The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1310 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 60.7.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)

    * Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)

    * Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)

    * Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)

    * Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)

    * Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)

    * Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)

    * Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)

    * mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)

    * chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

    * Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks     (CVE-2019-11698)

    * libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Mozilla: Memory safety bugs fixed in Firefox 67 and     Firefox ESR 60.7 (CVE-2019-9800)

  - Mozilla: Cross-origin theft of images with     createImageBitmap (CVE-2019-9797)

  - Mozilla: Stealing of cross-domain images using canvas     (CVE-2019-9817)

  - Mozilla: Compartment mismatch with fetch API     (CVE-2019-9819)

  - Mozilla: Use-after-free of ChromeEventHandler by     DocShell (CVE-2019-9820)

  - Mozilla: Use-after-free in XMLHttpRequest     (CVE-2019-11691)

  - Mozilla: Use-after-free removing listeners in the event     listener manager (CVE-2019-11692)

  - Mozilla: Buffer overflow in WebGL bufferdata on Linux     (CVE-2019-11693)

  - mozilla: Cross-origin theft of images with     ImageBitmapRenderingContext (CVE-2018-18511)

  - chromium-browser: Out of bounds read in Skia     (CVE-2019-5798)

  - Mozilla: Theft of user history data through drag and     drop of hyperlinks to and from bookmarks     (CVE-2019-11698)

  - libpng: use-after-free in png_image_free in png.c     (CVE-2019-7317)

This update for MozillaFirefox fixes the following issues :

MozillaFirefox was updated to 60.7.0esr (boo#1135824 MFSA 2019-14) :

  - CVE-2018-18511: Cross-origin theft of images with     ImageBitmapRenderingContext

  - CVE-2019-11691: Use-after-free in XMLHttpRequest

  - CVE-2019-11692: Use-after-free removing listeners in the     event listener manager

  - CVE-2019-11693: Buffer overflow in WebGL bufferdata on     Linux

  - CVE-2019-11694: (Windows only) Uninitialized memory     memory leakage in Windows sandbox

  - CVE-2019-11698: Theft of user history data through drag     and drop of hyperlinks to and from bookmarks

  - CVE-2019-5798: Out-of-bounds read in Skia

  - CVE-2019-7317: Use-after-free in png_image_free of     libpng library

  - CVE-2019-9797: Cross-origin theft of images with     createImageBitmap

  - CVE-2019-9800: Memory safety bugs fixed in Firefox 67     and Firefox ESR 60.7

  - CVE-2019-9815: Disable hyperthreading on content     JavaScript threads on macOS

  - CVE-2019-9816: Type confusion with object groups and     UnboxedObjects

  - CVE-2019-9817: Stealing of cross-domain images using     canvas

  - CVE-2019-9818: (Windows only) Use-after-free in crash     generation server

  - CVE-2019-9819: Compartment mismatch with fetch API

  - CVE-2019-9820: Use-after-free of ChromeEventHandler by     DocShell

  - CVE-2019-9821: Use-after-free in AssertWorkerThread

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-1308 advisory.

    [60.7.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [60.7.0-1]
    - Update to 60.7.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1269 advisory.

  - mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)

  - Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)

  - Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)

  - Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)

  - Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks     (CVE-2019-11698)

  - chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

  - libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

  - Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)

  - Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)

  - Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)

  - Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)

  - Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)

  - Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
125692	RHEL 6 : thunderbird (RHSA-2019:1310)	Nessus	Red Hat Local Security Checks	6/4/2019	11/6/2024	critical
125716	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190604)	Nessus	Scientific Linux Local Security Checks	6/5/2019	5/17/2024	critical
125809	openSUSE Security Update : MozillaFirefox (openSUSE-2019-1534)	Nessus	SuSE Local Security Checks	6/11/2019	5/16/2024	critical
127589	Oracle Linux 8 : thunderbird (ELSA-2019-1308)	Nessus	Oracle Linux Local Security Checks	8/12/2019	10/22/2024	critical
145688	CentOS 8 : firefox (CESA-2019:1269)	Nessus	CentOS Local Security Checks	1/29/2021	12/5/2022	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical