The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1489 advisory.

    [68.7.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [68.7.0-1]
    - Update to 68.7.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 68.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1429 advisory.

    The Mozilla Foundation Security Advisory describes this flaw as:On 32-bit builds, an out of bounds write     could have occurred when processing an image larger than 4 GB inGMPDecodeData. It is possible that with     enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird     < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6822)

    A flaw was found in Mozilla Firefox and Thunderbird. When parsing and validating SCTP chunks in WebRTC a     memory buffer overflow could occur leading to memory corruption and an exploitable crash. The highest     threat from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-6831)

    Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We     are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird <     68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820)

    Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6819)

    The Mozilla Foundation Security Advisory describes this flaw as:Mozilla developers reported memory safety     bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption     and we presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6825)

    The Mozilla Foundation Security Advisory describes this flaw as:The 'Copy as cURL' feature of Devtools'     network tab did not properly escape the HTTP POST data of a request, which can be controlled by the     website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have     resulted in the disclosure of local files. (CVE-2020-12392)

    When reading from areas partially or fully outside the source resource with WebGL'scopyTexSubImagemethod,     the specification requires the returned values be zero. Previously, this memory was uninitialized, leading     to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR <     68.7, and Firefox < 75. (CVE-2020-6821)

    Mozilla: Sender Email Address Spoofing using encoded Unicode characters (CVE-2020-12397)

    Memory safety flaws were found in Mozilla Firefox and Thunderbird. Memory corruption that an attacker     could leverage with enough effort, could allow arbitrary code to run. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-12395)

    A flaw was found in Mozilla Firefox and Thunderbird. When running shutdown code for Web Worker, a race     condition occurs leading to a use-after-free memory flaw that could lead to an exploitable crash. The     highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-12387)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1406 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.7.0 ESR.

    Security Fix(es):

    * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821)

    * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)

    * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1489 advisory.

  - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6819)

  - Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We     are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird <     68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820)

  - When reading from areas partially or fully outside the source resource with WebGL's     <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously,     this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability     affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6821)

  - On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in     <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
    (CVE-2020-6822)

  - Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs     present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6825)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in     <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
    (CVE-2020-6822)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-4711:08 advisory.

    * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821)
      * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)
      * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-4717:09 advisory.

    * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821)
      * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)
      * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
135715	Oracle Linux 7 : thunderbird (ELSA-2020-1489)	Nessus	Oracle Linux Local Security Checks	4/17/2020	10/22/2024	critical
136752	Amazon Linux 2 : thunderbird (ALAS-2020-1429)	Nessus	Amazon Linux Local Security Checks	5/21/2020	12/11/2024	critical
137246	RHEL 8 : firefox (RHSA-2020:1406)	Nessus	Red Hat Local Security Checks	6/9/2020	11/7/2024	critical
136194	CentOS 7 : thunderbird (RHSA-2020:1489)	Nessus	CentOS Local Security Checks	5/1/2020	10/9/2024	critical
246383	Linux Distros Unpatched Vulnerability : CVE-2020-6822	Nessus	Misc.	8/8/2025	8/8/2025	high
291682	MiracleLinux 7 : firefox-68.7.0-2.0.1.el7.AXS7 (AXSA:2020-4711:08)	Nessus	Miracle Linux Local Security Checks	1/19/2026	1/19/2026	critical
294544	MiracleLinux 4 : firefox-68.7.0-2.0.1.AXS4 (AXSA:2020-4717:09)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high

critical

critical