The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-9922206495 advisory.

    - New upstream update (130.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-1304d7f338 advisory.

    - New upstream update (130.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6719 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6722 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-6684 advisory.

    [128.2.0-1.0.2]
    - Fix prefs for new nss [Orabug: 37079820]

    [128.2.0-1.0.1]
    - Add Oracle prefs file

    [128.2.0]
    - Add OpenELA debranding

    [128.2.0-1]
    - Update to 128.2.0

    [128.1.1-2]
    - Update to 128.1.1

    [128.0-1]
    - Update to 128.0 final

    [128.0b4-1]
    - Update to 128.0b4

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-6838 advisory.

    [128.2.0-1.0.1]
    - Remove nomerge annotation from abort calls [Orabug: 37079143]
    - Update to 128.2.0 [Orabug: 37079143]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0490 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-7652:
    An error in the ECMA-262 specification relating to Async Generators could have resulted in a type     confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects     Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

    CVE-2024-8381:
    A potentially exploitable type confusion could be triggered when looking up a property name on an object     being used as the with environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and     Firefox ESR < 115.15.

    CVE-2024-8382:
    Internal browser event interfaces were exposed to web content when privileged EventHandler listener     callbacks ran for those events. Web content that tried to use those interfaces would not be able to use     them with elevated privileges, but their presence would indicate certain browser features had been used,     such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR <     128.2, and Firefox ESR < 115.15.

    CVE-2024-8384:
    The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected     at the right point between two passes. This could have led to memory corruption. This vulnerability     affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.

    CVE-2024-8385:
    A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an     exploitable type confusion vulnerability. This vulnerability affects Firefox < 130 and Firefox ESR <     128.2.

    CVE-2024-8386:
    If a site had been granted the permission to open popup windows, it could cause Select elements to appear     on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130 and Firefox     ESR < 128.2.

    CVE-2024-8387:
    Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 130 and Firefox ESR < 128.2.

    CVE-2024-8394:
    When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug     leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8860:21 advisory.

    * thunderbird: 115.15/128.2 ()
      * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
      * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
      * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions     (CVE-2024-8384)
      * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
      * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
      * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
      * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)
      * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
206746	Fedora 40 : firefox (2024-9922206495)	Nessus	Fedora Local Security Checks	9/7/2024	2/3/2025	critical
206866	Fedora 39 : firefox (2024-1304d7f338)	Nessus	Fedora Local Security Checks	9/10/2024	2/3/2025	critical
207355	RHEL 8 : thunderbird (RHSA-2024:6719)	Nessus	Red Hat Local Security Checks	9/17/2024	2/3/2025	critical
207357	RHEL 9 : thunderbird (RHSA-2024:6722)	Nessus	Red Hat Local Security Checks	9/17/2024	2/3/2025	critical
207435	Oracle Linux 8 : thunderbird (ELSA-2024-6684)	Nessus	Oracle Linux Local Security Checks	9/19/2024	9/11/2025	critical
209645	Oracle Linux 7 : firefox (ELSA-2024-6838)	Nessus	Oracle Linux Local Security Checks	10/25/2024	9/11/2025	critical
239891	TencentOS Server 3: thunderbird (TSSA-2024:0490)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	critical
293464	MiracleLinux 9 : thunderbird-128.2.0-1.el9_4.ML.1 (AXSA:2024-8860:21)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical