The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3601 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3601-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     October 05, 2023                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:115.3.1-1~deb10u1     CVE ID         : CVE-2023-5169 CVE-2023-5171 CVE-2023-5176 CVE-2023-5217

    Multiple security issues were discovered in Thunderbird, which could     result in denial of service or the execution of arbitrary code.

    Debian follows the Thunderbird upstream releases. Support for the     102.x series has ended, so starting with this update we're now     following the 115.x series.

    For Debian 10 buster, these problems have been fixed in version     1:115.3.1-1~deb10u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5477 advisory.

  - During the worker lifecycle, a use-after-free condition could have occured, which could have led to a     potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and     Thunderbird < 115.0.1. (CVE-2023-3600)

  - A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-     of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability     affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects     Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5171)

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and     Thunderbird < 115.3. (CVE-2023-5176)

  - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-5217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:5433 advisory.

  - During the worker lifecycle, a use-after-free condition could have occured, which could have led to a     potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and     Thunderbird < 115.0.1. (CVE-2023-3600)

  - A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-     of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability     affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects     Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5171)

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and     Thunderbird < 115.3. (CVE-2023-5176)

  - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-5217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5538 advisory.

    The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec,     commonly used with the WebM multimedia container file format.

    Security Fix(es):

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202401-34 (Chromium, Google Chrome, Microsoft Edge:
Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and its derivatives. Please review the CVE     identifiers referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
182752	Debian dla-3601 : thunderbird - security update	Nessus	Debian Local Security Checks	10/8/2023	1/22/2025	critical
187257	CentOS 7 : firefox (RHSA-2023:5477)	Nessus	CentOS Local Security Checks	12/22/2023	12/22/2023	critical
190211	CentOS 8 : firefox (CESA-2023:5433)	Nessus	CentOS Local Security Checks	2/8/2024	2/8/2024	critical
182787	RHEL 8 : libvpx (RHSA-2023:5538)	Nessus	Red Hat Local Security Checks	10/9/2023	11/7/2024	high
189844	GLSA-202401-34 : Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	1/31/2024	7/9/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical