The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0538 advisory.

  - If a user installed an extension of a particular type, the extension could have auto-updated itself and     while doing so, bypass the prompt which grants the new version the new requested permissions. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22754)

  - If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object     could have been changed into an executable script which would have run arbitrary code after the user     clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
    (CVE-2022-22756)

  - If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an     element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have     run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22759)

  - When importing resources using Web Workers, error messages would distinguish the difference between     <code>application/javascript</code> responses and non-script responses. This could have been abused to     learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22760)

  - Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the     frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22761)

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22763)

  - Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22764)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0676-1 advisory.

  - A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant     Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM     access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22753)

  - If a user installed an extension of a particular type, the extension could have auto-updated itself and     while doing so, bypass the prompt which grants the new version the new requested permissions. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22754)

  - If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object     could have been changed into an executable script which would have run arbitrary code after the user     clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
    (CVE-2022-22756)

  - If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an     element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have     run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22759)

  - When importing resources using Web Workers, error messages would distinguish the difference between     <code>application/javascript</code> responses and non-script responses. This could have been abused to     learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22760)

  - Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the     frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22761)

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22763)

  - Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22764)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0696-1 advisory.

  - A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant     Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM     access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22753)

  - If a user installed an extension of a particular type, the extension could have auto-updated itself and     while doing so, bypass the prompt which grants the new version the new requested permissions. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22754)

  - If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object     could have been changed into an executable script which would have run arbitrary code after the user     clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
    (CVE-2022-22756)

  - If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an     element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have     run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22759)

  - When importing resources using Web Workers, error messages would distinguish the difference between     <code>application/javascript</code> responses and non-script responses. This could have been abused to     learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22760)

  - Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the     frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22761)

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22763)

  - Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22764)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 91.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1818 advisory.

    crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in     Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in     the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks     are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a     logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are     affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. (CVE-2021-32810)

    During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in     memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15,     Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. (CVE-2021-38496)

    Through use of reportValidity() and window.open(), a plain-text validation message could have been     overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability     affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. (CVE-2021-38497)

    During process shutdown, a document could have caused a use-after-free of a languages service object,     leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93,     Thunderbird < 91.2, and Firefox ESR < 91.2. (CVE-2021-38498)

    Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2,     Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. (CVE-2021-38500)

    Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and     Firefox ESR < 91.2. (CVE-2021-38501)

    Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could     perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated     session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was     configured, the MITM could obtain the authentication credentials, too. This vulnerability affects     Thunderbird < 91.2. (CVE-2021-38502)

    The Mozilla Foundation Security Advisory describes this flaw as:

    It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Constructing audio sinks could have lead to a race condition when playing audio files and closing windows.
    This could have lead to a use-after-free causing a potentially exploitable crash. (CVE-2022-22737)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-     buffer-overflow causing a potentially exploitable crash. (CVE-2022-22738)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Malicious websites could have tricked users into accepting launching a program to handle an external URL     protocol. (CVE-2022-22739)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Certain network request objects were freed too early when releasing a network request handle. This could     have lead to a use-after-free causing a potentially exploitable crash. (CVE-2022-22740)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When resizing a popup while requesting fullscreen access, the popup would have become unable to leave     fullscreen mode. (CVE-2022-22741)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations     (CVE-2022-22745)

    The Mozilla Foundation Security Advisory describes this flaw as:

    After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data     could have lead to a crash. This crash is believed to be unexploitable. (CVE-2022-22747)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Malicious websites could have confused Thunderbird into showing the wrong origin when asking to launch a     program and handling an external URL protocol. (CVE-2022-22748)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson     Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR     91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. (CVE-2022-22751)

    The Mozilla Foundation Security Advisory describes this flaw as:

    If a user installed an extension of a particular type, the extension could have auto-updated itself and     while doing so, bypass the prompt which grants the new version the new requested permissions.
    (CVE-2022-22754)

    The Mozilla Foundation Security Advisory describes this flaw as:

    If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object     could have been changed into an executable script which would have run arbitrary code after the user     clicked on it. (CVE-2022-22756)

    The Mozilla Foundation Security Advisory describes this flaw as:

    If a document created a sandboxed iframe without allow-scripts, and subsequently appended an element to     the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite     the iframe's sandbox. (CVE-2022-22759)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When importing resources using Web Workers, error messages would distinguish the difference between     application/javascript responses and non-script responses. This could have been abused to learn     information cross-origin. (CVE-2022-22760)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the     frame-ancestors directive when it was used in the Web Extension\'s Content Security Policy.
    (CVE-2022-22761)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. (CVE-2022-22763)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Mozilla developers and community members Paul Adenot and the Mozilla Fuzzing Team reported memory safety     bugs present in Firefox 96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption     and we presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2022-22764)

    The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass     restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects     Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. (CVE-2021-38503)

    A flaw was found in Thunderbird, which is vulnerable to the heap overflow described in CVE-2021-43527 when     processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when     processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
    (CVE-2021-43529)

    References to CVE-2021-38503 and CVE-2021-43529 have been added after the original release of this     advisory, however those vulnerabilities were fixed by the packages referenced by this advisory's initial     release on 2022-07-06.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202202-03 (Mozilla Firefox: Multiple vulnerabilities)

  - A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially     exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability     affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29970)

  - A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating     the library resolved the issue, and may have remediated other, unknown security vulnerabilities as well.
    This vulnerability affects Firefox < 90. (CVE-2021-29972)

  - When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS     error page would allow the user to override an error on a domain which had specified HTTP Strict Transport     Security (which implies that the error should not be override-able.) This issue did not affect the network     connections, and they were correctly upgraded to HTTPS automatically. This vulnerability affects Firefox <     90. (CVE-2021-29974)

  - Through a series of DOM manipulations, a message, over which the attacker had control of the text but not     HTML or formatting, could be overlaid on top of another domain (with the new domain correctly shown in the     address bar) resulting in possible user confusion. This vulnerability affects Firefox < 90.
    (CVE-2021-29975)

  - Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12,     Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29976)

  - Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence     of memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 90. (CVE-2021-29977)

  - Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption     and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91,     Firefox ESR < 78.13, and Firefox < 91. (CVE-2021-29980)

  - An issue present in lowering/register allocation could have led to obscure but deterministic register     confusion failures in JITted code that would lead to a potentially exploitable crash. This vulnerability     affects Firefox < 91 and Thunderbird < 91. (CVE-2021-29981)

  - Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object,     resulting in the potential leak of a single bit of memory. This vulnerability affects Firefox < 91 and     Thunderbird < 91. (CVE-2021-29982)

  - Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly     considered during garbage collection. This led to memory corruption and a potentially exploitable crash.
    This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
    (CVE-2021-29984)

  - A use-after-free vulnerability in media channels could have led to memory corruption and a potentially     exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13,     and Firefox < 91. (CVE-2021-29985)

  - A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable     crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.*     This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
    (CVE-2021-29986)

  - After requesting multiple permissions, and closing the first permission panel, subsequent permission     panels will be displayed in a different position but still record a click in the default location, making     it possible to trick a user into accepting a permission they did not want to. *This bug only affects     Firefox on Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91 and     Thunderbird < 91. (CVE-2021-29987)

  - Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds     read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird <     78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. (CVE-2021-29988)

  - Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13,     and Firefox < 91. (CVE-2021-29989)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 91. (CVE-2021-29990)

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

  - Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded.
    This vulnerability affects Firefox < 92. (CVE-2021-38491)

  - Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14,     and Firefox < 92. (CVE-2021-38493)

  - Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.1 and Firefox ESR < 91.1.
    (CVE-2021-38495)

  - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass     restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects     Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. (CVE-2021-38503)

  - When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-     free could have resulted, leading to memory corruption and a potentially exploitable crash. This     vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. (CVE-2021-38504)

  - Through a series of navigations, Firefox could have entered fullscreen mode without notification or     warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This     vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. (CVE-2021-38506)

  - The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded     to TLS while retaining the visual properties of an HTTP connection, including being same-origin with     unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port     8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the     browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin     with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. This     vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. (CVE-2021-38507)

  - By displaying a form validity message in the correct location at the same time as a permission prompt     (such as for geolocation), the validity message could have obscured the prompt, resulting in the user     potentially being tricked into granting the permission. This vulnerability affects Firefox < 94,     Thunderbird < 91.3, and Firefox ESR < 91.3. (CVE-2021-38508)

  - Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary     (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's     choosing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
    (CVE-2021-38509)

  - Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the     target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
    (CVE-2021-43536)

  - An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory     leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR <     91.4.0, and Firefox < 95. (CVE-2021-43537)

  - By misusing a race in our notification code, an attacker could have forcefully hidden the notification for     pages that had received full screen and pointer lock access, which could have been used for spoofing     attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
    (CVE-2021-43538)

  - Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC     occurring within the call not tracing those live pointers. This could have led to a use-after-free causing     a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0,     and Firefox < 95. (CVE-2021-43539)

  - WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party     websites that would not have been uninstalled with the extension. This vulnerability affects Firefox < 95.
    (CVE-2021-43540)

  - When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not     properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
    (CVE-2021-43541)

  - Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages     for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and     Firefox < 95. (CVE-2021-43542)

  - Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by     embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and     Firefox < 95. (CVE-2021-43543)

  - Using the Location API in a loop could have caused severe application hangs and crashes. This     vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. (CVE-2021-43545)

  - It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor.
    This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. (CVE-2021-43546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has firefox packages installed that are affected by multiple vulnerabilities:

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This     vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2021-4140)

  - crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in     Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in     the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks     are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a     logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are     affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. (CVE-2021-32810)

  - Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14,     and Firefox < 92. (CVE-2021-38493)

  - During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in     memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15,     Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. (CVE-2021-38496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 96.0。因此，其会受到 mfsa2022-01 公告中提及的多个漏洞影响。

  - 争用条件可允许绕过全屏通知，进而可能导致忽略全屏窗口欺骗攻击。此错误仅影响 Windows 版 Firefox。其他操作系统不受影响。(CVE-2022-22746)

  - 在请求全屏访问的同时从 iframe 内部导航时，攻击者控制的选项卡可能使浏览器无法退出全屏模式。(CVE-2022-22743)

  - 在编辑模式下插入文本时，某些字符可能导致越界内存访问，从而造成潜在可利用的崩溃问题。(CVE-2022-22742)

  - 在请求全屏访问的同时调整弹出窗口的大小时，弹出窗口将无法退出全屏模式。(CVE-2022-22741)

  - 释放网络请求句柄时，过早释放特定网络请求对象。这可能造成释放后使用，从而导致潜在可利用的崩溃问题。(CVE-2022-22740)

  - 应用 CSS 过滤器效果可能会造成越界访问内存。这可能造成堆缓冲区溢出，从而导致潜在可利用的崩溃问题。(CVE-2022-22738)

