The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5235 advisory.

    [78.5.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [78.5.0-1]
    - Update to 78.5.0 build3

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5239 advisory.

    [78.5.0-1.0.1]
    - Remove upstream references [Orabug: 30143292]
    - Update distribution for Oracle Linux [Orabug: 30143292]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [78.5.0-1]
    - Update to 78.5.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202012-03 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5257 advisory.

    [78.5.0-1.0.1]
    - Fix LD_LIBRARY_PATH
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one

    [78.5.0-1]
    - Update to 78.5.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5237 advisory.

    [78.5.0-1.0.1]
    - Removed Upstream references
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [78.5.0-1]
    - Update to 78.5.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

  - Firefox Extended Support Release 78.5.0 ESR     (bsc#1178824)

  - CVE-2020-26951: Parsing mismatches could confuse and     bypass security sanitizer for chrome privileged code

  - CVE-2020-16012: Variable time processing of cross-origin     images during drawImage calls

  - CVE-2020-26953: Fullscreen could be enabled without     displaying the security UI

  - CVE-2020-26956: XSS through paste (manual and clipboard     API)

  - CVE-2020-26958: Requests intercepted through     ServiceWorkers lacked MIME type restrictions

  - CVE-2020-26959: Use-after-free in WebRequestService

  - CVE-2020-26960: Potential use-after-free in uses of     nsTArray

  - CVE-2020-15999: Heap buffer overflow in freetype

  - CVE-2020-26961: DoH did not filter IPv4 mapped IP     Addresses

  - CVE-2020-26965: Software keyboards may have remembered     typed passwords

  - CVE-2020-26966: Single-word search queries were also     broadcast to local network

  - CVE-2020-26968: Memory safety bugs fixed in Firefox 83     and Firefox ESR 78.5

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5257 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 78.5.0 ESR.

    Security Fix(es):

    * Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code     (CVE-2020-26951)

    * Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 (CVE-2020-26968)

    * Mozilla: Variable time processing of cross-origin images during drawImage calls (CVE-2020-16012)

    * Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

    * Mozilla: XSS through paste (manual and clipboard API) (CVE-2020-26956)

    * Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions (CVE-2020-26958)

    * Mozilla: Use-after-free in WebRequestService (CVE-2020-26959)

    * Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

    * Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

    * Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)

  - CVE-2020-26951: Parsing mismatches could confuse and     bypass security sanitizer for chrome privileged code

  - CVE-2020-16012: Variable time processing of cross-origin     images during drawImage calls

  - CVE-2020-26953: Fullscreen could be enabled without     displaying the security UI

  - CVE-2020-26956: XSS through paste (manual and clipboard     API)

  - CVE-2020-26958: Requests intercepted through     ServiceWorkers lacked MIME type restrictions

  - CVE-2020-26959: Use-after-free in WebRequestService

  - CVE-2020-26960: Potential use-after-free in uses of     nsTArray

  - CVE-2020-15999: Heap buffer overflow in freetype

  - CVE-2020-26961: DoH did not filter IPv4 mapped IP     Addresses

  - CVE-2020-26965: Software keyboards may have remembered     typed passwords

  - CVE-2020-26966: Single-word search queries were also     broadcast to local network

  - CVE-2020-26968: Memory safety bugs fixed in Firefox 83     and Firefox ESR 78.5

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
143368	Oracle Linux 7 : thunderbird (ELSA-2020-5235)	Nessus	Oracle Linux Local Security Checks	11/30/2020	10/22/2024	high
143378	Oracle Linux 7 : firefox (ELSA-2020-5239)	Nessus	Oracle Linux Local Security Checks	12/1/2020	10/23/2024	high
143494	GLSA-202012-03 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/7/2020	2/7/2024	high
146200	Oracle Linux 6 : firefox (ELSA-2020-5257)	Nessus	Oracle Linux Local Security Checks	2/4/2021	10/22/2024	high
143377	Oracle Linux 8 : firefox (ELSA-2020-5237)	Nessus	Oracle Linux Local Security Checks	12/1/2020	10/23/2024	high
143340	openSUSE Security Update : MozillaFirefox (openSUSE-2020-2031)	Nessus	SuSE Local Security Checks	11/30/2020	2/6/2025	critical
143366	RHEL 6 : firefox (RHSA-2020:5257)	Nessus	Red Hat Local Security Checks	11/30/2020	11/7/2024	high
143741	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:3548-1)	Nessus	SuSE Local Security Checks	12/9/2020	2/6/2025	critical
145368	openSUSE Security Update : MozillaFirefox (openSUSE-2020-2315)	Nessus	SuSE Local Security Checks	1/25/2021	2/6/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high

critical

critical