The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1287 advisory.

    * Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)

    * Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)

    * Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)

    * Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)

    * Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)

    * Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)

    * Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)

    * Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1301 advisory.

    * Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)

    * Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)

    * Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)

    * Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)

    * Mozilla: OpenPGP revocation information was ignored (CVE-2022-1197)

    * Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)

    * Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)

    * Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)

    * Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-14 (Mozilla Thunderbird: Multiple Vulnerabilities)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-29967, CVE-2021-29969,     CVE-2021-29970, CVE-2021-29976, CVE-2021-29980, CVE-2021-29984, CVE-2021-29985, CVE-2021-29986,     CVE-2021-29988, CVE-2021-29989, CVE-2021-30547, CVE-2021-38492, CVE-2021-38493, CVE-2021-38495,     CVE-2021-38503, CVE-2021-38504, CVE-2021-38506, CVE-2021-38507, CVE-2021-38508, CVE-2021-38509,     CVE-2021-40529, CVE-2021-4129, CVE-2021-4140, CVE-2021-43528, CVE-2021-43529, CVE-2021-43536,     CVE-2021-43537, CVE-2021-43538, CVE-2021-43539, CVE-2021-43541, CVE-2021-43542, CVE-2021-43543,     CVE-2021-43545, CVE-2021-43546, CVE-2022-0566, CVE-2022-1196, CVE-2022-1197, CVE-2022-1520, CVE-2022-1529,     CVE-2022-1802, CVE-2022-1834, CVE-2022-2200, CVE-2022-2226, CVE-2022-22737, CVE-2022-22738,     CVE-2022-22739, CVE-2022-22740, CVE-2022-22741, CVE-2022-22742, CVE-2022-22743, CVE-2022-22745,     CVE-2022-22747, CVE-2022-22748, CVE-2022-22751, CVE-2022-22754, CVE-2022-22756, CVE-2022-22759,     CVE-2022-22760, CVE-2022-22761, CVE-2022-22763, CVE-2022-22764, CVE-2022-24713, CVE-2022-26381,     CVE-2022-26383, CVE-2022-26384, CVE-2022-26386, CVE-2022-26387, CVE-2022-26485, CVE-2022-26486,     CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289, CVE-2022-29909,     CVE-2022-29911, CVE-2022-29912, CVE-2022-29913, CVE-2022-29914, CVE-2022-29916, CVE-2022-29917,     CVE-2022-31736, CVE-2022-31737, CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,     CVE-2022-31747, CVE-2022-34468, CVE-2022-34470, CVE-2022-34472, CVE-2022-34478, CVE-2022-34479,     CVE-2022-34481, CVE-2022-34484, CVE-2022-36318, CVE-2022-36319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5393-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, conduct spoofing attacks, or execute arbitrary code. (CVE-2022-1097, CVE-2022-1196,     CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289)

    It was discovered that Thunderbird ignored OpenPGP revocation when importing a revoked key in some     circumstances. An attacker could potentially exploit this by tricking the user into trusting the     authenticity of a message or tricking them into use a revoked key to send an encrypted message.
    (CVE-2022-1197)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 91.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-14 advisory.

  - Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 98 and Firefox ESR 91.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2022-28289)

  - The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount     of time during parsing. If an attacker was able to supply input to this crate, they could have caused a     denial of service in the browser. (CVE-2022-24713)

  - <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe     way on different threads, leading to a use-after-free and potentially exploitable crash. (CVE-2022-1097)

  - If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to     the parent process, an out of bounds write would have occurred leading to memory corruption and a     potentially exploitable crash. (CVE-2022-28281)

  - After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-     after-free and potentially exploitable crash. (CVE-2022-1196)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-14 advisory.

  - Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 98 and Firefox ESR 91.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2022-28289)

  - The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount     of time during parsing. If an attacker was able to supply input to this crate, they could have caused a     denial of service in the browser. (CVE-2022-24713)

  - <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe     way on different threads, leading to a use-after-free and potentially exploitable crash. (CVE-2022-1097)

  - If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to     the parent process, an out of bounds write would have occurred leading to memory corruption and a     potentially exploitable crash. (CVE-2022-28281)

  - After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-     after-free and potentially exploitable crash. (CVE-2022-1196)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1287 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.8.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)

    * Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)

    * Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)

    * Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)

    * Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)

    * Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)

    * Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)

    * Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1283 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.8.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)

    * Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)

    * Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)

    * Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)

    * Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)

    * Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)

    * Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)

    * Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:1284-1 advisory.

  - Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)

  - Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)

  - Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)

  - Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)

  - Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)

  - Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)

  - Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)

  - Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-1302 advisory.

    [91.8.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
    - Enabled aarch64 build

    [91.8.0-1]
    - Update to 91.8.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3145:09 advisory.

    Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)         Mozilla: Out of bounds write due to unexpected WebAuthN Extensions     (CVE-2022-28281)         Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8     (CVE-2022-28289)         Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)         Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)         Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)         Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)         Mozilla: iframe contents could be rendered outside the border     (CVE-2022-28286)     CVE(s):
    CVE-2022-1097     CVE-2022-1196     CVE-2022-24713     CVE-2022-28281     CVE-2022-28282     CVE-2022-28285     CVE-2022-28286     CVE-2022-28289

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
357462	Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2022_1287)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
359158	Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2022_1301)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
163986	GLSA-202208-14 : Mozilla Thunderbird: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/8/10	2023/10/16	critical
160275	Ubuntu 18.04 LTS / 20.04 LTS : Thunderbird vulnerabilities (USN-5393-1)	Nessus	Ubuntu Local Security Checks	2022/4/28	2024/8/27	high
159527	Mozilla Firefox ESR < 91.8	Nessus	Windows	2022/4/5	2025/11/18	high
159528	Mozilla Firefox ESR < 91.8	Nessus	MacOS X Local Security Checks	2022/4/5	2025/11/18	high
159612	RHEL 8 : firefox (RHSA-2022:1287)	Nessus	Red Hat Local Security Checks	2022/4/9	2024/11/7	high
159622	RHEL 8 : firefox (RHSA-2022:1283)	Nessus	Red Hat Local Security Checks	2022/4/9	2024/11/7	high
159640	Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:1284)	Nessus	Scientific Linux Local Security Checks	2022/4/11	2023/11/2	high
159655	Oracle Linux 7 : thunderbird (ELSA-2022-1302)	Nessus	Oracle Linux Local Security Checks	2022/4/12	2024/10/22	high
294104	MiracleLinux 8 : firefox-91.8.0-1.el8.ML.1 (AXSA:2022-3145:09)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

critical

high

high

high

high

high

high

high

high