The version of Thunderbird installed on the remote Windows host is prior to 140.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-54 advisory.

  - If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was     able to provide a WebAuthn challenge that the user would be prompted to complete.  This is in violation of     the WebAuthN spec which requires a secure transport established without errors. (CVE-2025-6433)

  - A use-after-free in FontFaceSet resulted in a potentially exploitable crash. (CVE-2025-6424)

  - An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID     that identified the browser, and persisted between containers and normal/private browsing mode, but not     profiles. (CVE-2025-6425)

  - The executable file warning did not warn users before opening files with the <code>terminal</code>     extension.  This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.
    (CVE-2025-6426)

  - An attacker was able to bypass the <code>connect-src</code> directive of a Content Security Policy by     manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools.
    (CVE-2025-6427)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10164 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10196 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:10246 advisory.

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 128.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-53 advisory.

  - A use-after-free in FontFaceSet resulted in a potentially exploitable crash. (CVE-2025-6424)

  - An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID     that identified the browser, and persisted between containers and normal/private browsing mode, but not     profiles. (CVE-2025-6425)

  - The executable file warning did not warn users before opening files with the <code>terminal</code>     extension.  This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.
    (CVE-2025-6426)

  - Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the     URL specified in an <code>embed</code> tag.  This could have bypassed website security checks that     restricted which domains users were allowed to embed. (CVE-2025-6429)

  - When a file download is specified via the <code>Content-Disposition</code> header, that directive would be     ignored if the file was included via a <code><embed></code> or <code><object></code> tag,     potentially making a website vulnerable to a cross-site scripting attack. (CVE-2025-6430)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of firefox installed on the remote host is prior to 128.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-040 advisory.

    A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects     Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12. (CVE-2025-6424)

    An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID     that identified the browser, and persisted between containers and normal/private browsing mode, but not     profiles. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12.
    (CVE-2025-6425)

    Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the     URL specified in an `embed` tag.  This could have bypassed website security checks that restricted which     domains users were allowed to embed. This vulnerability affects Firefox < 140 and Firefox ESR < 128.12.
    (CVE-2025-6429)

    When a file download is specified via the Content-Disposition header, that directive would be ignored if     the file was included via a <embed> or <object> tag, potentially making a website vulnerable to a cross-     site scripting attack. (CVE-2025-6430)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-53 advisory.

  - A use-after-free in FontFaceSet resulted in a potentially exploitable crash. (CVE-2025-6424)

  - An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID     that identified the browser, and persisted between containers and normal/private browsing mode, but not     profiles. (CVE-2025-6425)

  - The executable file warning did not warn users before opening files with the <code>terminal</code>     extension.  This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.
    (CVE-2025-6426)

  - Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the     URL specified in an <code>embed</code> tag.  This could have bypassed website security checks that     restricted which domains users were allowed to embed. (CVE-2025-6429)

  - When a file download is specified via the <code>Content-Disposition</code> header, that directive would be     ignored if the file was included via a <code><embed></code> or <code><object></code> tag,     potentially making a website vulnerable to a cross-site scripting attack. (CVE-2025-6430)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
241211	Mozilla Thunderbird < 140.0	Nessus	Windows	7/2/2025	7/11/2025	critical
241148	RHEL 8 : thunderbird (RHSA-2025:10164)	Nessus	Red Hat Local Security Checks	7/2/2025	7/11/2025	critical
241202	RHEL 9 : thunderbird (RHSA-2025:10196)	Nessus	Red Hat Local Security Checks	7/2/2025	7/11/2025	critical
243112	RockyLinux 8 : thunderbird (RLSA-2025:10246)	Nessus	Rocky Linux Local Security Checks	7/30/2025	7/30/2025	critical
240335	Mozilla Firefox ESR < 128.12	Nessus	Windows	6/24/2025	8/12/2025	critical
241734	Amazon Linux 2 : firefox (ALASFIREFOX-2025-040)	Nessus	Amazon Linux Local Security Checks	7/10/2025	8/12/2025	critical
240336	Mozilla Firefox ESR < 128.12	Nessus	MacOS X Local Security Checks	6/24/2025	8/12/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical