The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-bbb8d72c6f advisory.

    This update provides the latest release of Firefox, with an important security fix. We highly recommend     you install this update immediately and restart all Firefox instances.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 115.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-43 advisory.

  - A compromised content process could have provided malicious data to <code>FilterNodeD2D1</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5168)

  - A compromised content process could have provided malicious data in a <code>PathRecording</code> resulting     in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
    (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. (CVE-2023-5171)

  - If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently     freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only     affects Firefox on Windows when run in non-standard configurations (such as using <code>runas</code>).
    Other operating systems are unaffected. (CVE-2023-5174)

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7a4026e363 advisory.

    - Updated to latest upstream (118.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-5433 advisory.

    [115.3.1-1.0.1]
    - Update to 115.3.1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6405-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute     arbitrary code. (CVE-2023-4057, CVE-2023-4577, CVE-2023-4578, CVE-2023-4583, CVE-2023-4585, CVE-2023-5169,     CVE-2023-5171, CVE-2023-5176)

    Andrew McCreight discovered that Thunderbird did not properly manage during the worker lifecycle. An     attacker could potentially exploit this issue to cause a denial of service. (CVE-2023-3600)

    Harveer Singh discovered that Thunderbird did not store push notifications in private browsing mode in     encrypted form. An attacker could potentially exploit this issue to obtain sensitive information.
    (CVE-2023-4580)

    Clment Lecigne discovered that Thunderbird did not properly manage memory when handling VP8 media     stream. An attacker-controlled VP8 media stream could lead to a heap buffer overflow in the content     process, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-5217)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
185324	Fedora 39 : firefox (2023-bbb8d72c6f)	Nessus	Fedora Local Security Checks	11/7/2023	11/14/2024	high
181881	Mozilla Thunderbird < 115.3	Nessus	Windows	9/26/2023	10/6/2023	critical
182395	Fedora 37 : firefox (2023-7a4026e363)	Nessus	Fedora Local Security Checks	9/30/2023	11/14/2024	critical
182737	Oracle Linux 8 : firefox (ELSA-2023-5433)	Nessus	Oracle Linux Local Security Checks	10/6/2023	9/9/2025	critical
182432	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Thunderbird vulnerabilities (USN-6405-1)	Nessus	Ubuntu Local Security Checks	10/3/2023	8/27/2024	critical
190759	GLSA-202402-25 : Mozilla Thunderbird: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2/20/2024	2/20/2024	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical

critical

critical