The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5663-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service,

    spoof the mouse pointer position, obtain sensitive information, spoof the contents of the addressbar,     bypass security restrictions, or execute arbitrary code. (CVE-2022-2505, CVE-2022-36318, CVE-2022-36319,     CVE-2022-38472, CVE-2022-38473, CVE-2022-38476 CVE-2022-38477, CVE-2022-38478)

    Multiple security issues were discovered in Thunderbird. An attacker could potentially exploit these in     order to determine when a user opens a specially crafted message. (CVE-2022-3032, CVE-2022-3034)

    It was discovered that Thunderbird did not correctly handle HTML messages that contain a meta tag in some     circumstances. If a user were tricked into replying to a specially crafted message, an attacker could     potentially exploit this to obtain sensitive information. (CVE-2022-3033)

    A security issue was discovered with the Matrix SDK in Thunderbird. An attacker sharing a room with a user     could potentially exploit this to cause a denial of service. (CVE-2022-36059)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 91.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1855 advisory.

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla     developers and the Mozilla Fuzzing Team reporting memory safety bugs in Firefox 102. Some of these bugs     showed evidence of memory corruption, and we presume that with enough effort, some of these could have     been exploited to run arbitrary code. (CVE-2022-2505)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when visiting     directory listings for `chrome://` URLs as source text, some parameters were reflected. (CVE-2022-36318)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when     combining CSS properties for overflow and transform, the mouse cursor could interact with different     coordinates than displayed. (CVE-2022-36319)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker     abusing XSLT error handling to associate attacker-controlled content with another origin, which was     displayed in the address bar. This issue could be used to fool the user into submitting data intended for     the spoofed origin. (CVE-2022-38472)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a cross-     origin iframe referencing an XSLT document inheriting the parent domain's permissions (such as microphone     or camera access). (CVE-2022-38473)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a data race     that could occur in the `PK11_ChangePW` function, potentially leading to a use-after-free vulnerability.
    In Firefox, this lock protected the data when a user changed their master password. (CVE-2022-38476)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla     developer Nika Layzell and the Mozilla Fuzzing Team, reporting memory safety bugs present in Firefox 103     and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption, and we presume that with     enough effort, some of these could have been exploited to run arbitrary code. (CVE-2022-38477)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of members on     the Mozilla Fuzzing Team reporting memory safety bugs present in Firefox 103, Firefox ESR 102.1, and     Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption, and we presume that with     enough effort, some of these could have been exploited to run arbitrary code. (CVE-2022-38478)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 102.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-32 advisory.

  - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2022-2505)

  - When combining CSS properties for overflow and transform, the mouse cursor could interact with different     coordinates than displayed. (CVE-2022-36319)

  - When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected.
    (CVE-2022-36318)

  - When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that     would lead to unexpected network requests from the operating system. This bug only affects Thunderbird for     Windows. Other operating systems are unaffected. (CVE-2022-36314)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-5776 advisory.

    [91.12.0-2.0.1]
    - Remove upstream references [Orabug: 30143292]
    - Update distribution for Oracle Linux [Orabug: 30143292]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file
    - Enabled aarch64 build

    [91.12.0-1]
    - Update to 91.12.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-5767 advisory.

    [91.12.0-2.0.1]
    - Removed Upstream references

    [91.12.0-1]
    - Update to 91.12.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:5767 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5774 advisory.

  - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.1, Firefox <     103, and Thunderbird < 102.1. (CVE-2022-2505)

  - When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This     vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and     Thunderbird < 91.12. (CVE-2022-36318)

  - When combining CSS properties for overflow and transform, the mouse cursor could interact with different     coordinates than displayed. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox <     103, Thunderbird < 102.1, and Thunderbird < 91.12. (CVE-2022-36319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5767 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.12.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has firefox packages installed that are affected by multiple vulnerabilities:

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This     vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2021-4140)

  - crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in     Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in     the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks     are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a     logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are     affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. (CVE-2021-32810)

  - Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14,     and Firefox < 92. (CVE-2021-38493)

  - During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in     memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15,     Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. (CVE-2021-38496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
165820	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Thunderbird vulnerabilities (USN-5663-1)	Nessus	Ubuntu Local Security Checks	10/8/2022	8/27/2024	high
166000	Amazon Linux 2 : thunderbird (ALAS-2022-1855)	Nessus	Amazon Linux Local Security Checks	10/11/2022	12/11/2024	high
163661	Mozilla Thunderbird < 102.1	Nessus	Windows	8/1/2022	11/18/2025	high
163702	Oracle Linux 7 : firefox (ELSA-2022-5776)	Nessus	Oracle Linux Local Security Checks	8/2/2022	10/22/2024	high
163705	Oracle Linux 9 : firefox (ELSA-2022-5767)	Nessus	Oracle Linux Local Security Checks	8/2/2022	10/22/2024	high
167695	AlmaLinux 9 : firefox (ALSA-2022:5767)	Nessus	Alma Linux Local Security Checks	11/16/2022	1/4/2023	high
184932	Rocky Linux 8 : thunderbird (RLSA-2022:5774)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	high
163654	RHEL 9 : firefox (RHSA-2022:5767)	Nessus	Red Hat Local Security Checks	8/1/2022	11/7/2024	high
206859	NewStart CGSL MAIN 6.02 : firefox Multiple Vulnerabilities (NS-SA-2024-0066)	Nessus	NewStart CGSL Local Security Checks	9/10/2024	9/25/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

critical