The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-9655:04 advisory.

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and     Thunderbird 128.7 (CVE-2025-1017)
      * firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20,     Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016)
      * firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows     (CVE-2025-1013)
      * firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011)
      * firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009)
      * firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014)
      * firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR     128.7, Thunderbird 128.7, and Thunderbird 135. (CVE-2025-1017)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 135.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-07 advisory.

  - Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2025-1020)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user.
    This could have been leveraged to perform a potential spoofing attack. (CVE-2025-1018)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5858 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5858-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 05, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : firefox-esr     CVE ID         : CVE-2024-11704 CVE-2025-1009 CVE-2025-1010 CVE-2025-1011                      CVE-2025-1012 CVE-2025-1013 CVE-2025-1014 CVE-2025-1016                      CVE-2025-1017

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code.

    For the stable distribution (bookworm), these problems have been fixed in     version 128.7.0esr-1~deb12u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1135 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and     Thunderbird 128.7 (CVE-2025-1017)

    * firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20,     Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016)

    * firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows     (CVE-2025-1013)

    * firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011)

    * firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009)

    * firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014)

    * firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1137 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and     Thunderbird 128.7 (CVE-2025-1017)

    * firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20,     Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016)

    * firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows     (CVE-2025-1013)

    * firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011)

    * firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009)

    * firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014)

    * firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1138 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and     Thunderbird 128.7 (CVE-2025-1017)

    * firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20,     Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016)

    * firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows     (CVE-2025-1013)

    * firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011)

    * firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009)

    * firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014)

    * firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 20485d27-e540-11ef-a845-b42e991fc52e advisory.

    security@mozilla.org reports:
    A bug in WebAssembly code generation could have lead to a crash.
            It may have been possible for an attacker to leverage this to achieve             code execution.
    A race condition could have led to private browsing tabs being             opened in normal browsing windows.  This could have resulted in a             potential privacy leak.
    Certificate length was not properly checked when added to a certificate             store.  In practice only trusted data was processed.
    Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox             ESR 128.6, and Thunderbird 128.6.  Some of these bugs showed evidence             of memory corruption and we presume that with enough effort some             of these could have been exploited to run arbitrary code.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4045 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4045-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     February 07, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:128.7.0esr-1~deb11u1     CVE ID         : CVE-2024-11704 CVE-2025-1009 CVE-2025-1010 CVE-2025-1011                      CVE-2025-1012 CVE-2025-1013 CVE-2025-1014 CVE-2025-1016                      CVE-2025-1017

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For Debian 11 bullseye, these problems have been fixed in version     1:128.7.0esr-1~deb11u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2e627d0672 advisory.

    - Updated to latest upstream (135.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0374-1 advisory.

    * MFSA 2025-09
      * CVE-2025-1009 (bmo#1936613)         Use-after-free in XSLT
      * CVE-2025-1010 (bmo#1936982)         Use-after-free in Custom Highlight
      * CVE-2025-1011 (bmo#1936454)         A bug in WebAssembly code generation could result in a crash
      * CVE-2025-1012 (bmo#1939710)         Use-after-free during concurrent delazification
      * CVE-2024-11704 (bmo#1899402)         Potential double-free vulnerability in PKCS#7 decryption         handling
      * CVE-2025-1013 (bmo#1932555)         Potential opening of private browsing tabs in normal browsing         windows
      * CVE-2025-1014 (bmo#1940804)         Certificate length was not properly checked
      * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,         bmo#1938469, bmo#1939583, bmo#1940994)         Memory safety bugs fixed in Firefox 135, Thunderbird 135,         Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,         and Thunderbird 128.7
      * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)         Memory safety bugs fixed in Firefox 135, Thunderbird 135,         Firefox ESR 128.7, and Thunderbird 128.7

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1184 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and     Thunderbird 128.7 (CVE-2025-1017)

    * firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20,     Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016)

    * firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows     (CVE-2025-1013)

    * firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011)

    * thunderbird: Unsanitized address book fields (CVE-2025-1015)

    * firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009)

    * thunderbird: Address of e-mail sender can be spoofed by malicious email (CVE-2025-0510)

    * firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014)

    * firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1283 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and     Thunderbird 128.7 (CVE-2025-1017)

    * firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20,     Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016)

    * firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows     (CVE-2025-1013)

    * firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011)

    * firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009)

    * firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014)

    * firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1318 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and     Thunderbird 128.7 (CVE-2025-1017)

    * firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20,     Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016)

    * firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows     (CVE-2025-1013)

    * firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011)

    * thunderbird: Unsanitized address book fields (CVE-2025-1015)

    * firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009)

    * thunderbird: Address of e-mail sender can be spoofed by malicious email (CVE-2025-0510)

    * firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014)

    * firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
291765	MiracleLinux 9 : firefox-128.7.0-1.el9_5.ML.1 (AXSA:2025-9655:04)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical
231295	Linux Distros Unpatched Vulnerability : CVE-2025-1017	Nessus	Misc.	3/6/2025	4/16/2026	critical
214964	Mozilla Firefox < 135.0	Nessus	MacOS X Local Security Checks	2/4/2025	11/18/2025	critical
215021	Debian dsa-5858 : firefox-esr - security update	Nessus	Debian Local Security Checks	2/5/2025	2/7/2025	critical
215106	RHEL 8 : firefox (RHSA-2025:1135)	Nessus	Red Hat Local Security Checks	2/7/2025	6/5/2025	critical
215107	RHEL 8 : firefox (RHSA-2025:1137)	Nessus	Red Hat Local Security Checks	2/7/2025	6/5/2025	critical
215111	RHEL 9 : firefox (RHSA-2025:1138)	Nessus	Red Hat Local Security Checks	2/7/2025	6/5/2025	critical
215137	FreeBSD : mozilla -- multiple vulnerabilities (20485d27-e540-11ef-a845-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	2/7/2025	3/6/2025	critical
215142	Debian dla-4045 : thunderbird - security update	Nessus	Debian Local Security Checks	2/7/2025	3/6/2025	critical
215148	Fedora 40 : firefox (2025-2e627d0672)	Nessus	Fedora Local Security Checks	2/8/2025	3/6/2025	critical
215182	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaFirefox (SUSE-SU-2025:0374-1)	Nessus	SuSE Local Security Checks	2/10/2025	2/10/2025	critical
215197	RHEL 9 : thunderbird (RHSA-2025:1184)	Nessus	Red Hat Local Security Checks	2/10/2025	6/5/2025	critical
216068	RHEL 8 : firefox (RHSA-2025:1283)	Nessus	Red Hat Local Security Checks	2/11/2025	6/5/2025	critical
216111	RHEL 9 : thunderbird (RHSA-2025:1318)	Nessus	Red Hat Local Security Checks	2/11/2025	6/5/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical