FortiOS 5.4.1 prior to 5.4.11, 5.6.x prior to 5.6.9 or 6.0.x prior to 6.0.5. It is, therefore, affected by a security bypass vulnerability in the SSL VPN web portal, due to an error when processing HTTP requests. A remote, unauthenticated attacker can exploit this, by sending a specially crafted HTTP request to change the password of an arbitrary SSL VPN web portal user.

The remote Mac OS X host is running a version of FortiOS prior to 6.0.5. It is, therefore, affected by a heap buffer overflow condition in the SSL VPN web portal due to improper handling of javascript href data. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specifically crafted proxy-ed webpage, to cause a denial of service condition.

The remote Mac OS X host is running a version of FortiOS prior or equal to 5.4, 5.6.x prior to 5.6.8 or 6.0.x prior to 6.0.5. It is, therefore, affected by a buffer overflow condition in the SSL-VPN web portal, due to a failure to properly parse message payloads. An unauthenticated attacker can expoit this, via a specially crafted request to cause a denial of service condition.

The remote Mac OS X host is running a version of FortiOS 5.6.3 prior to 5.6.8 or 6.0.x prior to 6.0.5. It is, therefore, affected by a directory traversal vulnerability in the SSL VPN web portal, due to an improper limitation of a pathname to a restricted Directory. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to download arbitrary FortiOS system files.

The version of Fortinet FortiOS running on the remote Mac OS X host is prior or equal to 5.4, 5.6.x prior to 5.6.8, or 6.0.x prior to 6.0.5. It is, therefore, affected by a cross-site scripting (XSS) vulnerability in the SSL VPN web portal due to a failure to sanitize the login redir parameter. An unauthenticated, remote attacker can exploit this, by convincing a user to click on a specially crafted URL, to execute arbitrary script code in a user's browser session or to redirect the user to a malicious website.

The version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 32.0.0.192. It is therefore affected by a use-after-free vulnerability. An unauthenticated, remote attacker could exploit this to execute arbitrary code.

The version of Google Chrome installed on the remote macOS host is prior to 75.0.3770.80. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_06_stable-channel-update- for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
128774	Mozilla Thunderbird < 60.9 Multiple Vulnerabilities	Medium
128740	Google Chrome < 77.0.3865.75 Multiple Vulnerabilities	High
128706	Security Update for Microsoft Office (September 2019) (macOS)	High
128632	Adobe Flash Player for Mac <= 32.0.0.238 (APSB19-46)	High
128529	Mozilla Firefox ESR < 60.9	Critical
128527	Mozilla Firefox ESR < 68.1	High
128524	Mozilla Firefox < 69.0	Medium
128327	Google Chrome < 76.0.3809.132 Use-After-Free Vulnerability	High
128279	Fortinet FortiOS (Mac OS X) 5.6.0 < 5.6.8 / 6.0.x < 6.0.5 multiple pre-auth XSS vulnerabilities on SSL VPN (FG-IR-18-383)	Medium
128178	macOS : Apple Safari < 12.1.2 Multiple Vulnerabilities	High
128060	Mozilla Firefox ESR < 68.0.2	Low
128059	Mozilla Firefox < 68.0.2	Low
127915	Jamf Installed (macOS)	Info
127902	Adobe Reader <= 2015.006.30497 / 2017.011.30142 / 2019.012.20034 Multiple Vulnerabilities (APSB19-41) (macOS)	Critical
127901	Adobe Acrobat <= 2015.006.30497 / 2017.011.30142 / 2019.012.20034 Multiple Vulnerabilities (APSB19-41) (macOS)	Critical
127898	Adobe Photoshop CC 19.x <= 19.1.8 / 20.x <= 20.0.5 Vulnerability (APSB19-15)	High
127895	Adobe Creative Cloud Desktop <= 4.6.1.393 Multiple Vulnerabilities (APSB19-39) (macOS)	Medium
127894	Security Update for Microsoft Office (August 2019) (macOS)	High
127135	VMware Fusion 10.0.x < 10.1.6 / 11.0.x < 11.0.3 Pixel Shader out-of-bounds read/write vulnerabilities (VMSA-2019-0012)	Medium
127128	Google Chrome < 76.0.3809.100 Multiple Vulnerabilities	High
127124	Security Updates for Microsoft Office (July 2019) (macOS)	High
127119	Google Chrome < 76.0.3809.87 Multiple Vulnerabilities	Critical
127113	LibreOffice < 6.2.5 Multiple Vulnerabilities (macOS)	High
127055	macOS Sierra / High Sierra Multiple Vulnerabilities (Security Update 2019-004)	Medium
127054	macOS 10.14.x < 10.14.6 Multiple Vulnerabilities	Medium
126922	Wireshark 2.4.x < 2.4.16 DoS Vulnerability (macOS)	Medium
126920	Wireshark 2.6.x < 2.6.10 DoS Vulnerability (macOS)	Medium
126918	Wireshark 3.0.x < 3.0.3 DoS Vulnerability (macOS)	Medium
126752	Google Chrome < 75.0.3770.142 Multiple Vulnerabilities	High
126703	Mozilla Thunderbird < 60.8	High
126623	Mozilla Firefox ESR < 60.8	High
126621	Mozilla Firefox < 68.0	High
126590	Zoom Client for Meetings 4.x < 4.4.53932.0709 Webcam Hijacking Vulnerability (macOS)	Medium
126381	macOS : Apple Safari < 11.1.1 Multiple Vulnerabilities	Medium
126217	Mozilla Thunderbird < 60.7.2	High
126070	Mozilla Firefox < 67.0.4	High
126069	Mozilla Firefox ESR < 60.7.2	High
126000	Mozilla Firefox < 67.0.3	High
125999	Mozilla Firefox ESR < 60.7.1	High
125953	Security Update for Microsoft Office (June 2019) (macOS)	High
125951	Google Chrome < 75.0.3770.90 Vulnerability	High
125949	Mozilla Thunderbird < 60.7.1	Medium
125895	Fortinet FortiOS (Mac OS X) < 6.0.5 SSL VPN Web Portal Host Header Redirection (FG-IR-19-002)	Medium
125894	Fortinet FortiOS (Mac OS X) 5.4.1 < 5.4.11 / 5.6.x < 5.6.9 / 6.0.x < 6.0.5 SSL VPN Security Bypass (FG-IR-18-389)	Medium
125893	Fortinet FortiOS (Mac OS X) < 6.0.5 SSL VPN Heap Buffer Overflow (FG-IR-18-388)	Medium
125892	Fortinet FortiOS (Mac OS X) <= 5.4, 5.6.x < 5.6.8, 6.0.x < 6.0.5 SSL VPN Buffer Overflow (FG-IR-18-387)	Medium
125891	Fortinet FortiOS (Mac OS X) 5.6.3 < 5.6.8 / 6.0.x < 6.0.5 SSL VPN Directory Traversal Vulnerability (FG-IR-18-384)	Medium
125890	Fortinet FortiOS (Mac OS X) <= 5.4 / 5.6.x < 5.6.8 / 6.0.x < 6.0.5 SSL VPN Web Portal login redir XSS (FG-IR-17-242)	Low
125814	Adobe Flash Player for Mac <= 32.0.0.192 (APSB19-30)	High
125728	Google Chrome < 75.0.3770.80 Multiple Vulnerabilities	Medium

MacOS X Local Security Checks Family for Nessus