The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:13650 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-13676 advisory.

    [128.13.0-3.0.1]
    - Fix prefs for new nss [Orabug: 37079820]
    - Add Oracle prefs file

    [128.13.0]
    - Add OpenELA debranding

    [128.13.0-3]
    - Update to 128.13.0 build3

    [128.13.0-2]
    - Update to 128.13.0 build2

    [128.13.0-1]
    - Update to 128.13.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1148 advisory.

    On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. This vulnerability affects Firefox < 141, Firefox ESR <     115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and     Thunderbird < 140.1. (CVE-2025-8027)

    On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from     the instruction causing truncation and incorrect computation of the branch address. This vulnerability     affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141,     Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8028)

    Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability affects     Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and     Thunderbird < 140.1. (CVE-2025-8029)

    Insufficient escaping in the Copy as cURL feature could potentially be used to trick a user into     executing unexpected code. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR <     140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8030)

    The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP     Basic Authentication credentials. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox     ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8031)

    XSLT document loading did not correctly propagate the source document which bypassed its CSP. This     vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141,     Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8032)

    The JavaScript engine did not handle closed generators correctly and it was possible to resume them     leading to a nullptr deref. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR <     128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.
    (CVE-2025-8033)

    Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR     140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13,     Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8034)

    Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird     ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141,     Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8035)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-58 advisory.

  - Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird     ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-8035)

  - The <code>username:password</code> part was not correctly stripped from URLs in CSP reports potentially     leaking HTTP Basic Authentication credentials. (CVE-2025-8031)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Firefox executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4250 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4250-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     July 24, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : firefox-esr     Version        : 128.13.0esr-1~deb11u1     CVE ID         : CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030                      CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034                      CVE-2025-8035

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code.

    For Debian 11 bullseye, these problems have been fixed in version     128.13.0esr-1~deb11u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4253 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4253-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     July 27, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:128.13.0esr-1~deb11u1     CVE ID         : CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030                      CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034                      CVE-2025-8035

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For Debian 11 bullseye, these problems have been fixed in version     1:128.13.0esr-1~deb11u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12045 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:13651 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:13648 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:13676 advisory.

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)
      * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)
      * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)
      * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)
      * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)
      * firefox: Memory safety bugs (CVE-2025-8034)
      * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)
      * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)
      * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-59 advisory.

  - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-8040)

  - Firefox ignored paths when checking the validity of navigations in a frame. (CVE-2025-8038)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Firefox executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-63 advisory.

  - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-8040)

  - Thunderbird ignored paths when checking the validity of navigations in a frame. (CVE-2025-8038)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Thunderbird executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 141.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-61 advisory.

  - Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2025-8044)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Thunderbird executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

  - Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS     with DNS rebinding. (CVE-2025-8036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2fac68f810 advisory.

    - Updated to latest upstream (141.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-63 advisory.

  - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-8040)

  - Thunderbird ignored paths when checking the validity of navigations in a frame. (CVE-2025-8038)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Thunderbird executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
248488	RHEL 8 : thunderbird (RHSA-2025:13650)	Nessus	Red Hat Local Security Checks	8/12/2025	8/12/2025	critical
249231	Oracle Linux 8 : thunderbird (ELSA-2025-13676)	Nessus	Oracle Linux Local Security Checks	8/13/2025	8/13/2025	critical
251380	Amazon Linux 2023 : firefox (ALAS2023-2025-1148)	Nessus	Amazon Linux Local Security Checks	8/18/2025	8/18/2025	critical
242553	Mozilla Firefox ESR < 128.13	Nessus	MacOS X Local Security Checks	7/22/2025	7/30/2025	critical
242674	Debian dla-4250 : firefox-esr - security update	Nessus	Debian Local Security Checks	7/24/2025	7/24/2025	critical
242879	Debian dla-4253 : thunderbird - security update	Nessus	Debian Local Security Checks	7/27/2025	7/27/2025	critical
242991	RHEL 9 : firefox (RHSA-2025:12045)	Nessus	Red Hat Local Security Checks	7/29/2025	7/29/2025	critical
248485	RHEL 8 : thunderbird (RHSA-2025:13651)	Nessus	Red Hat Local Security Checks	8/12/2025	8/12/2025	critical
248486	RHEL 9 : thunderbird (RHSA-2025:13648)	Nessus	Red Hat Local Security Checks	8/12/2025	8/12/2025	critical
249252	AlmaLinux 8 : thunderbird (ALSA-2025:13676)	Nessus	Alma Linux Local Security Checks	8/14/2025	8/14/2025	critical
242558	Mozilla Firefox ESR < 140.1	Nessus	MacOS X Local Security Checks	7/22/2025	7/30/2025	critical
242570	Mozilla Thunderbird < 140.1	Nessus	MacOS X Local Security Checks	7/22/2025	7/30/2025	critical
242578	Mozilla Thunderbird < 141.0	Nessus	Windows	7/22/2025	7/30/2025	critical
242665	Fedora 41 : firefox (2025-2fac68f810)	Nessus	Fedora Local Security Checks	7/24/2025	8/2/2025	critical
242569	Mozilla Thunderbird < 140.1	Nessus	Windows	7/22/2025	7/30/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical