The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0850 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26381)

  - When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
    (CVE-2022-26383)

  - If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not     <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript     execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26384)

  - Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in     <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be     affected by other local users. This behavior was reverted to the original, user-specific directory.
    <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This     vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7. (CVE-2022-26386)

  - When installing an add-on, Firefox verified the signature before prompting the user; but while the user     was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have     noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
    (CVE-2022-26387)

  - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR     < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. (CVE-2022-26485)

  - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox <     97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
    (CVE-2022-26486)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3096:07 advisory.

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)
      * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)
      * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
      * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)
      * expat: Integer overflow in storeRawNames() (CVE-2022-25315)
      * Mozilla: Use-after-free in text reflows (CVE-2022-26381)
      * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)
      * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)
      * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)
      * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5106 advisory.

    Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary     code or information disclosure. For the oldstable distribution (buster), these problems have been fixed in     version 1:91.7.0-2~deb10u1. For the stable distribution (bullseye), these problems have been fixed in     version 1:91.7.0-2~deb11u1. We recommend that you upgrade your thunderbird packages. For the detailed     security status of thunderbird please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/thunderbird

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2942 advisory.

  - If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not     <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript     execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26384)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26381)

  - When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
    (CVE-2022-26383)

  - Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in     <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be     affected by other local users. This behavior was reverted to the original, user-specific directory.
    <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This     vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7. (CVE-2022-26386)

  - When installing an add-on, Firefox verified the signature before prompting the user; but while the user     was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have     noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
    (CVE-2022-26387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-14 (Mozilla Thunderbird: Multiple Vulnerabilities)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-29967, CVE-2021-29969,     CVE-2021-29970, CVE-2021-29976, CVE-2021-29980, CVE-2021-29984, CVE-2021-29985, CVE-2021-29986,     CVE-2021-29988, CVE-2021-29989, CVE-2021-30547, CVE-2021-38492, CVE-2021-38493, CVE-2021-38495,     CVE-2021-38503, CVE-2021-38504, CVE-2021-38506, CVE-2021-38507, CVE-2021-38508, CVE-2021-38509,     CVE-2021-40529, CVE-2021-4129, CVE-2021-4140, CVE-2021-43528, CVE-2021-43529, CVE-2021-43536,     CVE-2021-43537, CVE-2021-43538, CVE-2021-43539, CVE-2021-43541, CVE-2021-43542, CVE-2021-43543,     CVE-2021-43545, CVE-2021-43546, CVE-2022-0566, CVE-2022-1196, CVE-2022-1197, CVE-2022-1520, CVE-2022-1529,     CVE-2022-1802, CVE-2022-1834, CVE-2022-2200, CVE-2022-2226, CVE-2022-22737, CVE-2022-22738,     CVE-2022-22739, CVE-2022-22740, CVE-2022-22741, CVE-2022-22742, CVE-2022-22743, CVE-2022-22745,     CVE-2022-22747, CVE-2022-22748, CVE-2022-22751, CVE-2022-22754, CVE-2022-22756, CVE-2022-22759,     CVE-2022-22760, CVE-2022-22761, CVE-2022-22763, CVE-2022-22764, CVE-2022-24713, CVE-2022-26381,     CVE-2022-26383, CVE-2022-26384, CVE-2022-26386, CVE-2022-26387, CVE-2022-26485, CVE-2022-26486,     CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289, CVE-2022-29909,     CVE-2022-29911, CVE-2022-29912, CVE-2022-29913, CVE-2022-29914, CVE-2022-29916, CVE-2022-29917,     CVE-2022-31736, CVE-2022-31737, CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,     CVE-2022-31747, CVE-2022-34468, CVE-2022-34470, CVE-2022-34472, CVE-2022-34478, CVE-2022-34479,     CVE-2022-34481, CVE-2022-34484, CVE-2022-36318, CVE-2022-36319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-0850 advisory.

    [91.7.0-2.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
    - Enabled aarch64 build

    [91.7.0-2]
    - Update to 91.7.0 build2

    [91.7.0-1]
    - Update to 91.7.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-0845 advisory.

    [91.7.0-2.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [91.7.0-2]
    - Update to 91.7.0 build2

    [91.7.0-1]
    - Update to 91.7.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0850 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

    * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * Mozilla: Use-after-free in text reflows (CVE-2022-26381)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

    * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

    * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

    * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

    * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 91.7.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1779 advisory.

    A flaw was found in Thunderbird. The vulnerability occurs due to an out-of-bounds write of one byte when     processing the message. This flaw allows an attacker to craft an email message that causes Thunderbird to     perform an out-of-bounds write. (CVE-2022-0566)

    A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences (for example, from start tag     names) to the XML processing application on top of expat can lead to arbitrary code execution. This issue     is dependent on how invalid UTF-8 is handled inside the XML processor. (CVE-2022-25235)

    A flaw was found in expat. Passing one or more namespace separator characters in the xmlns[:prefix]     attribute values made expat send malformed tag names to the XML processor on top of expat. This issue     causes arbitrary code execution depending on how unexpected cases are handled inside the XML processor.
    (CVE-2022-25236)

    An integer overflow was found in expat. The issue occurs in storeRawNames() by abusing the m_buffer     expansion logic to allow allocations very close to INT_MAX and out-of-bounds heap writes. This flaw can     cause a denial of service or potentially arbitrary code execution. (CVE-2022-25315)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. (CVE-2022-26381)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. (CVE-2022-26383)

    The Mozilla Foundation Security Advisory describes this flaw as:

    If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts,     they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the     sandbox. (CVE-2022-26384)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Previously Thunderbird for macOS and Linux would download temporary files to a user-specific directory in     /tmp, but this behavior was changed to download them to /tmp where they could be affected by other local     users. This behavior was reverted to the original, user-specific directory. (CVE-2022-26386)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When installing an add-on, Thunderbird verified the signature before prompting the user; but while the     user was confirming the prompt, the underlying add-on file could have been modified and Thunderbird would     not have noticed. (CVE-2022-26387)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. (CVE-2022-26485)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape. We have had reports of attacks in the wild abusing this flaw. (CVE-2022-26486)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3104:04 advisory.

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)
      * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)
      * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
      * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)
      * expat: Integer overflow in storeRawNames() (CVE-2022-25315)
      * Mozilla: Use-after-free in text reflows (CVE-2022-26381)
      * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)
      * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)
      * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)
      * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)
      * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3095:06 advisory.

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)
      * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)
      * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
      * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)
      * expat: Integer overflow in storeRawNames() (CVE-2022-25315)
      * Mozilla: Use-after-free in text reflows (CVE-2022-26381)
      * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)
      * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)
      * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)
      * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
159320	CentOS 7 : thunderbird (RHSA-2022:0850)	Nessus	CentOS Local Security Checks	2022/3/29	2024/10/9	critical
294414	MiracleLinux 7 : firefox-91.7.0-3.0.1.el7.AXS7 (AXSA:2022-3096:07)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
159205	Debian DSA-5106-1 : thunderbird - security update	Nessus	Debian Local Security Checks	2022/3/24	2025/1/24	critical
158783	Debian DLA-2942-1 : firefox-esr - LTS security update	Nessus	Debian Local Security Checks	2022/3/10	2023/11/6	critical
163986	GLSA-202208-14 : Mozilla Thunderbird: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/8/10	2023/10/16	critical
158903	Oracle Linux 7 : thunderbird (ELSA-2022-0850)	Nessus	Oracle Linux Local Security Checks	2022/3/14	2024/10/22	critical
158904	Oracle Linux 8 : thunderbird (ELSA-2022-0845)	Nessus	Oracle Linux Local Security Checks	2022/3/14	2024/10/22	critical
158907	RHEL 7 : thunderbird (RHSA-2022:0850)	Nessus	Red Hat Local Security Checks	2022/3/14	2025/8/15	critical
160270	Amazon Linux 2 : thunderbird (ALAS-2022-1779)	Nessus	Amazon Linux Local Security Checks	2022/4/27	2024/12/11	critical
291667	MiracleLinux 8 : thunderbird-91.7.0-2.el8.ML.1 (AXSA:2022-3104:04)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
294697	MiracleLinux 8 : firefox-91.7.0-3.el8.ML.1 (AXSA:2022-3095:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical