The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3221 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 102.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2051 advisory.

    In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. (CVE-2023-32205)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An out-of-bound read could have led to a crash in the RLBox Expat driver. (CVE-2023-32206)

    The Mozilla Foundation Security Advisory describes this flaw as:

    A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. (CVE-2023-32207)

    The Mozilla Foundation Security Advisory describes this flaw as:

    A type checking bug would have led to invalid code being compiled. (CVE-2023-32211)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An attacker could have positioned a `datalist` element to obscure the address bar. (CVE-2023-32212)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When reading a file, an uninitialized value could have been used as read limit. (CVE-2023-32213)

    Mozilla developers and community members reported memory safety bugs present in Firefox 112 and Firefox     ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2023-32215)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3137 advisory.

  - In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113,     Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32205)

  - An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects     Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32206)

  - A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird <     102.11. (CVE-2023-32207)

  - A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox <     113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32211)

  - An attacker could have positioned a <code>datalist</code> element to obscure the address bar. This     vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32212)

  - When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects     Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32213)

  - Memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
    (CVE-2023-32215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6024:19 advisory.

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)
      * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)
      * Mozilla: Potential permissions request bypass via clickjacking     (CVE-2023-32207)
      * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11     (CVE-2023-32215)
      * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)
      * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)
      * Mozilla: Potential memory corruption in FileReader::DoReadData()     (CVE-2023-32213)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2023_3220 advisory.

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
176065	RHEL 8 : thunderbird (RHSA-2023:3221)	Nessus	Red Hat Local Security Checks	2023/5/18	2024/11/7	high
176710	Amazon Linux 2 : thunderbird (ALAS-2023-2051)	Nessus	Amazon Linux Local Security Checks	2023/6/5	2024/12/11	high
187263	CentOS 7 : firefox (RHSA-2023:3137)	Nessus	CentOS Local Security Checks	2023/12/22	2023/12/22	high
291808	MiracleLinux 9 : firefox-102.11.0-2.el9.ML.1 (AXSA:2023-6024:19)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
356284	Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2023_3220)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

偵測

搜尋 Plugin

high

high

high

high

high