The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4086-1 advisory.

    Firefox Extended Support Release 128.5.0 ESR, fixed various security fixes     and other quality improvements, MFSA 2024-64 (bsc#1233695):

    * CVE-2024-11691: Memory corruption in Apple GPU drivers
    * CVE-2024-11692: Select list elements could be shown over another site
    * CVE-2024-11693: Download Protections were bypassed by .library-ms files on Windows
    * CVE-2024-11694: CSP Bypass and XSS Exposure via Web Compatibility Shims
    * CVE-2024-11695: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters
    * CVE-2024-11696: Unhandled Exception in Add-on Signature Verification
    * CVE-2024-11697: Inproper Keypress Handling in Executable File Confirmation Dialog
    * CVE-2024-11698: Fullscreen Lock-Up When Modal Dialog Interrupts Transition on macOS
    * CVE-2024-11699: Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5, and Thunderbird 128.5

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202501-10 (Mozilla Firefox: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-10592 advisory.

    [128.5.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079813]
    - Add Oracle prefs

    [128.5.0]
    - Add OpenELA debranding

    [128.5.0-1]
    - Update to 128.5.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:10591 advisory.

    * thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message (CVE-2024-11159)
      * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)
      * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)
      * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and     Thunderbird 128.5 (CVE-2024-11699)
      * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters     (CVE-2024-11695)
      * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog     (CVE-2024-11697)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10591 advisory.

    * thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message (CVE-2024-11159)

    * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)

    * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)

    * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and     Thunderbird 128.5 (CVE-2024-11699)

    * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters     (CVE-2024-11695)

    * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
212560	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaFirefox (SUSE-SU-2024:4086-1)	Nessus	SuSE Local Security Checks	12/12/2024	12/12/2024	critical
214554	GLSA-202501-10 : Mozilla Firefox: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	1/23/2025	3/6/2025	high
212039	Oracle Linux 9 : thunderbird (ELSA-2024-10592)	Nessus	Oracle Linux Local Security Checks	12/3/2024	9/9/2025	medium
212099	AlmaLinux 8 : thunderbird (ALSA-2024:10591)	Nessus	Alma Linux Local Security Checks	12/5/2024	12/5/2024	medium
213223	RockyLinux 8 : thunderbird (RLSA-2024:10591)	Nessus	Rocky Linux Local Security Checks	12/19/2024	12/19/2024	medium

Detections

Analytics

Plugins Search

critical

high

medium

medium

medium