The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4050-1 advisory.

    - Mozilla Thunderbird 128.4.3
      * fixed: Folder corruption could cause Thunderbird to freeze         and become unusable
      * fixed: Message corruption could be propagated when reading mbox
      * fixed: Folder compaction was not abandoned on shutdown
      * fixed: Folder compaction did not clean up on failure
      * fixed: Collapsed NNTP thread incorrectly indicated there were         unread messages
      * fixed: Navigating to next unread message did not wait for all         messages to be loaded
      * fixed: Applying column view to folder and children could         break if folder error occurred
      * fixed: Remote content notifications were broken with         encrypted messages
      * fixed: Updating criteria of a saved search resulted in poor         search performance
      * fixed: Drop-downs may not work in some places
      * fixed: Security fixes       MFSA 2024-61 (bsc#1233355)
      * CVE-2024-11159 Potential disclosure of plaintext in OpenPGP encrypted message

    - Mozilla Thunderbird 128.4.2
      * changed: Increased the auto-compaction threshold to reduce         frequency of compaction
      * fixed: New profile creation caused console errors
      * fixed: Repair folder could result in older messages showing         wrong date and time
      * fixed: Recently deleted messages could become undeleted if         message compaction failed
      * fixed: Visual and UX improvements
      * fixed: Clicking on an HTML button could cause Thunderbird to freeze
      * fixed: Messages could not be selected for dragging
      * fixed: Could not open attached file in a MIME encrypted message
      * fixed: Account creation 'Setup Documentation' link was broken
      * fixed: Unable to generate QR codes when exporting to mobile         in some cases
      * fixed: Operating system reauthentication was missing when         exporting QR codes for mobile
      * fixed: Could not drag all-day events from one day to another         in week view

    - Mozilla Thunderbird 128.4.1
      * new: Add the 20 year donation appeal

    - Mozilla Thunderbird 128.4
      * new: Export Thunderbird account settings to Thunderbird         Mobile via QRCode
      * fixed: Unable to send an unencrypted response to an OpenPGP         encrypted message
      * fixed: Thunderbird update did not update language pack         version until another restart
      * fixed: Security fixes       MFSA 2024-58 (bsc#1231879)
      * CVE-2024-10458 Permission leak via embed or object elements
      * CVE-2024-10459 Use-after-free in layout with accessibility
      * CVE-2024-10460 Confusing display of origin for external protocol handler prompt
      * CVE-2024-10461 XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response
      * CVE-2024-10462 Origin of permission prompt could be spoofed by long URL
      * CVE-2024-10463 Cross origin video frame leak
      * CVE-2024-10464 History interface could have been used to cause a Denial of Service condition in the     browser
      * CVE-2024-10465 Clipboard 'paste' button persisted across tabs
      * CVE-2024-10466 DOM push subscription message could hang Firefox
      * CVE-2024-10467 Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and     Thunderbird 128.4

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-9552 advisory.

    [128.4.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079813]
    - Add Oracle prefs

    [128.4.0]
    - Add OpenELA debranding

    [128.4.0-1]
    - Update to 128.4.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 132.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-55 advisory.

  - A permission leak could have occurred from a trusted site to an untrusted site via <code>embed</code> or     <code>object</code> elements. (CVE-2024-10458)

  - An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially     exploitable crash. (CVE-2024-10459)

  - The origin of an external protocol handler prompt could have been obscured using a data: URL within an     <code>iframe</code>. (CVE-2024-10460)

  - In multipart/x-mixed-replace responses, <code>Content-Disposition: attachment</code> in the response     header was not respected and did not force a download, which could allow XSS attacks. (CVE-2024-10461)

  - Truncation of a long URL could have allowed origin spoofing in a permission prompt. (CVE-2024-10462)

  - Video frames could have been leaked between origins in some situations. (CVE-2024-10463)

  - Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially     exploitable crash. (CVE-2024-10468)

  - Repeated writes to history interface attributes could have been used to cause a Denial of Service     condition in the browser. This was addressed by introducing rate-limiting to this API. (CVE-2024-10464)

  - A clipboard paste button could persist across tabs which allowed a spoofing attack. (CVE-2024-10465)

  - By sending a specially crafted push message, a remote server could have hung the parent process, causing     the browser to become unresponsive. (CVE-2024-10466)

  - Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2024-10467)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 132.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-59 advisory.

  - A permission leak could have occurred from a trusted site to an untrusted site via <code>embed</code> or     <code>object</code> elements. (CVE-2024-10458)

  - An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially     exploitable crash. (CVE-2024-10459)

  - The origin of an external protocol handler prompt could have been obscured using a data: URL within an     <code>iframe</code>. (CVE-2024-10460)

  - In multipart/x-mixed-replace responses, <code>Content-Disposition: attachment</code> in the response     header was not respected and did not force a download, which could allow XSS attacks. (CVE-2024-10461)

  - Truncation of a long URL could have allowed origin spoofing in a permission prompt. (CVE-2024-10462)

  - Video frames could have been leaked between origins in some situations. (CVE-2024-10463)

  - Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially     exploitable crash. (CVE-2024-10468)

  - Repeated writes to history interface attributes could have been used to cause a Denial of Service     condition in the browser. This was addressed by introducing rate-limiting to this API. (CVE-2024-10464)

  - A clipboard paste button could persist across tabs which allowed a spoofing attack. (CVE-2024-10465)

  - By sending a specially crafted push message, a remote server could have hung the parent process, causing     the browser to become unresponsive. (CVE-2024-10466)

  - Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2024-10467)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-56 advisory.

