The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2478-1 advisory.

  - A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially     exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability     affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29970)

  - Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12,     Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29976)

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-2225:16 advisory.

    * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970)
      * Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976)
      * chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2742 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 78.12.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970)

    * Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976)

    * chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5011-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, overlay text     over another domain, or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2881 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 78.12.0.

    Security Fix(es):

    * Mozilla: IMAP server responses sent by a MITM prior to STARTTLS could be processed (CVE-2021-29969)

    * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970)

    * Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976)

    * chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2914 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 78.12.0.

    Security Fix(es):

    * Mozilla: IMAP server responses sent by a MITM prior to STARTTLS could be processed (CVE-2021-29969)

    * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970)

    * Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976)

    * chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1091-1 advisory.

  - If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server     responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected     data. This could have resulted in Thunderbird showing incorrect information, for example the attacker     could have tricked Thunderbird to show folders that didn't exist on the IMAP server.  (CVE-2021-29969)

  - A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially     exploitable crash. This bug only affected Firefox when accessibility was enabled.  (CVE-2021-29970)

  - Mozilla developers Emil Ghitta, Tyson Smith, Valentin Gosu, Olli Pettay, and Randell Jesup reported memory     safety bugs present in Firefox 89 and Firefox ESR 78.11. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code.  (CVE-2021-29976)

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5058-1 advisory.

    It was discovered that Thunderbird didn't ignore IMAP server responses prior to completion of the STARTTLS     handshake. A person-in-the-middle could potentially exploit this to trick Thunderbird into showing     incorrect information. (CVE-2021-29969)

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, or execute arbitrary code. (CVE-2021-29970, CVE-2021-29976, CVE-2021-29980, CVE-2021-29984,     CVE-2021-29985, CVE-2021-29986, CVE-2021-29988, CVE-2021-29989, CVE-2021-30547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release contains 14 security fixes, including :

- [1212618] Critical CVE-2021-30544: Use after free in BFCache.
Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-05-24

- [1201031] High CVE-2021-30545: Use after free in Extensions.
Reported by kkwon with everpall and kkomdal on 2021-04-21

- [1206911] High CVE-2021-30546: Use after free in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-05-08

- [1210414] High CVE-2021-30547: Out of bounds write in ANGLE.
Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on 2021-05-18

- [1210487] High CVE-2021-30548: Use after free in Loader. Reported by Yangkang(@dnpushme) & Wanglu of Qihoo360 Qex Team on 2021-05-18

- [1212498] High CVE-2021-30549: Use after free in Spell check.
Reported by David Erceg on 2021-05-23

- [1212500] High CVE-2021-30550: Use after free in Accessibility.
Reported by David Erceg on 2021-05-23

- [1216437] High CVE-2021-30551: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-06-04

- [1200679] Medium CVE-2021-30552: Use after free in Extensions.
Reported by David Erceg on 2021-04-20

- [1209769] Medium CVE-2021-30553: Use after free in Network service.
Reported by Anonymous on 2021-05-17

Google is aware that an exploit for CVE-2021-30551 exists in the wild.

ID	Name	Product	Family	Published	Updated	Severity
152113	SUSE SLES15 Security Update : MozillaFirefox (SUSE-SU-2021:2478-1)	Nessus	SuSE Local Security Checks	7/28/2021	7/13/2023	high
294564	MiracleLinux 7 : firefox-78.12.0-1.0.1.el7.AXS7 (AXSA:2021-2225:16)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
151668	RHEL 8 : firefox (RHSA-2021:2742)	Nessus	Red Hat Local Security Checks	7/15/2021	11/7/2024	high
151800	Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5011-1)	Nessus	Ubuntu Local Security Checks	7/16/2021	8/27/2024	high
152074	RHEL 7 : thunderbird (RHSA-2021:2881)	Nessus	Red Hat Local Security Checks	7/26/2021	11/7/2024	high
152097	RHEL 8 : thunderbird (RHSA-2021:2914)	Nessus	Red Hat Local Security Checks	7/27/2021	11/7/2024	high
152219	openSUSE 15 Security Update : MozillaThunderbird (openSUSE-SU-2021:1091-1)	Nessus	SuSE Local Security Checks	8/5/2021	12/6/2023	high
152953	Ubuntu 18.04 LTS / 20.04 LTS : Thunderbird vulnerabilities (USN-5058-1)	Nessus	Ubuntu Local Security Checks	9/1/2021	8/27/2024	high
150702	FreeBSD : chromium -- multiple vulnerabilities (20b3ab21-c9df-11eb-8558-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	6/11/2021	11/30/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high