The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 78.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-33 advisory.

  - Mozilla developers and community members Natalia Csoregi, Simon Giesecke, Jason Kratzer, Christian Holler,     and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2020-15659)

  - Crafted media files could lead to a race in texture caches, resulting in a use-after-free, memory     corruption, and a potentially exploitable crash. (CVE-2020-6463)

  - By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a     cross-origin redirect. This applied only to content that can be parsed as script. (CVE-2020-15652)

  - WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value     is often transmitted to the peer, which allows bypassing ASLR. (CVE-2020-6514)

  - Mozilla Developer Rob Wu discovered that a redirected HTTP request which is observed or modified through a     web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin     information. (CVE-2020-15655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

  - Firefox Extended Support Release 78.1.0 ESR

  - Fixed: Various stability, functionality, and security     fixes (bsc#1174538)

  - CVE-2020-15652: Potential leak of redirect targets when     loading scripts in a worker

  - CVE-2020-6514: WebRTC data channel leaks internal     address to peer

  - CVE-2020-15655: Extension APIs could be used to bypass     Same-Origin Policy

  - CVE-2020-15653: Bypassing iframe sandbox when allowing     popups

  - CVE-2020-6463: Use-after-free in ANGLE     gl::Texture::onUnbindAsSamplerTexture

  - CVE-2020-15656: Type confusion for special arguments in     IonMonkey

  - CVE-2020-15658: Overriding file type when saving to disk

  - CVE-2020-15657: DLL hijacking due to incorrect loading     path

  - CVE-2020-15654: Custom cursor can overlay user interface

  - CVE-2020-15659: Memory safety bugs fixed in Firefox 79     and Firefox ESR 78.1

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox fixes the following issues :

Firefox Extended Support Release 78.1.0 ESR

  - Fixed: Various stability, functionality, and security     fixes (bsc#1174538)

  - CVE-2020-15652: Potential leak of redirect targets when     loading scripts in a worker

  - CVE-2020-6514: WebRTC data channel leaks internal     address to peer

  - CVE-2020-15655: Extension APIs could be used to bypass     Same-Origin Policy

  - CVE-2020-15653: Bypassing iframe sandbox when allowing     popups

  - CVE-2020-6463: Use-after-free in ANGLE     gl::Texture::onUnbindAsSamplerTexture

  - CVE-2020-15656: Type confusion for special arguments in     IonMonkey

  - CVE-2020-15658: Overriding file type when saving to disk

  - CVE-2020-15657: DLL hijacking due to incorrect loading     path

  - CVE-2020-15654: Custom cursor can overlay user interface

  - CVE-2020-15659: Memory safety bugs fixed in Firefox 79     and Firefox ESR 78.1

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox fixes the following issues :

This update for MozillaFirefox and pipewire fixes the following issues :

MozillaFirefox Extended Support Release 78.1.0 ESR

  - Fixed: Various stability, functionality, and security     fixes (bsc#1174538)

  - CVE-2020-15652: Potential leak of redirect targets when     loading scripts in a worker

  - CVE-2020-6514: WebRTC data channel leaks internal     address to peer

  - CVE-2020-15655: Extension APIs could be used to bypass     Same-Origin Policy

  - CVE-2020-15653: Bypassing iframe sandbox when allowing     popups

  - CVE-2020-6463: Use-after-free in ANGLE     gl::Texture::onUnbindAsSamplerTexture

  - CVE-2020-15656: Type confusion for special arguments in     IonMonkey

  - CVE-2020-15658: Overriding file type when saving to disk

  - CVE-2020-15657: DLL hijacking due to incorrect loading     path

  - CVE-2020-15654: Custom cursor can overlay user interface

  - CVE-2020-15659: Memory safety bugs fixed in Firefox 79     and Firefox ESR 78.1

pipewire was updated to version 0.3.6 (bsc#1171433, jsc#ECO-2308) :

  - Extensive memory leak fixing and stress testing was     done. A big leak in screen sharing with DMA-BUF was     fixed.

  - Compile fixes

  - Stability improvements in jack and pulseaudio layers.

  - Added the old portal module to make the Camera portal     work again. This will be moved to the session manager in     future versions.

  - Improvements to the GStreamer source and sink shutdown.

  - Fix compatibility with v2 clients again when negotiating     buffers.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4443-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information, bypass iframe sandbox restrictions, confuse the user, or execute arbitrary code.
    (CVE-2020-6463, CVE-2020-6514, CVE-2020-15652, CVE-2020-15653, CVE-2020-15654, CVE-2020-15656,     CVE-2020-15658, CVE-2020-15659)

    It was discovered that redirected HTTP requests which are observed or modified through a web extension     could bypass existing CORS checks. If a user were tricked in to installing a specially crafted extension,     an attacker could potentially exploit this to obtain sensitive information across origins.
    (CVE-2020-15655)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
139317	Mozilla Thunderbird < 78.1	Nessus	MacOS X Local Security Checks	2020/8/4	2025/11/18	high
139356	openSUSE Security Update : MozillaFirefox (openSUSE-2020-1147)	Nessus	SuSE Local Security Checks	2020/8/6	2024/2/26	high
139360	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:2118-1)	Nessus	SuSE Local Security Checks	2020/8/6	2024/2/26	high
139562	openSUSE Security Update : MozillaFirefox (openSUSE-2020-1189)	Nessus	SuSE Local Security Checks	2020/8/13	2024/2/26	high
139182	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4443-1)	Nessus	Ubuntu Local Security Checks	2020/7/30	2024/8/27	high
139444	openSUSE Security Update : MozillaFirefox (openSUSE-2020-1155)	Nessus	SuSE Local Security Checks	2020/8/10	2024/2/26	high

检测

插件搜索

high

high

high

high

high

high