The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:10849 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)

    * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)

    * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and     Thunderbird 128.5 (CVE-2024-11699)

    * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters     (CVE-2024-11695)

    * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:10702 advisory.

    * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)
      * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)
      * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and     Thunderbird 128.5 (CVE-2024-11699)
      * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters     (CVE-2024-11695)
      * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog     (CVE-2024-11697)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:10848 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)

    * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)

    * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and     Thunderbird 128.5 (CVE-2024-11699)

    * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters     (CVE-2024-11695)

    * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:10881 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)

    * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)

    * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and     Thunderbird 128.5 (CVE-2024-11699)

    * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters     (CVE-2024-11695)

    * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4074-1 advisory.

    Firefox Extended Support Release 128.5.0 ESR, fixed various security fixes     and other quality improvements, MFSA 2024-64 (bsc#1233695):

    * CVE-2024-11691: Memory corruption in Apple GPU drivers
    * CVE-2024-11692: Select list elements could be shown over another site
    * CVE-2024-11693: Download Protections were bypassed by .library-ms files on Windows
    * CVE-2024-11694: CSP Bypass and XSS Exposure via Web Compatibility Shims
    * CVE-2024-11695: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters
    * CVE-2024-11696: Unhandled Exception in Add-on Signature Verification
    * CVE-2024-11697: Inproper Keypress Handling in Executable File Confirmation Dialog
    * CVE-2024-11698: Fullscreen Lock-Up When Modal Dialog Interrupts Transition on macOS
    * CVE-2024-11699: Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5, and Thunderbird 128.5

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202505-03 (Mozilla Thunderbird: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 115.18. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-70 advisory.

  - Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and     DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have     exposed users to malicious frames masquerading as legitimate content. (CVE-2024-11694)

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 115.18. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-70 advisory.

  - Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and     DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have     exposed users to malicious frames masquerading as legitimate content. (CVE-2024-11694)

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7193-1 advisory.

    Masato Kinugawa discovered that Thunderbird did not properly validate the CSP policy in the Web     Compatibility extension. An attacker could potentially exploit this issue to perform a cross-site     scripting attack.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
212088	RHEL 8 : firefox (RHSA-2024:10849)	Nessus	Red Hat Local Security Checks	12/5/2024	12/5/2024	high
212095	AlmaLinux 9 : firefox (ALSA-2024:10702)	Nessus	Alma Linux Local Security Checks	12/5/2024	12/5/2024	high
212121	RHEL 8 : firefox (RHSA-2024:10848)	Nessus	Red Hat Local Security Checks	12/6/2024	12/6/2024	high
212172	RHEL 7 : firefox (RHSA-2024:10881)	Nessus	Red Hat Local Security Checks	12/9/2024	12/9/2024	high
212532	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2024:4074-1)	Nessus	SuSE Local Security Checks	12/12/2024	12/12/2024	critical
235704	GLSA-202505-03 : Mozilla Thunderbird: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	5/12/2025	5/12/2025	medium
213009	Mozilla Thunderbird < 115.18	Nessus	Windows	12/13/2024	1/17/2025	high
213010	Mozilla Thunderbird < 115.18	Nessus	MacOS X Local Security Checks	12/13/2024	1/17/2025	high
213601	Ubuntu 20.04 LTS / 22.04 LTS : Thunderbird vulnerability (USN-7193-1)	Nessus	Ubuntu Local Security Checks	1/9/2025	1/17/2025	medium

Detections

Analytics

Plugins Search

high

high

high

high

critical

medium

high

high

medium