The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3150 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3138 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3140 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3137 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2211-1 advisory.

  - In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113,     Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32205)

  - An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects     Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32206)

  - A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird <     102.11. (CVE-2023-32207)

  - A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox <     113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32211)

  - An attacker could have positioned a <code>datalist</code> element to obscure the address bar. This     vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32212)

  - When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects     Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32213)

  - Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service.
    *Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability     affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32214)

  - Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian     Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112     and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-3151 advisory.

    [102.11.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
    - Enabled aarch64 build

    [102.11.0-1]
    - Update to 102.11.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 102.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2051 advisory.

    In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. (CVE-2023-32205)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An out-of-bound read could have led to a crash in the RLBox Expat driver. (CVE-2023-32206)

    The Mozilla Foundation Security Advisory describes this flaw as:

    A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. (CVE-2023-32207)

    The Mozilla Foundation Security Advisory describes this flaw as:

    A type checking bug would have led to invalid code being compiled. (CVE-2023-32211)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An attacker could have positioned a `datalist` element to obscure the address bar. (CVE-2023-32212)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When reading a file, an uninitialized value could have been used as read limit. (CVE-2023-32213)

    Mozilla developers and community members reported memory safety bugs present in Firefox 112 and Firefox     ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2023-32215)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-3220 advisory.

    [102.11.0-2.0.1]
    - Updated homepages to use https [Orabug: 34648274]
    - Removed Upstream references
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [102.11.0-2]
    - Update to 102.11.0 build2

    [102.11.0-1]
    - Update to 102.11.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5403 advisory.

    Multiple security issues were discovered in Thunderbird, which could result in denial of service or the     execution of arbitrary code. For the stable distribution (bullseye), these problems have been fixed in     version 1:102.11.0-1~deb11u1. We recommend that you upgrade your thunderbird packages. For the detailed     security status of thunderbird please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/thunderbird

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:3220 advisory.

  - In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks.  (CVE-2023-32205)

  - An out-of-bound read could have led to a crash in the RLBox Expat driver.  (CVE-2023-32206)

  - A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions.  (CVE-2023-32207)

  - A type checking bug would have led to invalid code being compiled.  (CVE-2023-32211)

  - An attacker could have positioned a <code>datalist</code> element to obscure the address bar.
    (CVE-2023-32212)

  - When reading a file, an uninitialized value could have been used as read limit.  (CVE-2023-32213)

  - Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian     Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112     and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code.  (CVE-2023-32215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 102.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-18 advisory.

  - Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian     Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird     102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2023-32215)

  - In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. (CVE-2023-32205)

  - An out-of-bound read could have led to a crash in the RLBox Expat driver. (CVE-2023-32206)

  - A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. (CVE-2023-32207)

  - A type checking bug would have led to invalid code being compiled. (CVE-2023-32211)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202401-10 (Mozilla Firefox: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 113.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-16 advisory.

  - Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2023-32216)

  - In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. (CVE-2023-32205)

  - An out-of-bound read could have led to a crash in the RLBox Expat driver. (CVE-2023-32206)

  - A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. (CVE-2023-32207)

  - Service workers could reveal script base URL due to dynamic <code>import()</code>. (CVE-2023-32208)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
175920	RHEL 9 : thunderbird (RHSA-2023:3150)	Nessus	Red Hat Local Security Checks	5/17/2023	11/7/2024	high
175924	RHEL 8 : firefox (RHSA-2023:3138)	Nessus	Red Hat Local Security Checks	5/17/2023	11/7/2024	high
175936	RHEL 8 : firefox (RHSA-2023:3140)	Nessus	Red Hat Local Security Checks	5/17/2023	11/7/2024	high
175938	RHEL 7 : firefox (RHSA-2023:3137)	Nessus	Red Hat Local Security Checks	5/17/2023	11/7/2024	high
175974	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2023:2211-1)	Nessus	SuSE Local Security Checks	5/17/2023	7/14/2023	high
175978	Oracle Linux 7 : thunderbird (ELSA-2023-3151)	Nessus	Oracle Linux Local Security Checks	5/17/2023	10/22/2024	high
176710	Amazon Linux 2 : thunderbird (ALAS-2023-2051)	Nessus	Amazon Linux Local Security Checks	6/5/2023	12/11/2024	high
176982	Oracle Linux 8 : firefox (ELSA-2023-3220)	Nessus	Oracle Linux Local Security Checks	6/8/2023	9/9/2025	high
175672	Debian DSA-5403-1 : thunderbird - security update	Nessus	Debian Local Security Checks	5/15/2023	1/24/2025	high
176121	AlmaLinux 8 : firefox (ALSA-2023:3220)	Nessus	Alma Linux Local Security Checks	5/19/2023	6/9/2023	high
175371	Mozilla Thunderbird < 102.11	Nessus	Windows	5/10/2023	11/18/2025	high
187727	GLSA-202401-10 : Mozilla Firefox: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	1/9/2024	9/25/2025	critical
175329	Mozilla Firefox < 113.0	Nessus	MacOS X Local Security Checks	5/9/2023	11/18/2025	critical
239048	TencentOS Server 4: firefox (TSSA-2024:0159)	Nessus	Tencent Local Security Checks	6/16/2025	11/23/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

critical

critical

critical