  - 构建音频接收器可能会导致在播放音频文件和关闭窗口时出现争用条件。
    这可能造成释放后使用，从而导致潜在可利用的崩溃问题。(CVE-2022-22737)

  - 可以构建能够绕过 iframe 沙盒的特定 XSLT 标记。
    (CVE-2021-4140)

  - 通过跨进程一般接受和传递资源句柄，受损内容进程可能使更高权限的进程产生混淆，从而本不具有访问权限的无权限进程进行句柄交互。此错误仅影响 Windows 版和 MacOS 版 Firefox。其他操作系统不受影响。(CVE-2022-22750)

  - 当扫描 QR 码时，Android 版 Firefox 会允许导航至某些未指向 Web 内容的 URL。此错误仅影响 Android 版 Firefox 。其他操作系统不受影响。
    (CVE-2022-22749)

  - 要求启动程序和处理外部 URL 协议时，恶意网站可致使 Firefox 混淆显示错误的来源。(CVE-2022-22748)

  - Securitypolicyviolation 事件可泄露框架祖先违规的跨源信息 (CVE-2022-22745)

  - PowerShell 未正确转义 DevTools 中“复制为 curl”功能所构建的 curl 命令。如果将其粘贴到 Powershell 提示符中，可能会导致命令注入问题。此错误仅影响 Windows 版 Firefox。其他操作系统不受影响。(CVE-2022-22744)

  - 接受不受信任的证书后，将空的 pkcs7 序列作为证书数据的一部分进行处理可能导致崩溃问题。此崩溃被认为是无法利用的。(CVE-2022-22747)

  - 如果将 Firefox 安装到全局可写目录，则当 Firefox 在当前目录中搜索系统库时，可能会出现本地升级权限的情况。但是，默认情况下安装目录不可全局写入。此错误仅影响非默认安装的 Windows 版 Firefox。其他操作系统不受影响。(CVE-2022-22736)

  - 恶意网站可诱骗用户接受启动程序以处理外部 URL 协议。(CVE-2022-22739)

  - 据 Mozilla 开发人员 Calixte Denizet、Kershaw Chang、Christian Holler、Jason Kratzer、Gabriele Svelto、Tyson Smith、Simon Giesecke 和 Steve Fink 报告，Firefox 95 和 Firefox ESR 91.4 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测若攻击者付出足够努力，就能利用部分错误运行任意代码。(CVE-2022-22751)

  - 据 Mozilla 开发人员 Christian Holler 和 Jason Kratzer 报告，Firefox 95 中存在内存安全错误。
    其中某些错误展示出内存损坏迹象，我们推测若攻击者付出足够努力，就能利用部分错误运行任意代码。(CVE-2022-22752)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程 Windows 主机上安装的 Firefox 版本低于 96.0。因此，其会受到 mfsa2022-01 公告中提及的多个漏洞影响。

  - 争用条件可允许绕过全屏通知，进而可能导致忽略全屏窗口欺骗攻击。此错误仅影响 Windows 版 Firefox。其他操作系统不受影响。(CVE-2022-22746)

  - 在请求全屏访问的同时从 iframe 内部导航时，攻击者控制的选项卡可能使浏览器无法退出全屏模式。(CVE-2022-22743)

  - 在编辑模式下插入文本时，某些字符可能导致越界内存访问，从而造成潜在可利用的崩溃问题。(CVE-2022-22742)

  - 在请求全屏访问的同时调整弹出窗口的大小时，弹出窗口将无法退出全屏模式。(CVE-2022-22741)

  - 释放网络请求句柄时，过早释放特定网络请求对象。这可能造成释放后使用，从而导致潜在可利用的崩溃问题。(CVE-2022-22740)

  - 应用 CSS 过滤器效果可能会造成越界访问内存。这可能造成堆缓冲区溢出，从而导致潜在可利用的崩溃问题。(CVE-2022-22738)

  - 构建音频接收器可能会导致在播放音频文件和关闭窗口时出现争用条件。
    这可能造成释放后使用，从而导致潜在可利用的崩溃问题。(CVE-2022-22737)

  - 可以构建能够绕过 iframe 沙盒的特定 XSLT 标记。
    (CVE-2021-4140)

  - 通过跨进程一般接受和传递资源句柄，受损内容进程可能使更高权限的进程产生混淆，从而本不具有访问权限的无权限进程进行句柄交互。此错误仅影响 Windows 版和 MacOS 版 Firefox。其他操作系统不受影响。(CVE-2022-22750)

  - 当扫描 QR 码时，Android 版 Firefox 会允许导航至某些未指向 Web 内容的 URL。此错误仅影响 Android 版 Firefox 。其他操作系统不受影响。
    (CVE-2022-22749)

  - 要求启动程序和处理外部 URL 协议时，恶意网站可致使 Firefox 混淆显示错误的来源。(CVE-2022-22748)

  - Securitypolicyviolation 事件可泄露框架祖先违规的跨源信息 (CVE-2022-22745)

  - PowerShell 未正确转义 DevTools 中“复制为 curl”功能所构建的 curl 命令。如果将其粘贴到 Powershell 提示符中，可能会导致命令注入问题。此错误仅影响 Windows 版 Firefox。其他操作系统不受影响。(CVE-2022-22744)

  - 接受不受信任的证书后，将空的 pkcs7 序列作为证书数据的一部分进行处理可能导致崩溃问题。此崩溃被认为是无法利用的。(CVE-2022-22747)

  - 如果将 Firefox 安装到全局可写目录，则当 Firefox 在当前目录中搜索系统库时，可能会出现本地升级权限的情况。但是，默认情况下安装目录不可全局写入。此错误仅影响非默认安装的 Windows 版 Firefox。其他操作系统不受影响。(CVE-2022-22736)

  - 恶意网站可诱骗用户接受启动程序以处理外部 URL 协议。(CVE-2022-22739)

  - 据 Mozilla 开发人员 Calixte Denizet、Kershaw Chang、Christian Holler、Jason Kratzer、Gabriele Svelto、Tyson Smith、Simon Giesecke 和 Steve Fink 报告，Firefox 95 和 Firefox ESR 91.4 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测若攻击者付出足够努力，就能利用部分错误运行任意代码。(CVE-2022-22751)

  - 据 Mozilla 开发人员 Christian Holler 和 Jason Kratzer 报告，Firefox 95 中存在内存安全错误。
    其中某些错误展示出内存损坏迹象，我们推测若攻击者付出足够努力，就能利用部分错误运行任意代码。(CVE-2022-22752)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 当工作线程关闭时，可能导致脚本在生命周期后期某个本不应运行的时间点运行。此漏洞会影响 Firefox < 96、Thunderbird < 91.6、Firefox ESR < 91.6。(CVE-2022-22763)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的一个程序包受到 RHSA-2022: 0512 公告中提及的多个漏洞的影响。

  - Mozilla：扩展程序可能在更新期间绕过权限确认 (CVE-2022-22754)

  - Mozilla：拖放图像可导致放置的对象成为可执行文件 (CVE-2022-22756)

  - Mozilla：如果使用父附加元素 (CVE-2022-22759)，沙盒 iframe 可能已执行脚本

  - Mozilla：可区分脚本和非脚本内容类型的跨源响应 (CVE-2022-22760)

  - Mozilla：未对带框架的扩展页面强制执行 frame-ancestors 内容安全策略指令 (CVE-2022-22761)

  - Mozilla：无效对象状态期间的脚本执行漏洞 (CVE-2022-22763)

  - Mozilla：在 Firefox 97 和 Firefox ESR 91.6 中修复了内存安全缺陷 (CVE-2022-22764)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Debian 9 主机上安装的多个程序包受到 dla-2921 公告中提及的多个漏洞影响。

  - Mozilla 开发人员 Paul Adenot 及 Mozilla Fuzzing 团队报告 Firefox 96 与 Firefox ESR 91.5 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22764)

  - 如果用户安装了特定类型的扩展程序，该扩展程序可能会自我更新，同时绕过授予新版本请求权限的提示。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22754)

  - 如果已经说服用户将图像拖放到其桌面或其他文件夹，则生成的对象可能已更改为可执行脚本，而该脚本会在用户点击后运行任意代码。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。
    (CVE-2022-22756)

  - 如果文档创建了一个不含 <code>allow-scripts</code> 的沙盒 iframe，随后将一个元素附加到 iframe 的文档（例如包含 JavaScript 事件处理程序），则尽管已经存在 iframe 沙盒，事件处理程序也会运行。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22759)

  - 使用 Web 工作线程导入资源时，错误消息会区分 <code>application/javascript</code> 响应和非脚本响应之间的差异。这可能被滥用于了解信息跨源。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22760)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2022:0514 公告中提及的多个漏洞的影响。

  - Mozilla：扩展程序可能在更新期间绕过权限确认 (CVE-2022-22754)

  - Mozilla：拖放图像可导致放置的对象成为可执行文件 (CVE-2022-22756)

  - Mozilla：如果使用父附加元素，沙盒 iframe 可能已执行脚本 (CVE-2022-22759)

  - Mozilla：可区分脚本和非脚本内容类型的跨源响应 (CVE-2022-22760)

  - Mozilla：未对带框架的扩展页面强制执行 frame-ancestors 内容安全策略指令 (CVE-2022-22761)

  - Mozilla：无效对象状态期间存在脚本执行漏洞 (CVE-2022-22763)

  - Mozilla：Firefox 97 和 Firefox ESR 91.6 中的内存安全缺陷已修复 (CVE-2022-22764)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的一个程序包受到 RHSA-2022: 0510 公告中提及的多个漏洞影响。

  - Mozilla：扩展程序可能在更新期间绕过权限确认 (CVE-2022-22754)

  - Mozilla：拖放图像可导致放置的对象成为可执行文件 (CVE-2022-22756)

  - Mozilla：如果使用父附加元素 (CVE-2022-22759)，沙盒 iframe 可能已执行脚本

  - Mozilla：可区分脚本和非脚本内容类型的跨源响应 (CVE-2022-22760)

  - Mozilla：未对带框架的扩展页面强制执行 frame-ancestors 内容安全策略指令 (CVE-2022-22761)

  - Mozilla：无效对象状态期间的脚本执行漏洞 (CVE-2022-22763)

  - Mozilla：在 Firefox 97 和 Firefox ESR 91.6 中修复了内存安全缺陷 (CVE-2022-22764)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 CentOS Linux 7 主机上安装的一个程序包受到 RHSA-2022:0538 公告中提及的多个漏洞影响。

  - 如果用户安装了特定类型的扩展程序，该扩展程序可能会自我更新，同时绕过授予新版本请求权限的提示。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22754)

  - 如果已经说服用户将图像拖放到其桌面或其他文件夹，则生成的对象可能已更改为可执行脚本，而该脚本会在用户点击后运行任意代码。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。
    (CVE-2022-22756)

  - 如果文档创建了一个不含 <code>allow-scripts</code> 的沙盒 iframe，随后将一个元素附加到 iframe 的文档（例如包含 JavaScript 事件处理程序），则尽管已经存在 iframe 沙盒，事件处理程序也会运行。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22759)

  - 使用 Web 工作线程导入资源时，错误消息会区分 <code>application/javascript</code> 响应和非脚本响应之间的差异。这可能被滥用于了解信息跨源。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22760)

  - 可通过 Web 访问的扩展页面（方案为 moz-extension:// 的页面）在 Web Extension 的 Content Security Policy 中使用 frame-ancestors 指令时，未正确强制执行该指令。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22761)

  - 关闭工作线程时，可以导致脚本在生命周期的后期运行，在原本不可能运行的时间点运行。该漏洞影响 Firefox < 96、Thunderbird < 91.6和 Firefox ESR < 91.6。 (CVE-2022-22763)

  - Mozilla 开发人员 Paul Adenot 及 Mozilla Fuzzing 团队报告 Firefox 96 与 Firefox ESR 91.5 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22764)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 CentOS Linux 7 主机上安装的一个程序包受到 RHSA-2022:0514 公告中提及的多个漏洞影响。

  - 如果用户安装了特定类型的扩展程序，该扩展程序可能会自我更新，同时绕过授予新版本请求权限的提示。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22754)

  - 如果已经说服用户将图像拖放到其桌面或其他文件夹，则生成的对象可能已更改为可执行脚本，而该脚本会在用户点击后运行任意代码。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。
    (CVE-2022-22756)

  - 如果文档创建了一个不含 <code>allow-scripts</code> 的沙盒 iframe，随后将一个元素附加到 iframe 的文档（例如包含 JavaScript 事件处理程序），则尽管已经存在 iframe 沙盒，事件处理程序也会运行。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22759)

  - 使用 Web 工作线程导入资源时，错误消息会区分 <code>application/javascript</code> 响应和非脚本响应之间的差异。这可能被滥用于了解信息跨源。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22760)

  - 可通过 Web 访问的扩展页面（方案为 moz-extension:// 的页面）在 Web Extension 的 Content Security Policy 中使用 frame-ancestors 指令时，未正确强制执行该指令。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22761)

  - 关闭工作线程时，可以导致脚本在生命周期的后期运行，在原本不可能运行的时间点运行。该漏洞影响 Firefox < 96、Thunderbird < 91.6和 Firefox ESR < 91.6。 (CVE-2022-22763)

  - Mozilla 开发人员 Paul Adenot 及 Mozilla Fuzzing 团队报告 Firefox 96 与 Firefox ESR 91.5 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Firefox < 97、Thunderbird < 91.6 和 Firefox ESR < 91.6。(CVE-2022-22764)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机受到 GLSA-202202-03 中所述漏洞的影响（Mozilla Firefox：多个漏洞）

  - 恶意网页可触发释放后使用、内存损坏和潜在可利用的崩溃。*只有在启用辅助功能时才会触发此错误。* 此漏洞会影响 Thunderbird 78.12 之前版本、Firefox ESR 78.12 之前版本和 Firefox 90 之前版本。(CVE-2021-29970)

  - 经测试后发现一个释放后使用漏洞，并且该漏洞可追溯至已过期的 Cairo 库。此问题已在更新库后得到解决，而其他未知安全漏洞也可能因更新库得到修复。
    此漏洞会影响 Firefox 90 之前版本。(CVE-2021-29972)

  -（例如因 Enhanced Tracking Protection 设置而导致）启用网络分区时，用户可利用 TLS 错误页面覆盖已指定 HTTP 严格传输安全性的域中的错误（但本不应覆盖该错误）。此问题不会影响网络连接，因为这些连接已自动正确升级为 HTTPS。此漏洞会影响 Firefox 90 之前版本。(CVE-2021-29974)

  - 通过一系列 DOM 操纵，消息（攻击者可以控制此类消息的文本，但不能控制 HTML 或格式）可能会覆盖在其他域（地址栏中正确显示新域）上层，从而可能导致用户混淆问题。此漏洞会影响 Firefox 90 之前版本。
    (CVE-2021-29975)

  - Mozilla 开发人员报告 Firefox 和 Thunderbird 之间共享的代码中存在内存安全错误。
    其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Thunderbird 78.12 之前版本、Firefox ESR 78.12 之前版本和 Firefox 90 之前版本。(CVE-2021-29976)

  - Mozilla 开发人员报告 Firefox 89 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Firefox 90 之前版本。(CVE-2021-29977)

  - canvas 对象中未初始化的内存可造成错误的 free()，导致内存损坏和可能遭利用的程序崩溃。此漏洞会影响 Thunderbird 78.13 之前版本、Thunderbird 91 之前版本、Firefox ESR 78.13 之前版本和 Firefox 91 之前版本。(CVE-2021-29980)

  - lowering/寄存器分配中存在一个问题，可导致 JITted 代码中发生隐蔽但确定的寄存器混淆失败，从而导致可能遭利用的程序崩溃。此漏洞影响 Firefox < 91 和 Thunderbird < 91。CVE-2021-29981

  - 由于 JIT 优化不正确，我们错误地解释了来自错误对象类型的数据，从而可能泄漏单个位的内存。此漏洞影响 Firefox < 91 和 Thunderbird < 91。CVE-2021-29982

  - 指令重新排序会导致一系列指令，造成程序在垃圾回收期间错误地考虑对象。这可能导致内存损坏和可能遭利用的程序崩溃。
    此漏洞会影响 Thunderbird < 78.13、Thunderbird < 91、Firefox ESR < 78.13 和 Firefox < 91。
    (CVE-2021-29984)

  - 媒体通道中存在释放后使用漏洞，这可导致内存损坏和可能遭利用的程序崩溃。此漏洞会影响 Thunderbird 78.13 之前版本、Thunderbird 91 之前版本、Firefox ESR 78.13 之前版本和 Firefox 91 之前版本。(CVE-2021-29985)

  - 调用 getaddrinfo 时疑似会发生争用情形，进而导致内存损坏以及可能遭利用的程序崩溃。*注：此问题仅影响 Linux 操作系统。其他操作系统不会受到影响。此漏洞会影响 Thunderbird < 78.13、Thunderbird < 91、Firefox ESR < 78.13 和 Firefox < 91。
    (CVE-2021-29986)

  - 请求多个权限并关闭第一个权限面板之后，后续的权限面板会显示在不同的位置，但仍会记录默认位置的点击，因此可诱骗用户接受他们不想要的权限。*此缺陷仅影响 Linux 系统上的 Firefox。其他操作系统不受影响。* 此漏洞影响 Firefox < 91 和 Thunderbird < 91。CVE-2021-29987

  - Firefox 会错误地将内联 list-item 元素视为 block 元素，从而导致越界读取或内存损坏，并造成可能被利用的程序崩溃。此漏洞会影响 Thunderbird 78.13 之前版本、Thunderbird 91 之前版本、Firefox ESR 78.13 之前版本和 Firefox 91 之前版本。(CVE-2021-29988)

  - Mozilla 开发人员报告 Firefox 90 和 Firefox ESR 78.12 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Thunderbird 78.13 之前版本、Firefox ESR 78.13 之前版本和 Firefox 91 之前版本。(CVE-2021-29989)

  - Mozilla 开发人员和社区成员报告 Firefox 90 中存在的内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞影响 Firefox 91 之前版本。CVE-2021-29990

  - 在 Google Chrome 91.0.4472.101 之前版本的 ANGLE 中存在越界写入，远程攻击者可利用此漏洞，通过构建的 HTML 页面，可能执行越界内存访问。(CVE-2021-30547)

  - 混合内容检查无法分析不透明源，从而导致加载某些混合内容。
    此漏洞会影响 Firefox 92 之前版本。(CVE-2021-38491)

  - Mozilla 开发人员报告 Firefox 91 和 Firefox ESR 78.13 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响版本低于 78.14 的 Firefox ESR、版本低于 78.14 的 Thunderbird 以及版本低于 92 的 Firefox。(CVE-2021-38493)

  - Mozilla 开发人员报告了 Thunderbird 78.13.0 中存在内存安全缺陷。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响版本低于 91.1 的 Thunderbird 以及版本低于 91.1 的 Firefox ESR。
    (CVE-2021-38495)

  - iframe 沙盒规则未正确应用到 XSLT 样式表，从而允许 iframe 绕过限制，例如执行脚本或浏览顶层框架。此漏洞会影响版本低于 91.3 的 Firefox ESR、版本低于 94 的 Firefox 和版本低于 91.3 的 Thunderbird。(CVE-2021-38503)

  - 在设置 webkitdirectory 的情况下与 HTML 输入元素的文件选择器对话框交互时，可能会发生释放后使用，从而导致内存损坏以及可能遭受攻击的崩溃。此漏洞会影响版本低于 91.3 的 Firefox ESR、版本低于 94 的 Firefox 和版本低于 91.3 的 Thunderbird。(CVE-2021-38504)

  - 通过一系列导航，Firefox 可在不通知或警告用户的情况下进入全屏模式。这可能导致对浏览器 UI 的欺骗攻击，包括钓鱼攻击。此漏洞会影响版本低于 91.3 的 Firefox ESR、版本低于 94 的 Firefox 和版本低于 91.3 的 Thunderbird。(CVE-2021-38506)

  - HTTP2 (RFC 8164) 的机会性加密功能允许连接透明地升级到 TLS ，同时保留 HTTP 连接的可视化属性，包括与端口 80 上的未加密连接同源。但是，如果相同 IP 地址上的第二个加密端口（例如端口 8443）未选择加入机会性加密，网络攻击者可将浏览器到 443 端口的连接转发到 8443 端口，从而导致浏览器将 8443 端口的内容视为与 HTTP 同源。已通过禁用使用率较低的机会加密功能解决了此问题。此漏洞会影响版本低于 91.3 的 Firefox ESR、版本低于 94 的 Firefox 和版本低于 91.3 的 Thunderbird。(CVE-2021-38507)

  - 若在收到显示权限提示（例如地理位置）的同时于正确位置显示表单有效性消息，则有效性消息可能已经掩盖提示，导致用户可能被诱骗授予权限。此漏洞会影响版本低于 91.3 的 Firefox ESR、版本低于 94 的 Firefox 和版本低于 91.3 的 Thunderbird。(CVE-2021-38508)

  - 由于受攻击者控制的事件出现序列异常问题，包含任意（尽管无样式）内容的 Javascript alert() 对话框可显示在攻击者选择的不受控网页之上。此漏洞会影响版本低于 91.3 的 Firefox ESR、版本低于 94 的 Firefox 和版本低于 91.3 的 Thunderbird。
    (CVE-2021-38509)

  - 在某些情况下，异步函数会导致导航失败，从而暴露目标 URL。此漏洞会影响版本低于 91.4.0 的 Thunderbird、版本低于 91.4.0 的 Firefox ESR 以及版本低于 95 的 Firefox。
    (CVE-2021-43536)

  - 从 64 位到 32 位整数大小的错误类型转换会允许攻击者损坏内存，从而导致主机可能因恶意利用漏洞发生崩溃。此漏洞会影响Thunderbird 91.4.0 之前版本、Firefox ESR 91.4.0 之前版本以及 Firefox 95 之前版本。(CVE-2021-43537)

  - 通过滥用通知代码中的争用，攻击者可以强制隐藏已接收全屏和指针锁定访问的页面的通知，但此漏洞可能会被用于发动欺骗攻击。此漏洞会影响版本低于 91.4.0 的 Thunderbird、版本低于 91.4.0 的 Firefox ESR 以及版本低于 95 的 Firefox。
    (CVE-2021-43538)

  - 未能正确记录跨 wasm 实例调用的实时指针位置，这会导致未跟踪这些实时指针的调用内发生 GC。这会导造成释放后使用，从而导致可能会被利用的崩溃。此漏洞会影响Thunderbird 91.4.0 之前版本、Firefox ESR 91.4.0 之前版本以及 Firefox 95 之前版本。(CVE-2021-43539)

  - 拥有正确权限的 WebExtension 可以为第三方网站创建和安装 ServiceWorker，但无法随该扩展程序一并卸载。此漏洞会影响 Firefox < 95。
    (CVE-2021-43540)

  - 调用外部协议的协议处理程序时，未正确转义所提供的包含空格的参数 URL。此漏洞会影响版本低于 91.4.0 的 Thunderbird、版本低于 91.4.0 的 Firefox ESR 以及版本低于 95 的 Firefox。
    (CVE-2021-43541)

  - 使用 XMLHttpRequest 时，攻击者可通过探测错误消息来加载外部协议，从而识别已安装的应用程序。此漏洞会影响Thunderbird 91.4.0 之前版本、Firefox ESR 91.4.0 之前版本以及 Firefox 95 之前版本。(CVE-2021-43542)

  - 使用 CSP 沙盒指令加载的文档可通过嵌入其他内容避开沙盒的脚本限制。此漏洞会影响Thunderbird 91.4.0 之前版本、Firefox ESR 91.4.0 之前版本以及 Firefox 95 之前版本。(CVE-2021-43543)

  - 在循环中使用 Location API 会导致严重的应用程序挂起和崩溃。此漏洞会影响Thunderbird 91.4.0 之前版本、Firefox ESR 91.4.0 之前版本以及 Firefox 95 之前版本。(CVE-2021-43545)

  - 可以使用经过缩放的本机光标重新创建之前针对用户的光标欺骗攻击。
    此漏洞会影响Thunderbird 91.4.0 之前版本、Firefox ESR 91.4.0 之前版本以及 Firefox 95 之前版本。(CVE-2021-43546)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程主机上安装的 thunderbird 版本低于 91.6.0-1。因此，如公告 ALAS2-2022-1818 所述，受到多个漏洞的影响。

  - crossbeam-deque 是工作窃取双端队列程序包，用于在 Rust 中编程时构建任务计划程序。在 0.7.4 和 0.8.0 之前的版本中，争用条件的结果是工作队列中的一个或多个任务可以弹出两次，而不是弹出其他被遗忘且从未弹出的任务。如果在堆上分配任务，此漏洞可造成双重释放和内存泄漏。如果没有出现这些问题，此漏洞仍会导致逻辑错误。使用 `Stealer: : steal`、`Stealer: : steal_batch` 或 `Stealer: : steal_batch_and_pop` 的 Crates 受到此问题的影响。此问题已在 crossbeam-deque 0.8.1 和 0.7.4 中修复。(CVE-2021-32810)

  - 在 MessageTasks 上操作期间，任务可能还在计划阶段就被删除，这将造成内存损坏并可能引发被恶意利用的崩溃问题。此漏洞会影响 Thunderbird < 78.15、Thunderbird < 91.2、Firefox ESR < 91.2、Firefox ESR < 78.15 以及 Firefox < 93。(CVE-2021-38496)

  - 通过使用 reportValidity() 和 window.open()，可将纯文本验证消息覆盖在其他原始数据上，因此可能造成用户混淆和伪造攻击。此漏洞会影响版本低于 91.2 的 Firefox ESR、版本低于 93 的 Firefox 和版本低于 91.2 的 Thunderbird。(CVE-2021-38497)

  - 在进程关闭期间，特定文档可导致语言服务对象释放后使用，进而造成内存损坏和潜在可利用的崩溃。此漏洞会影响版本低于 91.2 的 Firefox ESR、版本低于 93 的 Firefox 和版本低于 91.2 的 Thunderbird。(CVE-2021-38498)

  - Mozilla 开发人员报告 Firefox 92 和 Firefox ESR 91.1 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响 Thunderbird < 78.15、Thunderbird < 91.2、Firefox ESR < 91.2、Firefox ESR < 78.15 以及 Firefox < 93。(CVE-2021-38500)

  - Mozilla 开发人员报告 Firefox 92 和 Firefox ESR 91.1 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测如果攻击者进行足够的尝试，则可以利用此漏洞运行任意代码。此漏洞会影响版本低于 91.2 的 Firefox ESR、版本低于 93 的 Firefox 和版本低于 91.2 的 Thunderbird。(CVE-2021-38501)

  - Thunderbird 忽略了 SMTP 连接需要 STARTTLS 安全性的配置。MITM 可执行降级攻击以拦截传输的消息，或可控制经过身份验证的会话以执行 MITM 所选的 SMTP 命令。如果配置了不受保护的身份验证方法，MITM 也可以获取身份验证凭据。此漏洞影响 Thunderbird < 91.2。(CVE-2021-38502)

  - Mozilla：使用 XSLT 绕过 iframe 沙盒 (CVE-2021-4140)

  - Mozilla：播放音频文件时存在争用条件 (CVE-2022-22737)

  - Mozilla：BlendGaussianBlur 中存在堆缓冲区溢出问题 (CVE-2022-22738)

  - Mozilla：未限制外部协议启动对话框 (CVE-2022-22739)

  - Mozilla：ChannelEventQueue: : mOwner 中存在释放后使用问题 (CVE-2022-22740)

  - Mozilla：使用全屏模式伪造浏览器窗口 (CVE-2022-22741)

  - Mozilla：在编辑模式下插入文本时存在越界内存访问问题 (CVE-2022-22742)

  - 在请求全屏访问的同时从 iframe 内部导航时，攻击者控制的选项卡可能使浏览器无法退出全屏模式。(CVE-2022-22743)

  - Mozilla：通过 securitypolicyviolation 事件泄露跨源 URL (CVE-2022-22745)

  - Mozilla：处理空 pkcs7 序列时发生崩溃 (CVE-2022-22747)

  - Mozilla：外部协议启动对话框中存在伪来源 (CVE-2022-22748)

  - Mozilla：在 Firefox 96 和 Firefox ESR 91.5 中修复了内存安全缺陷 (CVE-2022-22751)

  - 如果用户安装了特定类型的扩展程序，该扩展程序可能会自我更新，同时绕过授予新版本请求权限的提示。
    (CVE-2022-22754)

  - 如果已经说服用户将图像拖放到其桌面或其他文件夹，则生成的对象可能已更改为可执行脚本，而该脚本会在用户点击后运行任意代码。(CVE-2022-22756)

  - 如果文档创建了一个不含 <code>allow-scripts</code> 的沙盒 iframe，随后将一个元素附加到 iframe 的文档（例如包含 JavaScript 事件处理程序），则尽管已经存在 iframe 沙盒，事件处理程序也会运行。(CVE-2022-22759)

  - 使用 Web 工作线程导入资源时，错误消息会区分 <code>application/javascript</code> 响应和非脚本响应之间的差异。这可能被滥用于了解信息跨源。(CVE-2022-22760)

  - 在 Web 扩展程序的内容安全策略中使用 Web 可访问的扩展页面（带有 moz-extension: // scheme 的页面）时，未正确强制执行 frame-ancestors 指令。
    (CVE-2022-22761)

  - 当工作线程关闭时，可能导致脚本在生命周期后期某个本不应运行的时间点运行。(CVE-2022-22763)

  - Mozilla 开发人员和社区成员 Paul Adenot 及 Mozilla Fuzzing 团队报告 Thunderbird 91.5 中存在内存安全错误。其中某些错误展示出内存损坏迹象，我们推测若攻击者付出足够努力，就能利用部分错误运行任意代码。(CVE-2022-22764)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
158081	CentOS 7 : thunderbird (RHSA-2022:0538)	Nessus	CentOS Local Security Checks	2022/2/15	2024/10/9	critical
158568	SUSE SLES15 Security Update : MozillaFirefox (SUSE-SU-2022:0676-1)	Nessus	SuSE Local Security Checks	2022/3/3	2023/7/14	critical
158612	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2022:0696-1)	Nessus	SuSE Local Security Checks	2022/3/5	2023/7/14	critical
163228	Amazon Linux 2 : thunderbird (ALAS-2022-1818)	Nessus	Amazon Linux Local Security Checks	2022/7/15	2024/12/11	critical
159007	GLSA-202202-03 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2022/3/17	2025/3/6	critical
206859	NewStart CGSL MAIN 6.02 : firefox Multiple Vulnerabilities (NS-SA-2024-0066)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2025/9/25	critical
156605	Mozilla Firefox < 96.0	Nessus	MacOS X Local Security Checks	2022/1/11	2023/11/21	critical
156606	Mozilla Firefox < 96.0	Nessus	Windows	2022/1/11	2023/11/21	critical
248698	Linux Distros 未修补的漏洞：CVE-2022-22763	Nessus	Misc.	2025/8/12	2025/8/12	high
158047	RHEL 8：firefox (RHSA-2022: 0512)	Nessus	Red Hat Local Security Checks	2022/2/14	2024/11/7	critical
158049	Debian DLA-2921-1：thunderbird - LTS 安全更新	Nessus	Debian Local Security Checks	2022/2/14	2023/11/9	critical
158055	RHEL 7：firefox (RHSA-2022:0514)	Nessus	Red Hat Local Security Checks	2022/2/14	2024/11/7	critical
158066	RHEL 8：firefox (RHSA-2022: 0510)	Nessus	Red Hat Local Security Checks	2022/2/15	2024/11/7	critical
158081	CentOS 7：thunderbird (RHSA-2022:0538)	Nessus	CentOS Local Security Checks	2022/2/15	2024/10/9	critical
158083	CentOS 7: firefox (RHSA-2022:0514)	Nessus	CentOS Local Security Checks	2022/2/15	2024/10/9	critical
159007	GLSA-202202-03：Mozilla Firefox：多个漏洞	Nessus	Gentoo Local Security Checks	2022/3/17	2025/3/6	critical
163228	Amazon Linux 2：thunderbird (ALAS-2022-1818)	Nessus	Amazon Linux Local Security Checks	2022/7/15	2024/12/11	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical