遠端 macOS 或 Mac OS X 主機上安裝的 Firefox ESR 版本比 128.5 版舊。因此，該應用程式會受到 mfsa2024-64 公告中提及的多個弱點影響。

  - Firefox 132、Firefox ESR 128.4 和 Thunderbird 128.4 中存在記憶體安全錯誤。其中某些錯誤顯示記憶體遭到損毀，我們推測若有心人士有意操控，可能利用其中部分錯誤執行任意程式碼。(CVE-2024-11699)

  - 處理全螢幕轉換時有一個瑕疵，可能在轉換期間開啟模態對話方塊時，不慎造成應用程式在全螢幕模式中停滯。此問題會導致使用者無法使用標準動作 (例如按下 Esc 或存取右鍵點擊功能表) 結束全螢幕模式，進而導致瀏覽器體驗中斷，直到重新啟動瀏覽器為止。此錯誤只會影響在 macOS 上執行的應用程式。其他作業系統不受影響。(CVE-2024-11698)

  - Apple 晶片 M 系列裝置上的某些 WebGL 操作可能導致超出邊界寫入和記憶體損毀，這是因為 Apple GPU 驅動程式中的瑕疵所導致。此錯誤只會影響 Apple M 系列硬體上的應用程式。其他平台不受影響。(CVE-2024-11691)

  - 攻擊者可造成選取下拉式清單顯示在另一個索引標籤上；這可導致使用者混淆及可能的偽造攻擊。 (CVE-2024-11692)

  - 下載 .library-ms 檔案時未顯示可執行檔警告。注意：此問題僅影響 Windows 作業系統。其他作業系統不受影響。(CVE-2024-11693)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The version of mozilla-firefox installed on the remote host is prior to 128.5.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-331-01 advisory.

    New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-firefox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-b266d38c44 advisory.

    Update NSS to 3.106.0     Update to Firefox 133.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1128 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-11699:
    Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 133, Firefox ESR < 128.5,     Thunderbird < 133, and Thunderbird < 128.5.

    CVE-2024-11698:
    A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in     fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit     fullscreen mode using standard actions like pressing Esc or accessing right-click menus, resulting in a     disrupted browsing experience until the browser is restarted.
    *This bug only affects the application when running on macOS. Other operating systems are unaffected.*     This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

    CVE-2024-11697:
    When handling keypress events, an attacker may have been able to trick a user into bypassing the Open     Executable File? confirmation dialog. This could have led to malicious code execution. This vulnerability     affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

    CVE-2024-11696:
    The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on     signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have     caused runtime errors that disrupted the signature validation process. As a result, the enforcement of     signature validation for unrelated add-ons may have been bypassed.  Signature validation in this context     is used to ensure that third-party applications on the user's computer have not tampered with the user's     extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR <     128.5, Thunderbird < 133, and Thunderbird < 128.5.

    CVE-2024-11695:
    A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the     page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR <     128.5, Thunderbird < 133, and Thunderbird < 128.5.

    CVE-2024-11694:
    Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and     DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have     exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox <     133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, and Thunderbird < 128.5.

    CVE-2024-11693:
    The executable file warning was not presented when downloading .library-ms files.
    *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This     vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

    CVE-2024-11692:
    An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5,     Thunderbird < 133, and Thunderbird < 128.5.

    CVE-2024-11691:
    Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.
    *This bug only affected the application on Apple M series hardware. Other platforms were unaffected.* This     vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, and     Thunderbird < 128.5.

    CVE-2024-11159:
    Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This     vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 133.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-63 advisory.

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

  - Malicious websites may have been able to perform user intent confirmation through tapjacking. This could     have led to users unknowingly approving the launch of external applications, potentially exposing them to     underlying vulnerabilities. (CVE-2024-11700)

  - An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. (CVE-2024-11692)

  - The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.
    This could have led to user confusion and possible spoofing attacks. (CVE-2024-11701)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-68 advisory.

  - Memory safety bugs present in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2024-11699)

  - A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in     fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit     fullscreen mode using standard actions like pressing Esc or accessing right-click menus, resulting in a     disrupted browsing experience until the browser is restarted.   This bug only affects the application when     running on macOS. Other operating systems are unaffected. (CVE-2024-11698)

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

  - An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. (CVE-2024-11692)

  - The executable file warning was not presented when downloading .library-ms files.   Note: This issue only     affected Windows operating systems. Other operating systems are unaffected. (CVE-2024-11693)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-64 advisory.

  - Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2024-11699)

  - A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in     fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit     fullscreen mode using standard actions like pressing Esc or accessing right-click menus, resulting in a     disrupted browsing experience until the browser is restarted.   This bug only affects the application when     running on macOS. Other operating systems are unaffected. (CVE-2024-11698)

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

  - An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. (CVE-2024-11692)

  - The executable file warning was not presented when downloading .library-ms files.   Note: This issue only     affected Windows operating systems. Other operating systems are unaffected. (CVE-2024-11693)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
211876	Mozilla Firefox ESR < 128.5	Nessus	MacOS X Local Security Checks	2024/11/26	2025/11/18	critical
211887	Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2024-331-01)	Nessus	Slackware Local Security Checks	2024/11/26	2024/11/28	critical
211970	Fedora 41 : firefox / nss (2024-b266d38c44)	Nessus	Fedora Local Security Checks	2024/11/29	2025/3/6	critical
239873	TencentOS Server 4: thunderbird (TSSA-2024:1128)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
211872	Mozilla Firefox < 133.0	Nessus	Windows	2024/11/26	2025/11/18	critical
211870	Mozilla Thunderbird < 128.5	Nessus	MacOS X Local Security Checks	2024/11/26	2025/11/18	critical
211876	Mozilla Firefox ESR < 128.5	Nessus	MacOS X Local Security Checks	2024/11/26	2025/11/18	critical

偵測

搜尋 Plugin

critical

critical

critical

medium

critical

critical

critical