The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0167 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and     Thunderbird 128.6 (CVE-2025-0243)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19,     Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0166 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and     Thunderbird 128.6 (CVE-2025-0243)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19,     Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:0144 advisory.

    * firefox: Use-after-free when breaking lines in text (CVE-2025-0238)

    * firefox: Memory corruption when using JavaScript Text Segmentation (CVE-2025-0241)

    * firefox: Alt-Svc ALPN validation failure when redirected (CVE-2025-0239)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and     Thunderbird 128.6 (CVE-2025-0243)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19,     Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242)

    * firefox: WebChannel APIs susceptible to confused deputy attack (CVE-2025-0237)

    * firefox: Compartment mismatch when parsing JavaScript JSON module (CVE-2025-0240)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-91031f9df9 advisory.

    Update to 128.6.0

    * https://www.thunderbird.net/en-US/thunderbird/128.6.0esr/releasenotes/
    * https://www.mozilla.org/en-US/security/advisories/mfsa2025-04/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0284 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and     Thunderbird 128.6 (CVE-2025-0243)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19,     Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0286 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and     Thunderbird 128.6 (CVE-2025-0243)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19,     Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0287 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and     Thunderbird 128.6 (CVE-2025-0243)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19,     Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0029 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-0237:
    The WebChannel API, which is used to transport various information across processes, did not check the     sending principal but rather accepted the principal being sent. This could have led to privilege     escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and     Thunderbird < 128.6.

    CVE-2025-0238:
    Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to     a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox     ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6.

    CVE-2025-0239:
    When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to     an insecure site. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and     Thunderbird < 128.6.

    CVE-2025-0240:
    Parsing a JavaScript module as JSON could under some circumstances cause cross-compartment access, which     may result in a use-after-free. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird     < 134, and Thunderbird < 128.6.

    CVE-2025-0241:
    When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially     exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and     Thunderbird < 128.6.

    CVE-2025-0242:
    Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5,     Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and     Thunderbird < 128.6.

    CVE-2025-0243:
    Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR <     128.6, Thunderbird < 134, and Thunderbird < 128.6.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5841 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5841-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     January 10, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : thunderbird     CVE ID         : CVE-2024-50336 CVE-2025-0237 CVE-2025-0238 CVE-2025-0239                      CVE-2025-0240 CVE-2025-0241 CVE-2025-0242 CVE-2025-0243

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:128.6.0esr-1~deb12u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
213636	RHEL 9 : thunderbird (RHSA-2025:0167)	Nessus	Red Hat Local Security Checks	1/9/2025	6/5/2025	high
213659	RHEL 9 : thunderbird (RHSA-2025:0166)	Nessus	Red Hat Local Security Checks	1/9/2025	6/5/2025	high
213978	RockyLinux 8 : firefox (RLSA-2025:0144)	Nessus	Rocky Linux Local Security Checks	1/11/2025	2/6/2025	high
214055	Fedora 40 : thunderbird (2025-91031f9df9)	Nessus	Fedora Local Security Checks	1/14/2025	1/31/2025	high
214058	RHEL 8 : thunderbird (RHSA-2025:0284)	Nessus	Red Hat Local Security Checks	1/14/2025	6/5/2025	high
214061	RHEL 8 : thunderbird (RHSA-2025:0286)	Nessus	Red Hat Local Security Checks	1/14/2025	6/5/2025	high
214068	RHEL 8 : thunderbird (RHSA-2025:0287)	Nessus	Red Hat Local Security Checks	1/14/2025	6/5/2025	high
238784	TencentOS Server 3: firefox (TSSA-2025:0029)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
213960	Debian dsa-5841 : thunderbird - security update	Nessus	Debian Local Security Checks	1/10/2025	1/31/2025	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

medium