The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3210 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 68.2.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

    * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

    * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

    * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

    * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

    * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

    * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

    * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

    * expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3281 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.2.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

    * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

    * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

    * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

    * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

    * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

    * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

    * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues :

Changes in MozillaFirefox :

Security issues fixed :

  - CVE-2019-15903: Fixed a heap overflow in the expat     library (bsc#1149429).

  - CVE-2019-11757: Fixed a use-after-free when creating     index updates in IndexedDB (bsc#1154738).

  - CVE-2019-11758: Fixed a potentially exploitable crash     due to 360 Total Security (bsc#1154738).

  - CVE-2019-11759: Fixed a stack-based buffer overflow in     HKDF output (bsc#1154738).

  - CVE-2019-11760: Fixed a stack-based buffer overflow in     WebRTC networking (bsc#1154738).

  - CVE-2019-11761: Fixed an unintended access to a     privileged JSONView object (bsc#1154738).

  - CVE-2019-11762: Fixed a same-origin-property violation     (bsc#1154738).

  - CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

  - CVE-2019-11764: Fixed several memory safety bugs     (bsc#1154738).

Non-security issues fixed :

  - Added Provides-line for translations-common     (bsc#1153423) .

  - Moved some settings from branding-package here     (bsc#1153869).

  - Disabled DoH by default.

Changes in MozillaFirefox-branding-SLE :

  - Moved extensions preferences to core package     (bsc#1153869).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird to version 68.2.1 provides the following fixes :

  - Security issues fixed (bsc#1154738) :

  - CVE-2019-15903: Fixed a heap overflow in the expat     library (bsc#1149429).

  - CVE-2019-11757: Fixed a use-after-free when creating     index updates in IndexedDB (bsc#1154738).

  - CVE-2019-11758: Fixed a potentially exploitable crash     due to 360 Total Security (bsc#1154738).

  - CVE-2019-11759: Fixed a stack-based buffer overflow in     HKDF output (bsc#1154738).

  - CVE-2019-11760: Fixed a stack-based buffer overflow in     WebRTC networking (bsc#1154738).

  - CVE-2019-11761: Fixed an unintended access to a     privileged JSONView object (bsc#1154738).

  - CVE-2019-11762: Fixed a same-origin-property violation     (bsc#1154738).

  - CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

  - CVE-2019-11764: Fixed several memory safety bugs     (bsc#1154738).

Other fixes (bsc#1153879) :

  - Some attachments couldn't be opened in messages     originating from MS Outlook 2016.

  - Address book import from CSV.

  - Performance problem in message body search.

  - Ctrl+Enter to send a message would open an attachment if     the attachment pane had focus.

  - Calendar: Issues with 'Today Pane' start-up.

  - Calendar: Glitches with custom repeat and reminder     number input.

  - Calendar: Problems with WCAP provider.

  - A language for the user interface can now be chosen in     the advanced settings 

  - Fixed an issue with Google authentication (OAuth2)

  - Fixed an issue where selected or unread messages were     not shown in the correct color in the thread pane under     some circumstances

  - Fixed an issue where when using a language pack, names     of standard folders were not localized (bsc#1149126)

  - Fixed an issue where the address book default startup     directory in preferences panel not persisted

  - Fixed various visual glitches

  - Fixed issues with the chat

  - Fixed building with rust >= 1.38.

  - Fixrd LTO build without PGO.

  - Removed kde.js since disabling instantApply breaks     extensions and is now obsolete with the move to HTML     views for preferences. (bsc#1151186)

  - Updated create-tar.sh. (bsc#1152778)

  - Deactivated the crashreporter for the last remaining     arch.

This update was imported from the SUSE:SLE-15:Update update project.

An update for thunderbird is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.2.0.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

* Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

* Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

* Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

* Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

* Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

* Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

* Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

* expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service.

Debian follows the Thunderbird upstream releases. Support for the 60.x series has ended, so starting with this update we're now following the 68.x releases.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4378:06 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)
      * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)
      * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)
      * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)
      * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)
      * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)
      * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)
      * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4386:06 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)
      * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)
      * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)
      * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)
      * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)
      * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)
      * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)
      * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-10 (Mozilla Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code, cause a Denial       of Service condition, obtain sensitive information, or conduct Cross-Site       Request Forgery (CSRF).
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
130371	RHEL 7 : thunderbird (RHSA-2019:3210)	Nessus	Red Hat Local Security Checks	10/30/2019	11/6/2024	high
130444	RHEL 6 : firefox (RHSA-2019:3281)	Nessus	Red Hat Local Security Checks	11/1/2019	11/6/2024	high
130885	openSUSE Security Update : MozillaFirefox / MozillaFirefox-branding-SLE (openSUSE-2019-2451)	Nessus	SuSE Local Security Checks	11/12/2019	4/12/2024	high
130936	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2452)	Nessus	SuSE Local Security Checks	11/13/2019	4/11/2024	high
130977	CentOS 6 : thunderbird (CESA-2019:3756)	Nessus	CentOS Local Security Checks	11/14/2019	4/11/2024	high
131139	Debian DSA-4571-1 : thunderbird - security update	Nessus	Debian Local Security Checks	11/20/2019	4/11/2024	high
288923	MiracleLinux 7 : firefox-68.2.0-1.0.1.el7.AXS7 (AXSA:2019-4378:06)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
290072	MiracleLinux 4 : firefox-68.2.0-4.0.1.AXS4 (AXSA:2019-4386:06)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
134587	GLSA-202003-10 : Mozilla Thunderbird: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/16/2020	9/28/2020	critical
147312	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0002)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	4/25/2023	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

critical

critical