The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3193 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.2.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

    * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

    * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

    * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

    * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

    * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

    * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

    * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaThunderbird to version 68.2.1 provides the following fixes :

  - Security issues fixed (bsc#1154738) :

  - CVE-2019-15903: Fixed a heap overflow in the expat     library (bsc#1149429).

  - CVE-2019-11757: Fixed a use-after-free when creating     index updates in IndexedDB (bsc#1154738).

  - CVE-2019-11758: Fixed a potentially exploitable crash     due to 360 Total Security (bsc#1154738).

  - CVE-2019-11759: Fixed a stack-based buffer overflow in     HKDF output (bsc#1154738).

  - CVE-2019-11760: Fixed a stack-based buffer overflow in     WebRTC networking (bsc#1154738).

  - CVE-2019-11761: Fixed an unintended access to a     privileged JSONView object (bsc#1154738).

  - CVE-2019-11762: Fixed a same-origin-property violation     (bsc#1154738).

  - CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

  - CVE-2019-11764: Fixed several memory safety bugs     (bsc#1154738).

Other fixes (bsc#1153879) :

  - Some attachments couldn't be opened in messages     originating from MS Outlook 2016.

  - Address book import from CSV.

  - Performance problem in message body search.

  - Ctrl+Enter to send a message would open an attachment if     the attachment pane had focus.

  - Calendar: Issues with 'Today Pane' start-up.

  - Calendar: Glitches with custom repeat and reminder     number input.

  - Calendar: Problems with WCAP provider.

  - A language for the user interface can now be chosen in     the advanced settings 

  - Fixed an issue with Google authentication (OAuth2)

  - Fixed an issue where selected or unread messages were     not shown in the correct color in the thread pane under     some circumstances

  - Fixed an issue where when using a language pack, names     of standard folders were not localized (bsc#1149126)

  - Fixed an issue where the address book default startup     directory in preferences panel not persisted

  - Fixed various visual glitches

  - Fixed issues with the chat

  - Fixed building with rust >= 1.38.

  - Fixrd LTO build without PGO.

  - Removed kde.js since disabling instantApply breaks     extensions and is now obsolete with the move to HTML     views for preferences. (bsc#1151186)

  - Updated create-tar.sh. (bsc#1152778)

  - Deactivated the crashreporter for the last remaining     arch.

This update was imported from the SUSE:SLE-15:Update update project.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service.

Debian follows the Thunderbird upstream releases. Support for the 60.x series has ended, so starting with this update we're now following the 68.x releases.

For Debian 8 'Jessie', these problems have been fixed in version 1:68.2.2-1~deb8u1.

We recommend that you upgrade your thunderbird packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - In libexpat before 2.2.8, crafted XML input could fool     the parser into changing from DTD parsing to document     parsing too early; a consecutive call to     XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read.
    (CVE-2019-15903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to     document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read. (CVE-2019-15903)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
130190	RHEL 7 : firefox (RHSA-2019:3193)	Nessus	Red Hat Local Security Checks	10/24/2019	11/7/2024	high
130937	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2464)	Nessus	SuSE Local Security Checks	11/13/2019	4/11/2024	high
131136	Debian DLA-1997-1 : thunderbird security update	Nessus	Debian Local Security Checks	11/20/2019	4/11/2024	high
131405	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0215)	Nessus	NewStart CGSL Local Security Checks	12/2/2019	4/9/2024	high
222406	Linux Distros Unpatched Vulnerability : CVE-2019-15903	Nessus	Misc.	3/4/2025	5/21/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high