  - A permission leak could have occurred from a trusted site to an untrusted site via <code>embed</code> or     <code>object</code> elements. (CVE-2024-10458)

  - An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially     exploitable crash. (CVE-2024-10459)

  - The origin of an external protocol handler prompt could have been obscured using a data: URL within an     <code>iframe</code>. (CVE-2024-10460)

  - In multipart/x-mixed-replace responses, <code>Content-Disposition: attachment</code> in the response     header was not respected and did not force a download, which could allow XSS attacks. (CVE-2024-10461)

  - Truncation of a long URL could have allowed origin spoofing in a permission prompt. (CVE-2024-10462)

  - Video frames could have been leaked between origins in some situations. (CVE-2024-10463)

  - Repeated writes to history interface attributes could have been used to cause a Denial of Service     condition in the browser. This was addressed by introducing rate-limiting to this API. (CVE-2024-10464)

  - A clipboard paste button could persist across tabs which allowed a spoofing attack. (CVE-2024-10465)

  - By sending a specially crafted push message, a remote server could have hung the parent process, causing     the browser to become unresponsive. (CVE-2024-10466)

  - Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2024-10467)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of mozilla-thunderbird installed on the remote host is prior to 128.4.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-304-03 advisory.

    New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-thunderbird security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:8725 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in     the browser (CVE-2024-10464)

    * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response     (CVE-2024-10461)

    * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)

    * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and     Thunderbird 128.4 (CVE-2024-10467)

    * firefox: thunderbird: Clipboard paste button persisted across tabs (CVE-2024-10465)

    * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)

    * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)

    * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)

    * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:8722 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in     the browser (CVE-2024-10464)

    * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response     (CVE-2024-10461)

    * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)

    * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and     Thunderbird 128.4 (CVE-2024-10467)

    * firefox: thunderbird: Clipboard paste button persisted across tabs (CVE-2024-10465)

    * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)

    * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)

    * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)

    * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:8729 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in     the browser (CVE-2024-10464)

    * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response     (CVE-2024-10461)

    * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)

    * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and     Thunderbird 128.4 (CVE-2024-10467)

    * firefox: thunderbird: Clipboard paste button persisted across tabs (CVE-2024-10465)

    * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)

    * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)

    * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)

    * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:8729 advisory.

    * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in     the browser (CVE-2024-10464)
      * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace     response (CVE-2024-10461)
      * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
      * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and     Thunderbird 128.4 (CVE-2024-10467)
      * firefox: thunderbird: Clipboard paste button persisted across tabs (CVE-2024-10465)
      * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)
      * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)
      * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)
      * firefox: thunderbird: Confusing display of origin for external protocol handler prompt     (CVE-2024-10460)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-8793 advisory.

    [128.4.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079813]
    - Add Oracle prefs

    [128.4.0]
    - Add OpenELA debranding

    [128.4.0-1]
    - Update to 128.4.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-8790 advisory.

    [128.4.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079820]
    - Add Oracle prefs file

    [128.4.0]
    - Add OpenELA debranding

    [128.4.0-1]
    - Update to 128.4.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:8790 advisory.

    * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in     the browser (CVE-2024-10464)
      * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace     response (CVE-2024-10461)
      * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
      * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and     Thunderbird 128.4 (CVE-2024-10467)
      * firefox: thunderbird: Clipboard paste button persisted across tabs (CVE-2024-10465)
      * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)
      * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)
      * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)
      * firefox: thunderbird: Confusing display of origin for external protocol handler prompt     (CVE-2024-10460)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9018 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in     the browser (CVE-2024-10464)

    * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response     (CVE-2024-10461)

    * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)

    * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and     Thunderbird 128.4 (CVE-2024-10467)

    * firefox: thunderbird: Clipboard paste button persisted across tabs (CVE-2024-10465)

    * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)

    * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)

    * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)

    * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
212584	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2024:4050-1)	Nessus	SuSE Local Security Checks	12/12/2024	12/12/2024	high
211614	Oracle Linux 9 : thunderbird (ELSA-2024-9552)	Nessus	Oracle Linux Local Security Checks	11/19/2024	12/6/2024	critical
209863	Mozilla Firefox < 132.0	Nessus	Windows	10/29/2024	12/6/2024	high
209865	Mozilla Thunderbird < 132.0	Nessus	Windows	10/29/2024	11/5/2024	high
209869	Mozilla Firefox ESR < 128.4	Nessus	MacOS X Local Security Checks	10/29/2024	12/6/2024	high
209918	Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2024-304-03)	Nessus	Slackware Local Security Checks	10/30/2024	11/5/2024	high
210024	RHEL 8 : firefox (RHSA-2024:8725)	Nessus	Red Hat Local Security Checks	11/1/2024	11/5/2024	high
210027	RHEL 8 : firefox (RHSA-2024:8722)	Nessus	Red Hat Local Security Checks	11/1/2024	11/5/2024	high
210032	RHEL 8 : firefox (RHSA-2024:8729)	Nessus	Red Hat Local Security Checks	11/1/2024	11/5/2024	high
210141	AlmaLinux 8 : firefox (ALSA-2024:8729)	Nessus	Alma Linux Local Security Checks	11/4/2024	11/5/2024	high
210230	Oracle Linux 9 : thunderbird (ELSA-2024-8793)	Nessus	Oracle Linux Local Security Checks	11/4/2024	12/6/2024	high
210233	Oracle Linux 8 : thunderbird (ELSA-2024-8790)	Nessus	Oracle Linux Local Security Checks	11/4/2024	12/6/2024	high
210270	AlmaLinux 8 : thunderbird (ALSA-2024:8790)	Nessus	Alma Linux Local Security Checks	11/5/2024	11/5/2024	high
210562	RHEL 8 : thunderbird (RHSA-2024:9018)	Nessus	Red Hat Local Security Checks	11/8/2024	11/8/2024	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high

high

high

high

high

high

high

high

high