The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2914 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 78.12.0.

    Security Fix(es):

    * Mozilla: IMAP server responses sent by a MITM prior to STARTTLS could be processed (CVE-2021-29969)

    * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970)

    * Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976)

    * chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5058-1 advisory.

    It was discovered that Thunderbird didn't ignore IMAP server responses prior to completion of the STARTTLS     handshake. A person-in-the-middle could potentially exploit this to trick Thunderbird into showing     incorrect information. (CVE-2021-29969)

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, or execute arbitrary code. (CVE-2021-29970, CVE-2021-29976, CVE-2021-29980, CVE-2021-29984,     CVE-2021-29985, CVE-2021-29986, CVE-2021-29988, CVE-2021-29989, CVE-2021-30547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release contains 14 security fixes, including :

- [1212618] Critical CVE-2021-30544: Use after free in BFCache.
Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-05-24

- [1201031] High CVE-2021-30545: Use after free in Extensions.
Reported by kkwon with everpall and kkomdal on 2021-04-21

- [1206911] High CVE-2021-30546: Use after free in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-05-08

- [1210414] High CVE-2021-30547: Out of bounds write in ANGLE.
Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on 2021-05-18

- [1210487] High CVE-2021-30548: Use after free in Loader. Reported by Yangkang(@dnpushme) & Wanglu of Qihoo360 Qex Team on 2021-05-18

- [1212498] High CVE-2021-30549: Use after free in Spell check.
Reported by David Erceg on 2021-05-23

- [1212500] High CVE-2021-30550: Use after free in Accessibility.
Reported by David Erceg on 2021-05-23

- [1216437] High CVE-2021-30551: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-06-04

- [1200679] Medium CVE-2021-30552: Use after free in Extensions.
Reported by David Erceg on 2021-04-20

- [1209769] Medium CVE-2021-30553: Use after free in Network service.
Reported by Anonymous on 2021-05-17

Google is aware that an exploit for CVE-2021-30551 exists in the wild.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0938-1 advisory.

  - Use after free in BFCache in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30544)

  - Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30545)

  - Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-30546)

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

  - Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30548)

  - Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30549)

  - Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced     a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30550)

  - Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30551)

  - Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30552)

  - Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-30553)

  - Use after free in WebGL. (CVE-2021-30554)

  - Use after free in Sharing. (CVE-2021-30555)

  - Use after free in WebAudio. (CVE-2021-30556)

  - Use after free in TabGroups. (CVE-2021-30557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
152097	RHEL 8 : thunderbird (RHSA-2021:2914)	Nessus	Red Hat Local Security Checks	7/27/2021	11/7/2024	high
152953	Ubuntu 18.04 LTS / 20.04 LTS : Thunderbird vulnerabilities (USN-5058-1)	Nessus	Ubuntu Local Security Checks	9/1/2021	8/27/2024	high
150702	FreeBSD : chromium -- multiple vulnerabilities (20b3ab21-c9df-11eb-8558-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	6/11/2021	11/30/2021	high
151198	openSUSE 15 Security Update : chromium (openSUSE-SU-2021:0938-1)	Nessus	SuSE Local Security Checks	7/1/2021	1/18/2022	high

Detections

Analytics

Plugins Search

high

high

high

high