The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-0123 advisory.

    [68.4.1-2.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [68.4.1-2]
    - Update to 68.4.1 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-0086 advisory.

    - Added fix for mozbz#1348168/CVE-2017-5428

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or information disclosure.

For Debian 8 'Jessie', these problems have been fixed in version 1:68.4.1-1~deb8u1.

We recommend that you upgrade your thunderbird packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the mozjs60 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a     crash. We presume that with enough effort that it could be exploited to run arbitrary code. This     vulnerability affects Firefox ESR < 68.4 and Firefox < 72. (CVE-2019-17017)

  - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type     confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. (CVE-2019-17026)

  - The type inference system allows the compilation of functions that can cause type confusions between     arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor     function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and     writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR     < 60.6, and Firefox < 66. (CVE-2019-9791)

  - A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be     used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects     Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. (CVE-2019-9795)

  - Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing     bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and     Thunderbird < 60.6.1. (CVE-2019-9810)

  - Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be     leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR <     60.6.1, and Thunderbird < 60.6.1. (CVE-2019-9813)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the mozjs60 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a     crash. We presume that with enough effort that it could be exploited to run arbitrary code. This     vulnerability affects Firefox ESR < 68.4 and Firefox < 72. (CVE-2019-17017)

  - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type     confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. (CVE-2019-17026)

  - The type inference system allows the compilation of functions that can cause type confusions between     arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor     function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and     writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR     < 60.6, and Firefox < 66. (CVE-2019-9791)

  - A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be     used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects     Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. (CVE-2019-9795)

  - Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing     bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and     Thunderbird < 60.6.1. (CVE-2019-9810)

  - Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be     leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR <     60.6.1, and Thunderbird < 60.6.1. (CVE-2019-9813)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
147312	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0002)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	4/25/2023	critical
180631	Oracle Linux 6 : thunderbird (ELSA-2020-0123)	Nessus	Oracle Linux Local Security Checks	9/7/2023	10/22/2024	high
180643	Oracle Linux 6 : firefox (ELSA-2020-0086)	Nessus	Oracle Linux Local Security Checks	9/7/2023	10/22/2024	high
133104	Debian DLA-2071-1 : thunderbird security update	Nessus	Debian Local Security Checks	1/21/2020	3/29/2024	high
159783	EulerOS 2.0 SP9 : mozjs60 (EulerOS-SA-2022-1431)	Nessus	Huawei Local Security Checks	4/18/2022	12/5/2022	critical
159810	EulerOS 2.0 SP9 : mozjs60 (EulerOS-SA-2022-1452)	Nessus	Huawei Local Security Checks	4/18/2022	12/5/2022	critical
160606	EulerOS Virtualization 2.9.1 : mozjs60 (EulerOS-SA-2022-1609)	Nessus	Huawei Local Security Checks	5/5/2022	12/5/2022	critical

Detections

Analytics

Plugins Search

critical

high

high

high

critical

critical

critical