The remote Redhat Enterprise Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:2973 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 45.6.0.

    Security Fix(es):

    * Multiple flaws were found in the processing of malformed web content. A web page containing malicious     content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of     the user running Thunderbird. (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895, CVE-2016-9900, CVE-2016-9901,     CVE-2016-9902, CVE-2016-9905)

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Wladimir     Palant, Philipp, Andrew Krasichkov, insertscript, Jan de Mooij, Iris Hsiao, Christian Holler, Carsten     Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky as the original     reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update upgrades Thunderbird to version 45.6.0.

Security Fix(es) :

  - Multiple flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Thunderbird to crash or, potentially,     execute arbitrary code with the privileges of the user     running Thunderbird. (CVE-2016-9893, CVE-2016-9899,     CVE-2016-9895, CVE-2016-9900, CVE-2016-9901,     CVE-2016-9902, CVE-2016-9905)

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues :

  - MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES

  - MFSA 2016-95/CVE-2016-9901: Data from Pocket server     improperly sanitized before execution

  - MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor     while manipulating DOM subtrees

  - MFSA 2016-95/CVE-2016-9899: Use-after-free while     manipulating DOM events and audio elements

  - MFSA 2016-95/CVE-2016-9904: Cross-origin information     leak in shared atoms

  - MFSA 2016-95/CVE-2016-9905: Crash in     EnumerateSubDocuments

  - MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag

  - MFSA 2016-95/CVE-2016-9900: Restricted external     resources can be loaded by SVG images through data URLs

  - MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in     Firefox 50.1 and Firefox ESR 45.6

  - MFSA 2016-95/CVE-2016-9902: Pocket extension does not     validate the origin of events Please see     https://www.mozilla.org/en-US/security/advisories/mfsa20     16-95/ for more information.

  - Fix fontconfig issue (bsc#1000751) on 32bit systems as     well.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to Mozilla Thunderbird 45.6.0 fixes security issues and bugs.

In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

The following vulnerabilities were fixed: (boo#1015422)

  - CVE-2016-9899: Use-after-free while manipulating DOM     events and audio elements

  - CVE-2016-9895: CSP bypass using marquee tag

  - CVE-2016-9897: Memory corruption in libGLES

  - CVE-2016-9898: Use-after-free in Editor while     manipulating DOM subtrees

  - CVE-2016-9900: Restricted external resources can be     loaded by SVG images through data URLs

  - CVE-2016-9904: Cross-origin information leak in shared     atoms

  - CVE-2016-9905: Crash in EnumerateSubDocuments

  - CVE-2016-9893: Memory safety bugs fixed in Thunderbird     45.6

The following bugs were fixed :

  - The system integration dialog was shown every time when     starting Thunderbird

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2016-1195:10 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards     compliance, performance and portability.
    Security issues fixed with this release:
    CVE-2016-9893
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9895
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9897
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9898
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9899
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9900
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9901
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9902
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9904
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-9905
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for thunderbird is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 45.6.0.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9905)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Wladimir Palant, Philipp, Andrew Krasichkov, insertscript, Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky as the original reporters.

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues :

  - MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES

  - MFSA 2016-95/CVE-2016-9901: Data from Pocket server     improperly sanitized before execution

  - MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor     while manipulating DOM subtrees

  - MFSA 2016-95/CVE-2016-9899: Use-after-free while     manipulating DOM events and audio elements

  - MFSA 2016-95/CVE-2016-9904: Cross-origin information     leak in shared atoms

  - MFSA 2016-95/CVE-2016-9905: Crash in     EnumerateSubDocuments

  - MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag

  - MFSA 2016-95/CVE-2016-9900: Restricted external     resources can be loaded by SVG images through data URLs

  - MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in     Firefox 50.1 and Firefox ESR 45.6

  - MFSA 2016-95/CVE-2016-9902: Pocket extension does not     validate the origin of events Please see     https://www.mozilla.org/en-US/security/advisories/mfsa20     16-95/ for more information.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox.
    (CVE-2016-9079,CVE-2016-9893,CVE-2016-9895,CVE-2016-989     7,CVE-2016-9898,CVE-2016-9899,CVE-2016-9900,CVE-2016-99     01,CVE-2016-9902,CVE-2016-9904,CVE-2016-9905,CVE-2017-5     373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378,     CVE-2017-5380, CVE-2017-5383, CVE-2017-5386,     CVE-2017-5390, CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox. (CVE-2016-9079,CVE-2016-9893,     CVE-2016-9899, CVE-2016-9895, CVE-2016-9897,     CVE-2016-9898, CVE-2016-9900, CVE-2016-9901,     CVE-2016-9902, CVE-2016-9904,     CVE-2016-9905,CVE-2017-5373,CVE-2017-5375,CVE-2017-5376     ,CVE-2017-5378,CVE-2017-5380,CVE-2017-5383,CVE-2017-538     6,CVE-2017-5390,CVE-2017-5396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 50.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exists when handling     style contexts, regular expressions, and clamped     gradients that allow an unauthenticated, remote attacker     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2016-9080)

  - Multiple memory corruption issues exists, such as when     handling document state changes or HTML5 content, or     else due to dereferencing already freed memory or     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-9893)

  - A buffer overflow condition exists in SkiaGl, within the     GrResourceProvider::createBuffer() function in file     gfx/skia/skia/src/gpu/GrResourceProvider.cpp, due to a     GrGLBuffer being truncated during allocation. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-9894)

  - A security bypass vulnerability exists due to event     handlers for marquee elements being executed despite a     Content Security Policy (CSP) that disallowed inline     JavaScript. An unauthenticated, remote attacker can     exploit this to impact integrity. (CVE-2016-9895)

  - A use-after-free error exists within WebVR when handling     the navigator object. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2016-9896)

  - A memory corruption issue exists in libGLES when WebGL     functions use a vector constructor with a varying array     within libGLES. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-9897)

  - A use-after-free error exists in Editor, specifically     within file editor/libeditor/HTMLEditor.cpp, when     handling DOM subtrees. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-9898)

  - A use-after-free error exists in the     nsNodeUtils::CloneAndAdopt() function within file     dom/base/nsNodeUtils.cpp, while manipulating DOM events     and removing audio elements, due to improper handling of     failing node adoption. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-9899)

  - A security bypass vulnerability exists in the     nsDataDocumentContentPolicy::ShouldLoad() function     within file dom/base/nsDataDocumentContentPolicy.cpp     that allows external resources to be inappropriately     loaded by SVG images by utilizing 'data:' URLs. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-domain information.
    (CVE-2016-9900)

  - A flaw exists due to improper sanitization of HTML tags     received from the Pocket server. An unauthenticated,     remote attacker can exploit this to run JavaScript code     in the about:pocket-saved (unprivileged) page, giving it     access to Pocket's messaging API through HTML injection.
    (CVE-2016-9901)

  - A flaw exists in the Pocket toolbar button, specifically     in browser/extensions/pocket/content/main.js, due to     improper verification of the origin of events fired from     its own pages. An unauthenticated, remote attacker can     exploit this to inject content and commands from other     origins into the Pocket context. Note that this issue     does not affect users with e10s enabled. (CVE-2016-9902)

  - A universal cross-site scripting (XSS) vulnerability     exists in the Add-ons SDK, specifically within files     addon-sdk/source/lib/sdk/ui/frame/view.html and     addon-sdk/source/lib/sdk/ui/frame/view.js, due to     improper validation of input before returning it to     users. An unauthenticated, remote attacker can exploit     this, via a specially crafted request, to execute     arbitrary script code in a user's browser session.
    (CVE-2016-9903)

  - An information disclosure vulnerability exists that     allows an unauthenticated, remote attacker to determine     whether an atom is used by another compartment or zone     in specific contexts, by utilizing a JavaScript Map/Set     timing attack. (CVE-2016-9904)

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or information leaks.

This update upgrades Firefox to version 45.6.0 ESR.

Security Fix(es) :

  - Multiple flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Firefox to crash or, potentially, execute     arbitrary code with the privileges of the user running     Firefox. (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895,     CVE-2016-9897, CVE-2016-9898, CVE-2016-9900,     CVE-2016-9901, CVE-2016-9902, CVE-2016-9904,     CVE-2016-9905)

An update for firefox is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 45.6.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895, CVE-2016-9897, CVE-2016-9898, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9904, CVE-2016-9905)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Philipp, Wladimir Palant, Nils, Jann Horn, Aral, Andrew Krasichkov, insertscript, Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky as the original reporters.

This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities :

  - CVE-2016-9894: Buffer overflow in SkiaGL

  - CVE-2016-9899: Use-after-free while manipulating DOM     events and audio elements

  - CVE-2016-9895: CSP bypass using marquee tag

  - CVE-2016-9896: Use-after-free with WebVR

  - CVE-2016-9897: Memory corruption in libGLES

  - CVE-2016-9898: Use-after-free in Editor while     manipulating DOM subtrees

  - CVE-2016-9900: Restricted external resources can be     loaded by SVG images through data URLs

  - CVE-2016-9904: Cross-origin information leak in shared     atoms

  - CVE-2016-9901: Data from Pocket server improperly     sanitized before execution

  - CVE-2016-9902: Pocket extension does not validate the     origin of events

  - CVE-2016-9903: XSS injection vulnerability in add-ons     SDK

  - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

  - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1     and Firefox ESR 45.6

The following bugs were fixed :

  - boo#1011922: fix crash after a few seconds of usage on     AArch64

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-2973 advisory.

    [45.6.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [45.6.0-1]
    - Update to the latest upstream (45.6.0)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities :

  - CVE-2016-9894: Buffer overflow in SkiaGL

  - CVE-2016-9899: Use-after-free while manipulating DOM     events and audio elements

  - CVE-2016-9895: CSP bypass using marquee tag

  - CVE-2016-9896: Use-after-free with WebVR

  - CVE-2016-9897: Memory corruption in libGLES

  - CVE-2016-9898: Use-after-free in Editor while     manipulating DOM subtrees

  - CVE-2016-9900: Restricted external resources can be     loaded by SVG images through data URLs

  - CVE-2016-9904: Cross-origin information leak in shared     atoms

  - CVE-2016-9901: Data from Pocket server improperly     sanitized before execution

  - CVE-2016-9902: Pocket extension does not validate the     origin of events

  - CVE-2016-9903: XSS injection vulnerability in add-ons     SDK

  - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

  - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1     and Firefox ESR 45.6

    The following bugs were fixed :

  - boo#1011922: fix crash after a few seconds of usage on     AArch64

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96038	RHEL 5 / 6 / 7 : thunderbird (RHSA-2016:2973)	Nessus	Red Hat Local Security Checks	2016/12/21	2025/3/24	critical
96043	Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20161221)	Nessus	Scientific Linux Local Security Checks	2016/12/21	2026/1/7	critical
96083	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2016:3223-1)	Nessus	SuSE Local Security Checks	2016/12/22	2026/1/7	critical
96246	openSUSE Security Update : MozillaThunderbird (openSUSE-2016-1531)	Nessus	SuSE Local Security Checks	2017/1/3	2026/1/6	critical
289717	MiracleLinux 7 : firefox-45.6.0-1.0.1.el7.AXS7 (AXSA:2016-1195:10)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
96036	CentOS 5 / 6 / 7 : thunderbird (CESA-2016:2973)	Nessus	CentOS Local Security Checks	2016/12/21	2026/1/7	critical
96082	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2016:3222-1)	Nessus	SuSE Local Security Checks	2016/12/22	2026/1/7	critical
99857	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1011)	Nessus	Huawei Local Security Checks	2017/5/1	2023/6/22	critical
99858	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1012)	Nessus	Huawei Local Security Checks	2017/5/1	2023/6/22	critical
95884	Mozilla Firefox < 50.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2016/12/15	2026/3/3	critical
95827	Debian DSA-3734-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	2016/12/15	2026/1/14	critical
95872	Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20161214)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2026/1/8	critical
95819	RHEL 5 / 6 / 7 : firefox (RHSA-2016:2946)	Nessus	Red Hat Local Security Checks	2016/12/14	2026/1/14	critical
96030	openSUSE Security Update : MozillaFirefox (openSUSE-2016-1490)	Nessus	SuSE Local Security Checks	2016/12/20	2026/1/8	critical
96065	Oracle Linux 5 / 6 / 7 : thunderbird (ELSA-2016-2973)	Nessus	Oracle Linux Local Security Checks	2016/12/22	2025/4/29	critical
96248	openSUSE Security Update : MozillaFirefox (openSUSE-2016-1534)	Nessus	SuSE Local Security Checks	2017/1/3	2026/1/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical