The version of Firefox installed on the remote macOS or Mac OS X host is prior to 77.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-20 advisory.

  - Mozilla developers :Gijs (he/him), Randell Jesup reported memory safety bugs present in Firefox 76. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2020-12411)

  - NSS has shown timing differences when performing DSA signatures, which was exploitable and could     eventually leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2020-12406)

  - Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions     leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but     not observable from web content. (CVE-2020-12407)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-21 advisory.

  - Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76 and     Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code. (CVE-2020-12410)

  - NSS has shown timing differences when performing DSA signatures, which was exploitable and could     eventually leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2020-12406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in Thunderbird which could result in the setup of a non-encrypted IMAP connection, denial of service or potentially the execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-202006-07 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for MozillaFirefox fixes the following issues :

Mozilla Firefox was updated to version 68.9.0 Extended Support Release (bsc#1172402).

CVE-2020-12405: Fixed a use-after-free in SharedWorkerService.

CVE-2020-12406: Fixed a JavaScript Type confusion with NativeTypes.

CVE-2020-12410: Fixed multiple memory safety bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2615 advisory.

    [68.9.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [68.9.0-1]
    - Update to 68.9.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Mozilla: Security downgrade with IMAP STARTTLS leads to     information leakage (CVE-2020-12398)

  - Mozilla: Use-after-free in SharedWorkerService     (CVE-2020-12405)

  - Mozilla: JavaScript Type confusion with NativeTypes     (CVE-2020-12406)

  - Mozilla: Memory safety bugs fixed in Firefox 77 and     Firefox ESR 68.9 (CVE-2020-12410)

The version of thunderbird installed on the remote host is prior to 68.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1462 advisory.

    Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and     Firefox ESR < 68.9. (CVE-2020-12410)

    Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12406)

    If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response,     then Thunderbird will continue with an unencrypted connection, causing email data to be sent without     protection. This vulnerability affects Thunderbird < 68.9.0. (CVE-2020-12398)

    When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox     ESR < 68.9. (CVE-2020-12405)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaThunderbird fixes the following issues :

Mozilla Thunderbird 68.9.0 (bsc#1172402)

  - CVE-2020-12405: Fixed a use-after-free in     SharedWorkerService.

  - CVE-2020-12406: Fixed a JavaScript Type confusion with     NativeTypes.

  - CVE-2020-12410: Fixed multiple memory safety issues

  - CVE-2020-12398: Fixed a potential information leak due     to security downgrade with IMAP STARTTLS

  - Use a symbolic icon from branding internals

This update was imported from the SUSE:SLE-15:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
147407	NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2023/4/25	critical
137048	Mozilla Firefox < 77.0	Nessus	MacOS X Local Security Checks	2020/6/2	2025/11/18	high
137050	Mozilla Firefox ESR < 68.9	Nessus	MacOS X Local Security Checks	2020/6/2	2025/11/18	high
137375	Debian DSA-4702-1 : thunderbird - security update	Nessus	Debian Local Security Checks	2020/6/12	2024/3/7	high
137444	GLSA-202006-07 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/6/17	2024/3/7	high
137594	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:1556-1)	Nessus	SuSE Local Security Checks	2020/6/18	2024/3/6	high
137696	Oracle Linux 7 : thunderbird (ELSA-2020-2615)	Nessus	Oracle Linux Local Security Checks	2020/6/22	2024/10/22	high
137698	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20200619)	Nessus	Scientific Linux Local Security Checks	2020/6/22	2024/3/6	high
138628	Amazon Linux 2 : thunderbird (ALAS-2020-1462)	Nessus	Amazon Linux Local Security Checks	2020/7/20	2024/12/11	high
138677	openSUSE Security Update : MozillaThunderbird (openSUSE-2020-799)	Nessus	SuSE Local Security Checks	2020/7/20	2024/2/29	high

检测

插件搜索

critical

high

high

high

high

high

high

high

high

high