The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5158 advisory.

    Multiple security issues were discovered in Thunderbird, which could result in denial of service or the     execution of arbitrary code. For the oldstable distribution (buster), these problems have been fixed in     version 1:91.10.0-1~deb10u1. For the stable distribution (bullseye), these problems have been fixed in     version 1:91.10.0-1~deb11u1. We recommend that you upgrade your thunderbird packages. For the detailed     security status of thunderbird please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/thunderbird

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4892 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.10.0.

    Security Fix(es):

    * Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email     (CVE-2022-1834)

    * Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)

    * Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738)

    * Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740)

    * Mozilla: Uninitialized variable leads to invalid memory read (CVE-2022-31741)

    * Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10 (CVE-2022-31747)

    * Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-     origin information (CVE-2022-31742)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4873 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.10.0 ESR.

    Security Fix(es):

    * Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)

    * Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738)

    * Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740)

    * Mozilla: Uninitialized variable leads to invalid memory read (CVE-2022-31741)

    * Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10 (CVE-2022-31747)

    * Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-     origin information (CVE-2022-31742)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3742:09 advisory.

    * Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email     (CVE-2022-1834)
      * Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)
      * Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737)
      * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738)
      * Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740)
      * Mozilla: Uninitialized variable leads to invalid memory read (CVE-2022-31741)
      * Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10 (CVE-2022-31747)
      * Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked     cross-origin information (CVE-2022-31742)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4019:18 advisory.

    * Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email     (CVE-2022-1834)
      * Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)
      * Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737)
      * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738)
      * Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740)
      * Mozilla: Uninitialized variable leads to invalid memory read (CVE-2022-31741)
      * Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10 (CVE-2022-31747)
      * Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked     cross-origin information (CVE-2022-31742)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
161961	Debian DSA-5158-1 : thunderbird - security update	Nessus	Debian Local Security Checks	6/8/2022	1/24/2025	critical
161985	RHEL 9 : thunderbird (RHSA-2022:4892)	Nessus	Red Hat Local Security Checks	6/9/2022	11/7/2024	critical
164860	RHEL 9 : firefox (RHSA-2022:4873)	Nessus	Red Hat Local Security Checks	9/8/2022	11/7/2024	critical
291852	MiracleLinux 8 : thunderbird-91.10.0-1.el8.ML.1 (AXSA:2022-3742:09)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical
293648	MiracleLinux 9 : thunderbird-91.10.0-1.el9.ML.1 (AXSA:2022-4019:18)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical