The version of Firefox installed on the remote Windows host is prior to 70.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-34 advisory.

  - Mozilla developers and community members Bob Clary, Jason Kratzer, Aaron Klotz, Iain Ireland, Tyson Smith,     Christian Holler, Steve Fink, Honza Bambas, Byron Campen, and Cristian Brindusan reported memory safety     bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption     and we presume that with enough effort some of these could be exploited to run arbitrary code.
    (CVE-2019-11764)

  - A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in     arbitrary code execution and a sandbox escape. (CVE-2019-25136)

  - Incorrect derivation of a packet length in WebRTC caused heap corruption via a crafted video file. This     resulted in a potentially exploitable crash. (CVE-2018-6156)

  - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to     document parsing too early. A subsequent call to <code>XMLGetCurrentLineNumber</code> or     <code>XMLGetCurrentColumnNumber</code> then resulted in a heap-based buffer over-read. (CVE-2019-15903)

  - When storing a value in IndexedDB, the value's prototype chain is followed and it was possible to retain a     reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a     potentially exploitable crash. (CVE-2019-11757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:3196 advisory.

  - Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

  - Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

  - Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

  - Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

  - Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

  - Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

  - Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

  - Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

  - expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has firefox packages installed that are affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-3193 advisory.

    [68.2.0-1.0.1]
    - Update distribution for Oracle Linux [Orabug: 30143292]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [68.2.0-1]
    - Update to 68.2.0 ESR

    [68.1.0-6]
    - Enable system nss on RHEL6

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-3196 advisory.

    [68.2.0-2.0.1]
    - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [68.2.0-2]
    - Rebuild

    [68.2.0-1]
    - Update to 68.2.0 ESR

    [68.1.0-6]
    - Enable system nss on RHEL6

    [68.1.0-2]
    - Enable building langpacks

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-3210 advisory.

    [68.2.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [68.2.0-1]
    - Update to 68.2.0

    [68.1.1-2]
    - Update to 68.1.1

    [60.9.0-2]
    - Update to 60.9.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-3237 advisory.

    [68.2.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [68.2.0-1]
    - Update to 68.2.0

    [68.1.1-2]
    - Update to 68.1.1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox to 68.2.0 ESR fixes the following issues :

Mozilla Firefox was updated to version 68.2.0 ESR (bsc#1154738).

Security issues fixed :

CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).

CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).

CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).

CVE-2019-11759: Fixed a stack-based buffer overflow in HKDF output (bsc#1154738).

CVE-2019-11760: Fixed a stack-based buffer overflow in WebRTC networking (bsc#1154738).

CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738).

CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738).

CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738).

Non-security issues fixed: Firefox 60.7 ESR changed the user interface language (bsc#1137990).

Wrong Firefox GUI Language (bsc#1120374).

Fixed an inadvertent crash report transmission without user opt-in (bsc#1074235).

Firefox hangs randomly when browsing and scrolling (bsc#1043008).

Firefox stops loading page until mouse is moved (bsc#1025108).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues :

Changes in MozillaFirefox :

Security issues fixed :

  - CVE-2019-15903: Fixed a heap overflow in the expat     library (bsc#1149429).

  - CVE-2019-11757: Fixed a use-after-free when creating     index updates in IndexedDB (bsc#1154738).

  - CVE-2019-11758: Fixed a potentially exploitable crash     due to 360 Total Security (bsc#1154738).

  - CVE-2019-11759: Fixed a stack-based buffer overflow in     HKDF output (bsc#1154738).

  - CVE-2019-11760: Fixed a stack-based buffer overflow in     WebRTC networking (bsc#1154738).

  - CVE-2019-11761: Fixed an unintended access to a     privileged JSONView object (bsc#1154738).

  - CVE-2019-11762: Fixed a same-origin-property violation     (bsc#1154738).

  - CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

  - CVE-2019-11764: Fixed several memory safety bugs     (bsc#1154738).

Non-security issues fixed :

  - Added Provides-line for translations-common     (bsc#1153423) .

  - Moved some settings from branding-package here     (bsc#1153869).

  - Disabled DoH by default.

Changes in MozillaFirefox-branding-SLE :

  - Moved extensions preferences to core package     (bsc#1153869).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4202-1 advisory.

    It was discovered that a specially crafted S/MIME message with an inner encryption layer could be     displayed as having a valid signature in some circumstances, even if the signer had no access to the     encrypted message. An attacker could potentially exploit this to spoof the message author.
    (CVE-2019-11755)

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, bypass security restrictions, bypass same-origin restrictions, conduct cross-site scripting (XSS)     attacks, or execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759, CVE-2019-11760,     CVE-2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764)

    A heap overflow was discovered in the expat library in Thunderbird. If a user were tricked in to opening a     specially crafted message, an attacker could potentially exploit this to cause a denial of service, or     execute arbitrary code. (CVE-2019-15903)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
130170	Mozilla Firefox < 70.0	Nessus	Windows	10/24/2019	11/18/2025	critical
145572	CentOS 8 : firefox (CESA-2019:3196)	Nessus	CentOS Local Security Checks	1/29/2021	1/25/2024	high
131409	NewStart CGSL CORE 5.04 / MAIN 5.04 : firefox Multiple Vulnerabilities (NS-SA-2019-0216)	Nessus	NewStart CGSL Local Security Checks	12/2/2019	4/9/2024	high
130184	Oracle Linux 7 : firefox (ELSA-2019-3193)	Nessus	Oracle Linux Local Security Checks	10/24/2019	10/22/2024	high
130247	Oracle Linux 8 : firefox (ELSA-2019-3196)	Nessus	Oracle Linux Local Security Checks	10/25/2019	10/22/2024	high
130414	Oracle Linux 7 : thunderbird (ELSA-2019-3210)	Nessus	Oracle Linux Local Security Checks	10/31/2019	10/22/2024	high
130415	Oracle Linux 8 : thunderbird (ELSA-2019-3237)	Nessus	Oracle Linux Local Security Checks	10/31/2019	10/23/2024	high
130450	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2872-1)	Nessus	SuSE Local Security Checks	11/1/2019	4/16/2024	critical
130890	openSUSE Security Update : MozillaFirefox / MozillaFirefox-branding-SLE (openSUSE-2019-2459)	Nessus	SuSE Local Security Checks	11/12/2019	4/12/2024	high
183628	Ubuntu 18.04 LTS : Thunderbird vulnerabilities (USN-4202-1)	Nessus	Ubuntu Local Security Checks	10/21/2023	8/27/2024	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

critical

high

high