The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:7184-1 advisory.

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server     administrators (CVE-2022-39249)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

  - Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

  - Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

  - Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

  - Mozilla: Denial of Service via window.print (CVE-2022-42929)

  - Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7070 advisory.

  - A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the     result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox     ESR < 102.4, and Thunderbird < 102.4. (CVE-2022-42927)

  - Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific     state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability     affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (CVE-2022-42928)

  - If a website called `window.print()` in a particular way, it could cause a denial of service of the     browser, which may persist beyond browser restart depending on the user's session restore settings. This     vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (CVE-2022-42929)

  - Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     105 and Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. This vulnerability     affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (CVE-2022-42932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 106.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-44 advisory.

  - Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs     present in Firefox 105. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2022-46885)

  - A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the     result of a redirect, via <code>performance.getEntries()</code>. (CVE-2022-42927)

  - Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific     state, could have lead to memory corruption and a potentially exploitable crash. (CVE-2022-42928)

  - An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a     potentially exploitable crash.<br />Note: This advisory was added on December 13th, 2022 after we better     understood the impact of the issue. The fix was included in the original release of Firefox 106.
    (CVE-2022-46881)

  - If a website called <code>window.print()</code> in a particular way, it could cause a denial of service of     the browser, which may persist beyond browser restart depending on the user's session restore settings.
    (CVE-2022-42929)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 102.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-45 advisory.

  - Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     105 and Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2022-42932)

  - A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the     result of a redirect, via <code>performance.getEntries()</code>. (CVE-2022-42927)

  - Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific     state, could have lead to memory corruption and a potentially exploitable crash. (CVE-2022-42928)

  - If a website called <code>window.print()</code> in a particular way, it could cause a denial of service of     the browser, which may persist beyond browser restart depending on the user's session restore settings.
    (CVE-2022-42929)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3156 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3156-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     October 20, 2022                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : firefox-esr     Version        : 102.4.0esr-1~deb10u1     CVE ID         : CVE-2022-42927 CVE-2022-42928 CVE-2022-42929 CVE-2022-42932

    Multiple security issues have been found in the Mozilla Firefox     web browser, which could potentially result in the execution     of arbitrary code or information disclosure.

    In addition, this update brings back support for the armhf architecture.

    For Debian 10 buster, these problems have been fixed in version     102.4.0esr-1~deb10u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-4980:05 advisory.

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)
      * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)
      * Mozilla: Denial of Service via window.print (CVE-2022-42929)
      * Mozilla: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 (CVE-2022-42932)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
166777	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:7184)	Nessus	Scientific Linux Local Security Checks	11/1/2022	1/4/2023	high
184493	Rocky Linux 8 : firefox (RLSA-2022:7070)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	high
166209	Mozilla Firefox < 106.0	Nessus	Windows	10/18/2022	11/18/2025	high
166211	Mozilla Firefox ESR < 102.4	Nessus	MacOS X Local Security Checks	10/18/2022	11/18/2025	high
166330	Debian dla-3156 : firefox-esr - security update	Nessus	Debian Local Security Checks	10/20/2022	1/22/2025	high
292700	MiracleLinux 9 : firefox-102.4.0-1.el9.ML.1 (AXSA:2023-4980:05)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high