The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6178 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6178-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     March 25, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : firefox-esr     CVE ID         : CVE-2025-59375 CVE-2026-4684 CVE-2026-4685 CVE-2026-4686                      CVE-2026-4687 CVE-2026-4688 CVE-2026-4689 CVE-2026-4690                      CVE-2026-4691 CVE-2026-4692 CVE-2026-4693 CVE-2026-4694                      CVE-2026-4695 CVE-2026-4696 CVE-2026-4697 CVE-2026-4698                      CVE-2026-4699 CVE-2026-4700 CVE-2026-4701 CVE-2026-4702                      CVE-2026-4704 CVE-2026-4705 CVE-2026-4706 CVE-2026-4707                      CVE-2026-4708 CVE-2026-4709 CVE-2026-4710 CVE-2026-4713                      CVE-2026-4714 CVE-2026-4715 CVE-2026-4716 CVE-2026-4717                      CVE-2026-4718 CVE-2026-4719 CVE-2026-4720 CVE-2026-4721

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code, sandbox escape, information disclosure, denial of service or     privilege escalation.

    For the oldstable distribution (bookworm), these problems have been     fixed in version 140.9.0esr-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 140.9.0esr-1~deb13u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-49237e1ced advisory.

    Update NSS to 3.121.0     Update to Firefox 149.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1126-1 advisory.

    Update to Firefox 140.9.0 ESR (MFSA 2026-22, bsc#1260083):

      - CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component
      - CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component
      - CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component
      - CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component
      - CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component
      - CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM     component
      - CVE-2026-4690: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM     component
      - CVE-2026-4691: Use-after-free in the CSS Parsing and Computation component
      - CVE-2026-4692: Sandbox escape in the Responsive Design Mode component
      - CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component
      - CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component
      - CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web Codecs component
      - CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component
      - CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web Codecs component
      - CVE-2026-4698: JIT miscompilation in the JavaScript Engine: JIT component
      - CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component
      - CVE-2026-4700: Mitigation bypass in the Networking: HTTP component
      - CVE-2026-4701: Use-after-free in the JavaScript Engine component
      - CVE-2026-4702: JIT miscompilation in the JavaScript Engine component
      - CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component
      - CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component
      - CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component
      - CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D component
      - CVE-2026-4708: Incorrect boundary conditions in the Graphics component
      - CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component
      - CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component
      - CVE-2026-4711: Use-after-free in the Widget: Cocoa component
      - CVE-2026-4712: Information disclosure in the Widget: Cocoa component
      - CVE-2026-4713: Incorrect boundary conditions in the Graphics component
      - CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component
      - CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D component
      - CVE-2026-4716: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
      - CVE-2026-4717: Privilege escalation in the Netmonitor component
      - CVE-2025-59375: Denial-of-service in the XML component
      - CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component
      - CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component
      - CVE-2026-4720: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and         Thunderbird 149
      - CVE-2026-4721: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR     140.9,         Firefox 149 and Thunderbird 149

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
303745	Debian dsa-6178 : firefox-esr - security update	Nessus	Debian Local Security Checks	3/25/2026	3/26/2026	critical
304408	Fedora 42 : firefox / nss (2026-49237e1ced)	Nessus	Fedora Local Security Checks	3/31/2026	4/30/2026	critical
350280	SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-upstream / etc (SUSE-SU-2026:1126-1)	Nessus	SuSE Local Security Checks	9/25/2026	9/28/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical