The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2036 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.8.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free during worker shutdown (CVE-2020-12387)

    * Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395)

    * Mozilla: Buffer overflow in SCTP chunk input validation (CVE-2020-6831)

    * Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-17 advisory.

  - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported memory safety bugs present in Firefox 75 and Firefox     ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2020-12395)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. Note: this issue only affects Firefox on Windows operating systems. (CVE-2020-12388,     CVE-2020-12389)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. (CVE-2020-12387)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. (CVE-2020-6831)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. (CVE-2020-12392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Mozilla: Use-after-free during worker shutdown     (CVE-2020-12387)

  - Mozilla: Memory safety bugs fixed in Firefox 76 and     Firefox ESR 68.8 (CVE-2020-12395)

  - Mozilla: Buffer overflow in SCTP chunk input validation     (CVE-2020-6831)

  - Mozilla: Arbitrary local file access with 'Copy as cURL'     (CVE-2020-12392)

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 76.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-16 advisory.

  - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported memory safety bugs present in Firefox 75 and Firefox     ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2020-12395)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. Note: this issue only affects Firefox on Windows operating systems. (CVE-2020-12388,     CVE-2020-12389)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. (CVE-2020-12387)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. (CVE-2020-6831)

  - Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks     (CVE-2020-12390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in Thunderbird which could result in spoofing the displayed sender email address, denial of service or potentially the execution of arbitrary code.

This update for MozillaThunderbird fixes the following issues :

  - Update to 68.8.0 ESR MFSA 2020-18 (bsc#1171186)

  - CVE-2020-12397 (bmo#1617370) Sender Email Address     Spoofing using encoded Unicode characters

  - CVE-2020-12387 (bmo#1545345) Use-after-free during     worker shutdown

  - CVE-2020-6831 (bmo#1632241) Buffer overflow in SCTP     chunk input validation

  - CVE-2020-12392 (bmo#1614468) Arbitrary local file access     with 'Copy as cURL'

  - CVE-2020-12393 (bmo#1615471) Devtools' 'Copy as cURL'     feature did not fully escape website-controlled data,     potentially leading to command injection

  - CVE-2020-12395 (bmo#1595886, bmo#1611482, bmo#1614704,     bmo#1624098, bmo#1625749, bmo#1626382, bmo#1628076,     bmo#1631508) Memory safety bugs fixed in Thunderbird     68.8.0

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2049 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 68.8.0.

    Security Fix(es):

    * Mozilla: Use-after-free during worker shutdown (CVE-2020-12387)

    * Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395)

    * usrsctp: Buffer overflow in AUTH chunk input validation (CVE-2020-6831)

    * Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392)

    * Mozilla: Sender Email Address Spoofing using encoded Unicode characters (CVE-2020-12397)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

Update to version 68.8.0 ESR (bsc#1171186) :

CVE-2020-12387: Use-after-free during worker shutdown

CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens

CVE-2020-12389: Sandbox escape with improperly separated process types

CVE-2020-6831: Buffer overflow in SCTP chunk input validation

CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'

CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2031 advisory.

    [68.8.0-1.0.1.el8_2]
    - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file
    - Remove upstream references [Orabug: 30530527]

    * Wed Apr 29 2020 Jan Horak <jhorak@redhat.com>
    - Update to 68.8.0 build1

    [68.7.0-3]
    - Added fix for rhbz#1821418

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2049 advisory.

    [68.8.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [68.8.0-1]
    - Update to 68.8.0 build2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
136354	RHEL 6 : firefox (RHSA-2020:2036)	Nessus	Red Hat Local Security Checks	2020/5/6	2024/11/7	critical
136356	Mozilla Firefox ESR < 68.8	Nessus	MacOS X Local Security Checks	2020/5/7	2025/11/18	critical
136389	Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20200506)	Nessus	Scientific Linux Local Security Checks	2020/5/7	2024/3/13	critical
136403	Mozilla Firefox < 76.0	Nessus	MacOS X Local Security Checks	2020/5/7	2025/11/18	critical
136431	Debian DSA-4683-1 : thunderbird - security update	Nessus	Debian Local Security Checks	2020/5/11	2024/3/13	critical
136461	openSUSE Security Update : MozillaThunderbird (openSUSE-2020-643)	Nessus	SuSE Local Security Checks	2020/5/11	2024/3/13	critical
136477	RHEL 6 : thunderbird (RHSA-2020:2049)	Nessus	Red Hat Local Security Checks	2020/5/11	2024/11/7	critical
136649	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:1209-1)	Nessus	SuSE Local Security Checks	2020/5/15	2024/3/12	critical
180897	Oracle Linux 8 : firefox (ELSA-2020-2031)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	critical
180988	Oracle Linux 6 : thunderbird (ELSA-2020-2049)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	critical
147407	NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2023/4/25	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical