The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0938-1 advisory.

  - Use after free in BFCache in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30544)

  - Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30545)

  - Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-30546)

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

  - Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30548)

  - Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30549)

  - Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced     a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30550)

  - Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30551)

  - Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30552)

  - Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-30553)

  - Use after free in WebGL. (CVE-2021-30554)

  - Use after free in Sharing. (CVE-2021-30555)

  - Use after free in WebAudio. (CVE-2021-30556)

  - Use after free in TabGroups. (CVE-2021-30557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 90.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-28 advisory.

  - If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host
    - irrespective of scheme or port - would be granted that permission. This bug only affects Firefox for     Android. Other operating systems are unaffected. (CVE-2021-29971)

  - A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially     exploitable crash.  This bug only affected Firefox when accessibility was enabled. (CVE-2021-29970)

  - An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially     exploitable crash. (CVE-2021-30547)

  - A user-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library.
    Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilities     as well. (CVE-2021-29972)

  - Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This     was corrected to require user interaction with the page before a user's password would be entered by the     browser's autofill functionality. This bug only affects Firefox for Android. Other operating systems are     unaffected. (CVE-2021-29973)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2709 advisory.

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 / SLES_SAP11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14766-1 advisory.

  - A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially     exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability     affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29970)

  - Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12,     Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29976)

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4940 advisory.

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2711 advisory.

    Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary     code. CVE-2021-30547 Description For Debian 9 stretch, these problems have been fixed in version     1:78.12.0-1~deb9u1. We recommend that you upgrade your thunderbird packages. For the detailed security     status of thunderbird please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/thunderbird Further information about Debian LTS security advisories, how to     apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2883 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 78.12.0.

    Security Fix(es):

    * Mozilla: IMAP server responses sent by a MITM prior to STARTTLS could be processed (CVE-2021-29969)

    * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970)

    * Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976)

    * chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:2883 advisory.

  - Mozilla: IMAP server responses sent by a MITM prior to STARTTLS could be processed (CVE-2021-29969)

  - Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970)

  - Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976)

  - chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2883 advisory.

  - If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server     responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected     data. This could have resulted in Thunderbird showing incorrect information, for example the attacker     could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability     affects Thunderbird < 78.12. (CVE-2021-29969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
151198	openSUSE 15 Security Update : chromium (openSUSE-SU-2021:0938-1)	Nessus	SuSE Local Security Checks	7/1/2021	1/18/2022	high
151571	Mozilla Firefox < 90.0	Nessus	Windows	7/13/2021	11/18/2025	critical
151677	Debian DLA-2709-1 : firefox-esr - LTS security update	Nessus	Debian Local Security Checks	7/15/2021	12/8/2023	high
151803	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2021:14766-1)	Nessus	SuSE Local Security Checks	7/17/2021	7/13/2023	high
151807	Debian DSA-4940-1 : thunderbird - security update	Nessus	Debian Local Security Checks	7/18/2021	12/7/2023	high
151812	Debian DLA-2711-1 : thunderbird - LTS security update	Nessus	Debian Local Security Checks	7/19/2021	1/24/2025	high
152076	RHEL 8 : thunderbird (RHSA-2021:2883)	Nessus	Red Hat Local Security Checks	7/26/2021	11/7/2024	high
152168	CentOS 8 : thunderbird (CESA-2021:2883)	Nessus	CentOS Local Security Checks	8/1/2021	12/6/2023	high
157838	Rocky Linux 8 : thunderbird (RLSA-2021:2883)	Nessus	Rocky Linux Local Security Checks	2/9/2022	11/6/2023	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high

high

high

high