The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-4111 advisory.

    [68.3.0-1.0.1]
    - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file
    - Remove upstream references [Orabug: 30530527]

    [68.3.0-1]
    - Update to 68.3.0 ESR

    [68.2.0-4]
    - Added patch for TLS 1.3 support.

    [68.2.0-3]
    - Rebuild

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4216-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information, or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 68.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-38 advisory.

  - Mozilla developers Christoph Diehl, Nathan Froyd, Jason Kratzer, Christian Holler, Karl Tomlinson, Tyson     Smith reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2019-17012)

  - When using nested workers, a use-after-free could occur during worker destruction. This resulted in a     potentially exploitable crash. (CVE-2019-17008)

  - When setting a thread name on Windows in WebRTC, an incorrect number of arguments could have been     supplied, leading to stack corruption and a potentially exploitable crash.  Note: this issue only occurs     on Windows. Other operating systems are unaffected. (CVE-2019-13722)

  - When encrypting with a block cipher, if a call to <code>NSCEncryptUpdate</code> was made with data smaller     than the block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. (CVE-2019-11745)

  - When running, the updater service wrote status and log files to an unrestricted location; potentially     allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater     service.  Note: This attack requires local system access and only affects Windows. Other operating systems     are not affected. (CVE-2019-17009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 68.3.0 ESR.

Security Fix(es) :

* Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

* Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

* Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

* Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

* Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update upgrades Thunderbird to version 68.3.0.

Security Fix(es) :

  - Mozilla: Use-after-free in worker destruction     (CVE-2019-17008)

  - Mozilla: Memory safety bugs fixed in Firefox 71 and     Firefox ESR 68.3 (CVE-2019-17012)

  - Mozilla: Buffer overflow in plain text serializer     (CVE-2019-17005)

  - Mozilla: Use-after-free when performing device     orientation checks (CVE-2019-17010)

  - Mozilla: Use-after-free when retrieving a document in     antitracking (CVE-2019-17011)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
131829	Oracle Linux 8 : firefox (ELSA-2019-4111)	Nessus	Oracle Linux Local Security Checks	2019/12/9	2024/10/22	high
131924	Ubuntu 18.04 LTS : Firefox vulnerabilities (USN-4216-1)	Nessus	Ubuntu Local Security Checks	2019/12/10	2024/8/29	high
131956	Mozilla Thunderbird < 68.3	Nessus	Windows	2019/12/12	2025/11/18	high
131958	CentOS 6 : firefox (CESA-2019:4108)	Nessus	CentOS Local Security Checks	2019/12/12	2024/4/4	high
131990	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20191211)	Nessus	Scientific Linux Local Security Checks	2019/12/12	2024/4/4	high
147407	NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2023/4/25	critical

检测

插件搜索

high

high

high

high

high

critical