The version of mozilla-thunderbird installed on the remote host is prior to 128.5.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-331-02 advisory.

    New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-thunderbird security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4086-1 advisory.

    Firefox Extended Support Release 128.5.0 ESR, fixed various security fixes     and other quality improvements, MFSA 2024-64 (bsc#1233695):

    * CVE-2024-11691: Memory corruption in Apple GPU drivers
    * CVE-2024-11692: Select list elements could be shown over another site
    * CVE-2024-11693: Download Protections were bypassed by .library-ms files on Windows
    * CVE-2024-11694: CSP Bypass and XSS Exposure via Web Compatibility Shims
    * CVE-2024-11695: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters
    * CVE-2024-11696: Unhandled Exception in Add-on Signature Verification
    * CVE-2024-11697: Inproper Keypress Handling in Executable File Confirmation Dialog
    * CVE-2024-11698: Fullscreen Lock-Up When Modal Dialog Interrupts Transition on macOS
    * CVE-2024-11699: Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5, and Thunderbird 128.5

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-515180fdb3 advisory.

    Update to 128.5.0

    * https://www.thunderbird.net/en-US/thunderbird/128.5.0esr/releasenotes/
    * https://www.mozilla.org/en-US/security/advisories/mfsa2024-68/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 133.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-67 advisory.

  - A double-free issue could have occurred in `secpkcs7decoderstartdecrypt()` when handling an error path.
    Under specific conditions, the same symmetric key could have been freed twice, potentially leading to     memory corruption. (CVE-2024-11704)

  - Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and     memory corruption due to a flaw in Apple's GPU driver.   This bug only affected the application on Apple M     series hardware. Other platforms were unaffected. (CVE-2024-11691)

  - Malicious websites may have been able to perform user intent confirmation through tapjacking. This could     have led to users unknowingly approving the launch of external applications, potentially exposing them to     underlying vulnerabilities. (CVE-2024-11700)

  - An attacker could cause a select dropdown to be shown over another tab; this could have led to user     confusion and possible spoofing attacks. (CVE-2024-11692)

  - The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.
    This could have led to user confusion and possible spoofing attacks. (CVE-2024-11701)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-ea7b2e66a1 advisory.

    Update NSS to 3.106.0     Update to Firefox 133.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
211886	Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2024-331-02)	Nessus	Slackware Local Security Checks	2024/11/26	2024/11/28	critical
212560	SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-upstream / etc (SUSE-SU-2024:4086-1)	Nessus	SuSE Local Security Checks	2024/12/12	2026/6/26	critical
212068	Fedora 40 : thunderbird (2024-515180fdb3)	Nessus	Fedora Local Security Checks	2024/12/5	2024/12/5	critical
211869	Mozilla Thunderbird < 133.0	Nessus	MacOS X Local Security Checks	2024/11/26	2025/11/18	critical
211949	Fedora 40 : firefox / nss (2024-ea7b2e66a1)	Nessus	Fedora Local Security Checks	2024/11/28	2025/3/6	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical