The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2017-1344:02 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.
    Security issues fixed with this release:
    CVE-2017-5398
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5400
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5401
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5402
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5404
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5405
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5407
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5408
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-5410
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-0461 advisory.

    [52.0-4.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [52.0-4]
    - Update to 52.0 ESR (b4)

    [52.0-3]
    - Added fix for rhbz#1423012 - ppc64 gfx crashes

    [52.0-2]
    - Enable system nss

    [52.0-1]
    - Update to 52.0ESR (B1)
    - Build RHEL7 package for Gtk3

    [52.0-0.13]
    - Added fix for rhbz#1414535

    [52.0-0.12]
    - Update to 52.0b8

    [52.0-0.11]
    - Readded addons patch

    [52.0-0.10]
    - Update to 52.0b3

    [52.0-0.9]
    - Update to 52.0b2

    [52.0-0.8]
    - Update to 52.0b1

    [52.0-0.5]
    - Firefox Aurora 52 testing build

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to MozillaThunderbird 51.1.0 fixes security issues and bugs.

In general, these flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

The following vulnerabilities were fixed: boo#1035082, MFSA 2017-13, boo#1028391, MFSA 2017-09)

  - CVE-2017-5443: Out-of-bounds write during BinHex     decoding

  - CVE-2017-5429: Memory safety bugs fixed in Firefox 53,     Firefox ESR 45.9, and Firefox ESR 52.1

  - CVE-2017-5464: Memory corruption with accessibility and     DOM manipulation

  - CVE-2017-5465: Out-of-bounds read in ConvolvePixel

  - CVE-2017-5466: Origin confusion when reloading isolated     data:text/html URL

  - CVE-2017-5467: Memory corruption when drawing Skia     content

  - CVE-2017-5460: Use-after-free in frame selection

  - CVE-2017-5449: Crash during bidirectional unicode     manipulation with animation

  - CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA     frames are sent with incorrect data

  - CVE-2017-5447: Out-of-bounds read during glyph     processing

  - CVE-2017-5444: Buffer overflow while parsing     application/http-index-format content

  - CVE-2017-5445: Uninitialized values used while parsing     application/http-index-format content

  - CVE-2017-5442: Use-after-free during style changes

  - CVE-2017-5469: Potential Buffer overflow in     flex-generated code

  - CVE-2017-5440: Use-after-free in txExecutionState     destructor during XSLT processing

  - CVE-2017-5441: Use-after-free with selection during     scroll events

  - CVE-2017-5439: Use-after-free in nsTArray Length()     during XSLT processing

  - CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT     processing

  - CVE-2017-5436: Out-of-bounds write with malicious font     in Graphite 2

  - CVE-2017-5435: Use-after-free during transaction     processing in the editor

  - CVE-2017-5434: Use-after-free during focus handling

  - CVE-2017-5433: Use-after-free in SMIL animation     functions

  - CVE-2017-5432: Use-after-free in text input selection

  - CVE-2017-5430: Memory safety bugs fixed in Firefox 53     and Firefox ESR 52.1

  - CVE-2017-5459: Buffer overflow in WebGL

  - CVE-2017-5454; Sandbox escape allowing file system read     access through file picker

  - CVE-2017-5451: Addressbar spoofing with onblur event

  - CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP

  - CVE-2017-5401: Memory Corruption when handling     ErrorResult

  - CVE-2017-5402: Use-after-free working with events in     FontFace objects

  - CVE-2017-5403: Use-after-free using addRange to add     range to an incorrect root object

  - CVE-2017-5404: Use-after-free working with ranges in     selections

  - CVE-2017-5406: Segmentation fault in Skia with canvas     operations 

  - CVE-2017-5407: Pixel and history stealing via     floating-point timing side channel with SVG filters

  - CVE-2017-5410: Memory corruption during JavaScript     garbage collection incremental sweeping

  - CVE-2017-5408: Cross-origin reading of video captions in     violation of CORS

  - CVE-2017-5412: Buffer overflow read in SVG filters

  - CVE-2017-5413: Segmentation fault during bidirectional     operations

  - CVE-2017-5414: File picker can choose incorrect default     directory

  - CVE-2017-5416: Null dereference crash in HttpChannel

  - CVE-2017-5426: Gecko Media Plugin sandbox is not started     if seccomp-bpf filter is running

  - CVE-2017-5418: Out of bounds read when parsing HTTP     digest authorization responses

  - CVE-2017-5419: Repeated authentication prompts lead to     DOS attack

  - CVE-2017-5405: FTP response codes can cause use of     uninitialized values for ports

  - CVE-2017-5421: Print preview spoofing

  - CVE-2017-5422: DOS attack by using view-source: protocol     repeatedly in one hyperlink

  - CVE-2017-5399: Memory safety bugs fixed in Thunderbird     52

  - CVE-2017-5398: Memory safety bugs fixed in Thunderbird     52 and Thunderbird 45.8

The following non-security changes are included :

  - Background images not working and other issues related     to embedded images when composing email have been fixed

  - Google Oauth setup can sometimes not progress to the     next step

  - Clicking on a link in an email may not open this link in     the external browser

  - addon blocklist updates

  - enable ALSA for systems without PulseAudio

  - Optionally remove corresponding data files when removing     an account

  - Possibility to copy message filter

  - Calendar: Event can now be created and edited in a tab

  - Calendar: Processing of received invitation counter     proposals

  - Chat: Support Twitter Direct Messages

  - Chat: Liking and favoriting in Twitter

  - Chat: Removed Yahoo! Messenger support

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3216-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to bypass same origin restrictions, obtain     sensitive information, spoof the addressbar, spoof the print dialog, cause a denial of service via     application crash or hang, or execute arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,     CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405, CVE-2017-5406, CVE-2017-5407,     CVE-2017-5408, CVE-2017-5410, CVE-2017-5412, CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416,     CVE-2017-5417, CVE-2017-5418, CVE-2017-5419, CVE-2017-5420, CVE-2017-5421, CVE-2017-5422, CVE-2017-5426,     CVE-2017-5427)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201705-06 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, bypass       access restriction, access otherwise protected information, or spoof       content via multiple vectors.
  Workaround :

    There is no known workaround at this time.

An update for firefox is now available for Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 45.8.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5405)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Nils, Jerri Rice, Rh0, Anton Eliasson, David Kohlbrenner, Ivan Fratric of Google Project Zero, Anonymous, Eric Lawrence of Chrome Security, Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd as the original reporters.

This update to Mozilla Thunderbird 45.8.0 fixes security issues and bugs.

The following security issues from advisory MFSA 2017-07 were fixed.
(boo#1028391) In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts :

  - CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP

  - CVE-2017-5401: Memory Corruption when handling     ErrorResult

  - CVE-2017-5402: Use-after-free working with events in     FontFace objects (bmo#1334876)

  - CVE-2017-5404: Use-after-free working with ranges in     selections

  - CVE-2017-5407: Pixel and history stealing via     floating-point timing side channel with SVG filters

  - CVE-2017-5410: Memory corruption during JavaScript     garbage collection incremental sweeping

  - CVE-2017-5408: Cross-origin reading of video captions in     violation of CORS

  - CVE-2017-5405: FTP response codes can cause use of     uninitialized values for ports (bmo#1336699)

  - CVE-2017-5398: Memory safety bugs fixed in Thunderbird     45.8

The following non-security issues were fixed :

  - crash when viewing certain IMAP messages

Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or spoofing.

With version 45.8 Debian drops it's custom branding from the Icedove package and ships the mail client as Thunderbird again. Please see the link below for further information:
https://wiki.debian.org/Thunderbird

Transition packages for the Icedove packages are provided which automatically upgrade to the new version. Since new binary packages need to be installed, make sure to allow that in your upgrade procedure (e.g. by using 'apt-get dist-upgrade' instead of 'apt-get upgrade').

For Debian 7 'Wheezy', these problems have been fixed in version 1:45.8.0-3~deb7u1.

We recommend that you upgrade your icedove packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
288907	MiracleLinux 4 : thunderbird-45.8.0-1.AXS4 (AXSA:2017-1344:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
97627	Oracle Linux 7 : firefox (ELSA-2017-0461)	Nessus	Oracle Linux Local Security Checks	2017/3/9	2024/10/22	critical
100020	openSUSE Security Update : MozillaThunderbird (openSUSE-2017-545)	Nessus	SuSE Local Security Checks	2017/5/8	2025/12/19	critical
97600	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3216-1)	Nessus	Ubuntu Local Security Checks	2017/3/8	2024/8/27	critical
100083	GLSA-201705-06 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/5/10	2025/12/19	critical
97628	RHEL 5 / 6 : firefox (RHSA-2017:0459)	Nessus	Red Hat Local Security Checks	2017/3/9	2025/12/30	critical
97748	openSUSE Security Update : MozillaThunderbird (openSUSE-2017-345)	Nessus	SuSE Local Security Checks	2017/3/15	2025/12/30	critical
99442	Debian DLA-896-1 : icedove/thunderbird security update	Nessus	Debian Local Security Checks	2017/4/19	2025/12/25	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical