The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4298:05 advisory.

    * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812)
      * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9     (CVE-2019-11740)
      * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images     (CVE-2019-11742)
      * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)
      * Mozilla: Use-after-free while manipulating video (CVE-2019-11746)
      * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)
      * firefox: stored passwords in 'Saved Logins' can be copied without master password entry     (CVE-2019-11733)
      * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-2807 advisory.

    [60.9.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [60.9.0-1]
    - Update to 60.9.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2774 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 60.9.0.

    Security Fix(es):

    * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message     (CVE-2019-11739)

    * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

    * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images     (CVE-2019-11742)

    * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

    * Mozilla: Use-after-free while manipulating video (CVE-2019-11746)

    * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

    * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2773 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 60.9.0.

    Security Fix(es):

    * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message     (CVE-2019-11739)

    * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

    * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images     (CVE-2019-11742)

    * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

    * Mozilla: Use-after-free while manipulating video (CVE-2019-11746)

    * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

    * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2807 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 60.9.0.

    Security Fix(es):

    * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message     (CVE-2019-11739)

    * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

    * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images     (CVE-2019-11742)

    * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

    * Mozilla: Use-after-free while manipulating video (CVE-2019-11746)

    * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

    * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update upgrades Thunderbird to version 60.9.0.

Security Fix(es) :

  - Mozilla: Covert Content Attack on S/MIME encryption     using a crafted multipart/alternative message     (CVE-2019-11739)

  - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox     ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

  - Mozilla: Same-origin policy violation with SVG filters     and canvas to steal cross-origin images (CVE-2019-11742)

  - Mozilla: XSS by breaking out of title and textarea     elements using innerHTML (CVE-2019-11744)

  - Mozilla: Use-after-free while manipulating video     (CVE-2019-11746)

  - Mozilla: Use-after-free while extracting a key value in     IndexedDB (CVE-2019-11752)

  - Mozilla: Cross-origin access to unload event attributes     (CVE-2019-11743)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4122-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to obtain sensitive information, bypass     Content Security Policy (CSP) protections, bypass same-origin restrictions, conduct cross-site scripting     (XSS) attacks, cause a denial of service, or execute arbitrary code. (CVE-2019-5849, CVE-2019-11734,     CVE-2019-11735, CVE-2019-11737, CVE-2019-11738, CVE-2019-11740, CVE-2019-11742, CVE-2019-11743,     CVE-2019-11744, CVE-2019-11746, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11752)

    It was discovered that a compromised content process could log in to a malicious Firefox Sync account. An     attacker could potentially exploit this, in combination with another vulnerability, to disable the     sandbox. (CVE-2019-9812)

    It was discovered that addons.mozilla.org and accounts.firefox.com could be loaded in to the same content     process. An attacker could potentially exploit this, in combination with another vulnerability that     allowed a cross-site scripting (XSS) attack, to modify browser settings. (CVE-2019-11741)

    It was discovered that the Forget about this site feature in the history pane removes HTTP Strict     Transport Security (HSTS) settings for sites on the pre-load list. An attacker could potentially exploit     this to bypass the protections offered by HSTS. (CVE-2019-11747)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
288977	MiracleLinux 7 : firefox-60.9.0-1.0.1.el7.AXS7 (AXSA:2019-4298:05)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
129088	Oracle Linux 6 : thunderbird (ELSA-2019-2807)	Nessus	Oracle Linux Local Security Checks	9/20/2019	10/22/2024	high
128962	RHEL 8 : thunderbird (RHSA-2019:2774)	Nessus	Red Hat Local Security Checks	9/17/2019	11/6/2024	high
129037	RHEL 7 : thunderbird (RHSA-2019:2773)	Nessus	Red Hat Local Security Checks	9/19/2019	11/6/2024	high
129041	RHEL 6 : thunderbird (RHSA-2019:2807)	Nessus	Red Hat Local Security Checks	9/19/2019	11/6/2024	high
129093	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190919)	Nessus	Scientific Linux Local Security Checks	9/20/2019	4/24/2024	high
128521	Ubuntu 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-4122-1)	Nessus	Ubuntu Local Security Checks	9/5/2019	8/27/2024	critical

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

critical