The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.26. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-57 advisory.

  - Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR     140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2025-8034)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - The JavaScript engine did not handle closed generators correctly and it was possible to resume them     leading to a nullptr deref. (CVE-2025-8033)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-63 advisory.

  - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-8040)

  - Thunderbird ignored paths when checking the validity of navigations in a frame. (CVE-2025-8038)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Thunderbird executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-63 advisory.

  - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2025-8040)

  - Thunderbird ignored paths when checking the validity of navigations in a frame. (CVE-2025-8038)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Thunderbird executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 141.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-61 advisory.

  - Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2025-8044)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Thunderbird executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

  - Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS     with DNS rebinding. (CVE-2025-8036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 128.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-62 advisory.

  - Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird     ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-8035)

  - The <code>username:password</code> part was not correctly stripped from URLs in CSP reports potentially     leaking HTTP Basic Authentication credentials. (CVE-2025-8031)

  - On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. (CVE-2025-8027)

  - On arm64, a WASM <code>brtable</code> instruction with a lot of entries could lead to the label being too     far from the instruction causing truncation and incorrect computation of the branch address.
    (CVE-2025-8028)

  - Thunderbird executed <code>javascript:</code> URLs when used in <code>object</code> and <code>embed</code>     tags. (CVE-2025-8029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:11797 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:12278 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-12188 advisory.

    [128.13.0-3.0.1]
    - Add Oracle prefs

    [128.13.0-3]
    - Update to 128.13.0 build3

    [128.13.0-2]
    - Update to 128.13.0 build2

    [128.13.0-1]
    - Update to 128.13.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-11797 advisory.

    [128.13.0-1.0.1]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789]

    [128.13.0-1]
    - Update to 128.13.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:12353 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:13645 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:13650 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

    * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

    * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

    * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

    * firefox: Memory safety bugs (CVE-2025-8034)

    * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

    * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

    * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-13676 advisory.

    [128.13.0-3.0.1]
    - Fix prefs for new nss [Orabug: 37079820]
    - Add Oracle prefs file

    [128.13.0]
    - Add OpenELA debranding

    [128.13.0-3]
    - Update to 128.13.0 build3

    [128.13.0-2]
    - Update to 128.13.0 build2

    [128.13.0-1]
    - Update to 128.13.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1148 advisory.

    On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack.
    Baseline-JIT, however, read the entire 64 bits. This vulnerability affects Firefox < 141, Firefox ESR <     115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and     Thunderbird < 140.1. (CVE-2025-8027)

    On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from     the instruction causing truncation and incorrect computation of the branch address. This vulnerability     affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141,     Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8028)

    Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability affects     Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and     Thunderbird < 140.1. (CVE-2025-8029)

    Insufficient escaping in the Copy as cURL feature could potentially be used to trick a user into     executing unexpected code. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR <     140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8030)

    The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP     Basic Authentication credentials. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox     ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8031)

    XSLT document loading did not correctly propagate the source document which bypassed its CSP. This     vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141,     Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8032)

    The JavaScript engine did not handle closed generators correctly and it was possible to resume them     leading to a nullptr deref. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR <     128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.
    (CVE-2025-8033)

    Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR     140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13,     Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8034)

    Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird     ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141,     Thunderbird < 128.13, and Thunderbird < 140.1. (CVE-2025-8035)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2fac68f810 advisory.

    - Updated to latest upstream (141.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
242560	Mozilla Firefox ESR < 115.26	Nessus	MacOS X Local Security Checks	7/22/2025	7/30/2025	critical
242569	Mozilla Thunderbird < 140.1	Nessus	Windows	7/22/2025	7/30/2025	critical
242570	Mozilla Thunderbird < 140.1	Nessus	MacOS X Local Security Checks	7/22/2025	7/30/2025	critical
242578	Mozilla Thunderbird < 141.0	Nessus	Windows	7/22/2025	7/30/2025	critical
242580	Mozilla Thunderbird < 128.13	Nessus	Windows	7/22/2025	7/30/2025	critical
242892	RHEL 10 : firefox (RHSA-2025:11797)	Nessus	Red Hat Local Security Checks	7/28/2025	7/28/2025	critical
243044	RHEL 7 : firefox (RHSA-2025:12278)	Nessus	Red Hat Local Security Checks	7/30/2025	7/30/2025	critical
243191	Oracle Linux 10 : thunderbird (ELSA-2025-12188)	Nessus	Oracle Linux Local Security Checks	7/30/2025	7/30/2025	critical
243193	Oracle Linux 10 : firefox (ELSA-2025-11797)	Nessus	Oracle Linux Local Security Checks	7/30/2025	7/30/2025	critical
243229	RHEL 8 : firefox (RHSA-2025:12353)	Nessus	Red Hat Local Security Checks	7/31/2025	7/31/2025	critical
248466	RHEL 8 : thunderbird (RHSA-2025:13645)	Nessus	Red Hat Local Security Checks	8/12/2025	8/12/2025	critical
248488	RHEL 8 : thunderbird (RHSA-2025:13650)	Nessus	Red Hat Local Security Checks	8/12/2025	8/12/2025	critical
249231	Oracle Linux 8 : thunderbird (ELSA-2025-13676)	Nessus	Oracle Linux Local Security Checks	8/13/2025	8/13/2025	critical
251380	Amazon Linux 2023 : firefox (ALAS2023-2025-1148)	Nessus	Amazon Linux Local Security Checks	8/18/2025	8/18/2025	critical
242665	Fedora 41 : firefox (2025-2fac68f810)	Nessus	Fedora Local Security Checks	7/24/2025	8/2/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical