The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3882 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3882-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     September 09, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:115.15.0-1~deb11u1     CVE ID         : CVE-2024-8381 CVE-2024-8382 CVE-2024-8383 CVE-2024-8384

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For Debian 11 bullseye, these problems have been fixed in version     1:115.15.0-1~deb11u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of firefox installed on the remote host is prior to 115.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-029 advisory.

    2024-09-26: CVE-2024-7652 was added to this advisory.

    An error in the ECMA-262 specification relating to Async Generators could have resulted in a type     confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects     Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128. (CVE-2024-7652)

    A potentially exploitable type confusion could be triggered when looking up a property name on an object     being used as the `with` environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and     Firefox ESR < 115.15. (CVE-2024-8381)

    Internal browser event interfaces were exposed to web content when privileged EventHandler listener     callbacks ran for those events. Web content that tried to use those interfaces would not be able to use     them with elevated privileges, but their presence would indicate certain browser features had been used,     such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR <     128.2, and Firefox ESR < 115.15. (CVE-2024-8382)

    The Mozilla Foundation's Security Advisory reveals that Firefox didn't prompt for confirmation when     handling Usenet schemes like news: and snews:, which could allow malicious programs to register as     handlers. This oversight could enable a website to launch these programs without user consent.
    (CVE-2024-8383)

    The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected     at the right point between two passes. This could have led to memory corruption. This vulnerability     affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15. (CVE-2024-8384)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-40 advisory.

  - Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2024-8387)

  - A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an     exploitable type confusion vulnerability. (CVE-2024-8385)

  - A potentially exploitable type confusion could be triggered when looking up a property name on an object     being used as the <code>with</code> environment. (CVE-2024-8381)

  - Internal browser event interfaces were exposed to web content when privileged EventHandler listener     callbacks ran for those events. Web content that tried to use those interfaces would not be able to use     them with elevated privileges, but their presence would indicate certain browser features had been used,     such as when a user opened the Dev Tools console. (CVE-2024-8382)

  - Firefox normally asks for confirmation before asking the operating system to find an application to handle     a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes     news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an     unscrupulous program that the user downloaded could register itself as a handler. The website that served     the application download could then launch that application at will. (CVE-2024-8383)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6839 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a3a1caf5-6ba1-11ef-b9e8-b42e991fc52e advisory.

    security@mozilla.org reports:
    This entry contains 8 vulnerabilities:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
206779	Debian dla-3882 : thunderbird - security update	Nessus	Debian Local Security Checks	2024/9/9	2025/2/3	critical
207402	Amazon Linux 2 : firefox (ALASFIREFOX-2024-029)	Nessus	Amazon Linux Local Security Checks	2024/9/18	2025/2/3	critical
206471	Mozilla Firefox ESR < 128.2	Nessus	MacOS X Local Security Checks	2024/9/3	2025/11/18	critical
233271	RHEL 8 : firefox update (Important) (RHSA-2024:6839)	Nessus	Red Hat Local Security Checks	2025/3/22	2025/3/22	critical
206696	FreeBSD : firefox -- multiple vulnerabilities (a3a1caf5-6ba1-11ef-b9e8-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	2024/9/6	2025/2/3	critical

检测

插件搜索

critical

critical

critical

critical

critical