The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_5045 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 (BZ#2030116)

    * Mozilla: URL leakage when navigating while executing asynchronous function (CVE-2021-43536)

    * Mozilla: Heap buffer overflow when using structured clone (CVE-2021-43537)

    * Mozilla: Missing fullscreen and pointer lock notification when requesting both (CVE-2021-43538)

    * Mozilla: GC rooting failure when calling wasm instance methods (CVE-2021-43539)

    * Mozilla: External protocol handler parameters were unescaped (CVE-2021-43541)

    * Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler     (CVE-2021-43542)

    * Mozilla: Bypass of CSP sandbox directive when embedding (CVE-2021-43543)

    * Mozilla: JavaScript unexpectedly enabled for the composition area (CVE-2021-43528)

    * Mozilla: Denial of Service when using the Location API in a loop (CVE-2021-43545)

    * Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed (CVE-2021-43546)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_5013 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4

    * Mozilla: URL leakage when navigating while executing asynchronous function (CVE-2021-43536)

    * Mozilla: Heap buffer overflow when using structured clone (CVE-2021-43537)

    * Mozilla: Missing fullscreen and pointer lock notification when requesting both (CVE-2021-43538)

    * Mozilla: GC rooting failure when calling wasm instance methods (CVE-2021-43539)

    * Mozilla: External protocol handler parameters were unescaped (CVE-2021-43541)

    * Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler     (CVE-2021-43542)

    * Mozilla: Bypass of CSP sandbox directive when embedding (CVE-2021-43543)

    * Mozilla: Denial of Service when using the Location API in a loop (CVE-2021-43545)

    * Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed (CVE-2021-43546)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5248-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, obtain sensitive information, trick a user into accepting unwanted permissions, conduct header     splitting attacks, conduct spoofing attacks, bypass security restrictions, confuse the user, or execute     arbitrary code. (CVE-2021-4129, CVE-2021-4140, CVE-2021-29981, CVE-2021-29982, CVE-2021-29987,     CVE-2021-29991, CVE-2021-38495, CVE-2021-38496, CVE-2021-38497, CVE-2021-38498, CVE-2021-38500,     CVE-2021-38501, CVE-2021-38503, CVE-2021-38504, CVE-2021-38506, CVE-2021-38507, CVE-2021-38508,     CVE-2021-38509, CVE-2021-43534, CVE-2021-43535, CVE-2021-43536, CVE-2021-43537, CVE-2021-43538,     CVE-2021-43539, CVE-2021-43541, CVE-2021-43542, CVE-2021-43543, CVE-2021-43545, CVE-2021-43656,     CVE-2022-22737, CVE-2022-22738, CVE-2022-22739, CVE-2022-22740, CVE-2022-22741, CVE-2022-22742,     CVE-2022-22743, CVE-2022-22745, CVE-2022-22747, CVE-2022-22748, CVE-2022-22751)

    It was discovered that Thunderbird ignored the configuration to require STARTTLS for an SMTP connection. A     person-in-the-middle could potentially exploit this to perform a downgrade attack in order to intercept     messages or take control of a session. (CVE-2021-38502)

    It was discovered that JavaScript was unexpectedly enabled in the composition area. An attacker could     potentially exploit this in combination with another vulnerability, with unspecified impacts.
    (CVE-2021-43528)

    A buffer overflow was discovered in the Matrix chat library bundled with Thunderbird. An attacker could     potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2021-44538)

    It was discovered that Thunderbird's OpenPGP integration only considered the inner signed message when     checking signature validity in a message that contains an additional outer MIME layer. An attacker could     potentially exploit this to trick the user into thinking that a message has a valid signature.
    (CVE-2021-4126)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
359020	Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2021_5045)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
359136	Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2021_5013)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
156961	Ubuntu 18.04 LTS / 20.04 LTS : Thunderbird vulnerabilities (USN-5248-1)	Nessus	Ubuntu Local Security Checks	2022/1/22	2025/3/6	critical

检测

插件搜索

critical

critical

critical