The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:4108 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.3.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

    * Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

    * Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

    * Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

    * Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-38 advisory.

  - Mozilla developers Christoph Diehl, Nathan Froyd, Jason Kratzer, Christian Holler, Karl Tomlinson, Tyson     Smith reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2019-17012)

  - When using nested workers, a use-after-free could occur during worker destruction. This resulted in a     potentially exploitable crash. (CVE-2019-17008)

  - When setting a thread name on Windows in WebRTC, an incorrect number of arguments could have been     supplied, leading to stack corruption and a potentially exploitable crash.  Note: this issue only occurs     on Windows. Other operating systems are unaffected. (CVE-2019-13722)

  - When encrypting with a block cipher, if a call to <code>NSCEncryptUpdate</code> was made with data smaller     than the block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. (CVE-2019-11745)

  - When running, the updater service wrote status and log files to an unrestricted location; potentially     allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater     service.  Note: This attack requires local system access and only affects Windows. Other operating systems     are not affected. (CVE-2019-17009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-4195 advisory.

    [68.3.0-2.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [68.3.0-2]
    - Update to 68.3.0 build2

    [68.2.0-2]
    - Added patch for TLS 1.3 support.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:4205 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 68.3.0.

    Security Fix(es):

    * Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

    * Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

    * Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

    * Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

    * Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4415:08 advisory.

    * Mozilla: Use-after-free in worker destruction (CVE-2019-17008)
      * Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)
      * Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)
      * Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)
      * Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
131746	RHEL 6 : firefox (RHSA-2019:4108)	Nessus	Red Hat Local Security Checks	12/6/2019	11/7/2024	high
131955	Mozilla Thunderbird < 68.3	Nessus	MacOS X Local Security Checks	12/12/2019	11/18/2025	high
131974	Oracle Linux 8 : thunderbird (ELSA-2019-4195)	Nessus	Oracle Linux Local Security Checks	12/12/2019	10/22/2024	high
131986	RHEL 6 : thunderbird (RHSA-2019:4205)	Nessus	Red Hat Local Security Checks	12/12/2019	11/7/2024	high
132082	Debian DSA-4585-1 : thunderbird - security update	Nessus	Debian Local Security Checks	12/17/2019	4/4/2024	high
289817	MiracleLinux 4 : firefox-68.3.0-1.0.1.AXS4 (AXSA:2019-4415:08)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high