The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-2773 advisory.

    [60.9.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [60.9.0-1]
    - Update to 60.9.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-30 advisory.

  - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This     results in a use-after-free and a potentially exploitable crash. (CVE-2019-11752)

  - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a     HTML reply/forward. (CVE-2019-11739)

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. (CVE-2019-11746)

  - Some HTML elements, such as <code><title></code> and <code><textarea></code>, can contain     literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to     <code>.innerHTML</code> on these elements, and subsequent content after that will be parsed as if it were     outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements     as it does for other elements. (CVE-2019-11744)

  - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of     SVG filters and a <code><canvas></code> element due to an error in how same-origin policy is applied     to cached image content. The resulting same-origin policy violation could allow for data theft.
    (CVE-2019-11742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

Updated to new ESR version 68.1 (bsc#1149323).

In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735.

Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810).

The version displayed in Help > About is now correct (bsc#1087200).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-27 advisory.

  - Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape     that sandbox by loading <code>accounts.firefox.com</code> in that process and forcing a log-in to a     malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the     local machine and the compromised browser would restart without the sandbox if a crash is triggered.
    (CVE-2019-9812)

  - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This     results in a use-after-free and a potentially exploitable crash. (CVE-2019-11752)

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. (CVE-2019-11746)

  - Some HTML elements, such as <code><title></code> and <code><textarea></code>, can contain     literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to     <code>.innerHTML</code> on these elements, and subsequent content after that will be parsed as if it were     outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements     as it does for other elements. (CVE-2019-11744)

  - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of     SVG filters and a <code><canvas></code> element due to an error in how same-origin policy is applied     to cached image content. The resulting same-origin policy violation could allow for data theft.
    (CVE-2019-11742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201911-07 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14173-1 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR     68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects     Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
    (CVE-2019-11740)

  - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of     SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached     image content. The resulting same-origin policy violation could allow for data theft. This vulnerability     affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
    (CVE-2019-11742)

  - Navigation events were not fully adhering to the W3C's Navigation-Timing Level 2 draft specification in     some instances for the unload event, which restricts access to detailed timing attributes to only be same-     origin. This resulted in potential cross-origin information exposure of history through timing side-     channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox     ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11743)

  - Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without     treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and     subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site     does not filter user input as strictly for these elements as it does for other elements. This     vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and     Firefox ESR < 68.1. (CVE-2019-11744)

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69,     Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11746)

  - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This     results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69,     Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11752)

  - The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it     unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is     manipulated to update this unprotected location and the updated maintenance service in the unprotected     location has been altered, the altered maintenance service can run with elevated privileges during the     update process due to a lack of integrity checks. This allows for privilege escalation if the executable     has been replaced locally. *Note: This attack requires local system access and only affects Windows.
    Other operating systems are not affected.*. This vulnerability affects Firefox < 69, Firefox ESR < 60.9,     and Firefox ESR < 68.1. (CVE-2019-11753)

  - Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape     that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox     Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and     the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability     affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69. (CVE-2019-9812)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69,     Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11746)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-29 advisory.

  - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This     results in a use-after-free and a potentially exploitable crash. (CVE-2019-11752)

  - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a     HTML reply/forward. (CVE-2019-11739)

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. (CVE-2019-11746)

  - Some HTML elements, such as <code><title></code> and <code><textarea></code>, can contain     literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to     <code>.innerHTML</code> on these elements, and subsequent content after that will be parsed as if it were     outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements     as it does for other elements. (CVE-2019-11744)

  - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of     SVG filters and a <code><canvas></code> element due to an error in how same-origin policy is applied     to cached image content. The resulting same-origin policy violation could allow for data theft.
    (CVE-2019-11742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-29 advisory.

  - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This     results in a use-after-free and a potentially exploitable crash. (CVE-2019-11752)

  - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a     HTML reply/forward. (CVE-2019-11739)

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. (CVE-2019-11746)

  - Some HTML elements, such as <code><title></code> and <code><textarea></code>, can contain     literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to     <code>.innerHTML</code> on these elements, and subsequent content after that will be parsed as if it were     outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements     as it does for other elements. (CVE-2019-11744)

  - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of     SVG filters and a <code><canvas></code> element due to an error in how same-origin policy is applied     to cached image content. The resulting same-origin policy violation could allow for data theft.
    (CVE-2019-11742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, information disclosure and a covert content attack on S/MIME encryption using a crafted multipart/alternative message.

The version of Thunderbird installed on the remote Windows host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-30 advisory.

  - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This     results in a use-after-free and a potentially exploitable crash. (CVE-2019-11752)

  - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a     HTML reply/forward. (CVE-2019-11739)

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. (CVE-2019-11746)

  - Some HTML elements, such as <code><title></code> and <code><textarea></code>, can contain     literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to     <code>.innerHTML</code> on these elements, and subsequent content after that will be parsed as if it were     outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements     as it does for other elements. (CVE-2019-11744)

  - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of     SVG filters and a <code><canvas></code> element due to an error in how same-origin policy is applied     to cached image content. The resulting same-origin policy violation could allow for data theft.
    (CVE-2019-11742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update upgrades Thunderbird to version 60.9.0.

Security Fix(es) :

  - Mozilla: Covert Content Attack on S/MIME encryption     using a crafted multipart/alternative message     (CVE-2019-11739)

  - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox     ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

  - Mozilla: Same-origin policy violation with SVG filters     and canvas to steal cross-origin images (CVE-2019-11742)

  - Mozilla: XSS by breaking out of title and textarea     elements using innerHTML (CVE-2019-11744)

  - Mozilla: Use-after-free while manipulating video     (CVE-2019-11746)

  - Mozilla: Use-after-free while extracting a key value in     IndexedDB (CVE-2019-11752)

  - Mozilla: Cross-origin access to unload event attributes     (CVE-2019-11743)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - Encrypted S/MIME parts in a crafted     multipart/alternative message can leak plaintext when     included in a a HTML reply/forward. This vulnerability     affects Thunderbird < 68.1 and Thunderbird < 60.9.
    (CVE-2019-11739)

  - Mozilla developers and community members reported memory     safety bugs present in Firefox 68, Firefox ESR 68, and     Firefox 60.8. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     that some of these could be exploited to run arbitrary     code. This vulnerability affects Firefox < 69,     Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR <     60.9, and Firefox ESR < 68.1. (CVE-2019-11740)

  - A same-origin policy violation occurs allowing the theft     of cross-origin images through a combination of SVG     filters and a <canvas> element due to an error in     how same-origin policy is applied to cached image     content. The resulting same-origin policy violation     could allow for data theft. This vulnerability affects     Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9,     Firefox ESR < 60.9, and Firefox ESR < 68.1.
    (CVE-2019-11742)

  - Navigation events were not fully adhering to the W3C's     Navigation-Timing Level 2 draft specification in some     instances for the unload event, which restricts access     to detailed timing attributes to only be same-origin.
    This resulted in potential cross-origin information     exposure of history through timing side-channel attacks.
    This vulnerability affects Firefox < 69, Thunderbird <     68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and     Firefox ESR < 68.1. (CVE-2019-11743)

  - Some HTML elements, such as <title> and     <textarea>, can contain literal angle brackets     without treating them as markup. It is possible to pass     a literal closing tag to .innerHTML on these elements,     and subsequent content after that will be parsed as if     it were outside the tag. This can lead to XSS if a site     does not filter user input as strictly for these     elements as it does for other elements. This     vulnerability affects Firefox < 69, Thunderbird < 68.1,     Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR     < 68.1. (CVE-2019-11744)

  - A use-after-free vulnerability can occur while     manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable     crash. This vulnerability affects Firefox < 69,     Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR <     60.9, and Firefox ESR < 68.1. (CVE-2019-11746)

  - It is possible to delete an IndexedDB key value and     subsequently try to extract it during conversion. This     results in a use-after-free and a potentially     exploitable crash. This vulnerability affects Firefox <     69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR     < 60.9, and Firefox ESR < 68.1. (CVE-2019-11752)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
128961	Oracle Linux 7 : thunderbird (ELSA-2019-2773)	Nessus	Oracle Linux Local Security Checks	9/17/2019	10/22/2024	high
128971	Mozilla Thunderbird < 68.1	Nessus	MacOS X Local Security Checks	9/18/2019	11/18/2025	high
129772	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2620-1)	Nessus	SuSE Local Security Checks	10/10/2019	4/18/2024	critical
128529	Mozilla Firefox ESR < 60.9	Nessus	MacOS X Local Security Checks	9/5/2019	11/18/2025	critical
131267	GLSA-201911-07 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	11/25/2019	4/10/2024	critical
150554	SUSE SLES11 Security Update : MozillaFirefox, firefox-glib2, firefox-gtk3 (SUSE-SU-2019:14173-1)	Nessus	SuSE Local Security Checks	6/10/2021	12/26/2023	critical
248112	Linux Distros Unpatched Vulnerability : CVE-2019-11746	Nessus	Misc.	8/11/2025	7/24/2026	high
128774	Mozilla Thunderbird < 60.9	Nessus	MacOS X Local Security Checks	9/16/2019	11/18/2025	high
128775	Mozilla Thunderbird < 60.9	Nessus	Windows	9/16/2019	11/18/2025	high
128783	Debian DSA-4523-1 : thunderbird - security update	Nessus	Debian Local Security Checks	9/16/2019	4/26/2024	high
128972	Mozilla Thunderbird < 68.1	Nessus	Windows	9/18/2019	11/18/2025	high
129042	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190918)	Nessus	Scientific Linux Local Security Checks	9/19/2019	4/24/2024	high
129935	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0190)	Nessus	NewStart CGSL Local Security Checks	10/15/2019	4/18/2024	high

Detections

Analytics

Plugins Search

high

high

critical

critical

critical

critical

high

high

high

high

high

high

high