The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4774 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.9.1.

    Security Fix(es):

    * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution     (CVE-2022-1529)

    * Mozilla: Prototype pollution in Top-Level Await implementation (CVE-2022-1802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:4776 advisory.

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,     they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This     vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and     Thunderbird < 91.9.1. (CVE-2022-1802)

  - An attacker could have sent a message to the parent process where the contents were used to double-index     into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript     executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox <     100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. (CVE-2022-1529)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5158 advisory.

    Multiple security issues were discovered in Thunderbird, which could result in denial of service or the     execution of arbitrary code. For the oldstable distribution (buster), these problems have been fixed in     version 1:91.10.0-1~deb10u1. For the stable distribution (bullseye), these problems have been fixed in     version 1:91.10.0-1~deb11u1. We recommend that you upgrade your thunderbird packages. For the detailed     security status of thunderbird please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/thunderbird

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4772 advisory.

    [91.9.1-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
    - Reference oracle-indexhtml within Requires [Orabug: 33802044]

    [91.9.1-1]
    - Update to 91.9.1 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4767 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.9.1 ESR.

    Security Fix(es):

    * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution     (CVE-2022-1529)

    * Mozilla: Prototype pollution in Top-Level Await implementation (CVE-2022-1802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4773 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.9.1.

    Security Fix(es):

    * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution     (CVE-2022-1529)

    * Mozilla: Prototype pollution in Top-Level Await implementation (CVE-2022-1802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5434-1 advisory.

    It was discovered that the methods of an Array object could be corrupted as a result of prototype     pollution by sending a message to the parent process. If a user were tricked into opening a specially     crafted website, an attacker could exploit this to execute JavaScript in a privileged context.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4769 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.9.1.

    Security Fix(es):

    * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution     (CVE-2022-1529)

    * Mozilla: Prototype pollution in Top-Level Await implementation (CVE-2022-1802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4769 advisory.

    [91.9.1-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [91.9.1-1]
    - Update to 91.9.1 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 91.9.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1804 advisory.

    The Mozilla Foundation Security Advisory describes this flaw as:An attacker could have sent a message to     the parent process where the contents were used to double-index into a JavaScript object, leading to     prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent     process. (CVE-2022-1529)

    he Mozilla Foundation Security Advisory describes this flaw as:If an attacker was able to corrupt the     methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of     attacker-controlled JavaScript code in a privileged context. (CVE-2022-1802)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4765 advisory.

    [91.9.1-1.0.1]
    - Replaced upstream package with oracle-indexhtml [Orabug: 33802044]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file
    - Removed Upstream references

    [91.9.1-1]
    - Update to 91.9.1 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4772 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.9.1.

    Security Fix(es):

    * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution     (CVE-2022-1529)

    * Mozilla: Prototype pollution in Top-Level Await implementation (CVE-2022-1802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:4765 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4730 advisory.

  - An attacker could have sent a message to the parent process where the contents were used to double-index     into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript     executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox <     100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. (CVE-2022-1529)

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,     they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This     vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and     Thunderbird < 91.9.1. (CVE-2022-1802)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-14 (Mozilla Thunderbird: Multiple Vulnerabilities)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-29967, CVE-2021-29969,     CVE-2021-29970, CVE-2021-29976, CVE-2021-29980, CVE-2021-29984, CVE-2021-29985, CVE-2021-29986,     CVE-2021-29988, CVE-2021-29989, CVE-2021-30547, CVE-2021-38492, CVE-2021-38493, CVE-2021-38495,     CVE-2021-38503, CVE-2021-38504, CVE-2021-38506, CVE-2021-38507, CVE-2021-38508, CVE-2021-38509,     CVE-2021-40529, CVE-2021-4129, CVE-2021-4140, CVE-2021-43528, CVE-2021-43529, CVE-2021-43536,     CVE-2021-43537, CVE-2021-43538, CVE-2021-43539, CVE-2021-43541, CVE-2021-43542, CVE-2021-43543,     CVE-2021-43545, CVE-2021-43546, CVE-2022-0566, CVE-2022-1196, CVE-2022-1197, CVE-2022-1520, CVE-2022-1529,     CVE-2022-1802, CVE-2022-1834, CVE-2022-2200, CVE-2022-2226, CVE-2022-22737, CVE-2022-22738,     CVE-2022-22739, CVE-2022-22740, CVE-2022-22741, CVE-2022-22742, CVE-2022-22743, CVE-2022-22745,     CVE-2022-22747, CVE-2022-22748, CVE-2022-22751, CVE-2022-22754, CVE-2022-22756, CVE-2022-22759,     CVE-2022-22760, CVE-2022-22761, CVE-2022-22763, CVE-2022-22764, CVE-2022-24713, CVE-2022-26381,     CVE-2022-26383, CVE-2022-26384, CVE-2022-26386, CVE-2022-26387, CVE-2022-26485, CVE-2022-26486,     CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289, CVE-2022-29909,     CVE-2022-29911, CVE-2022-29912, CVE-2022-29913, CVE-2022-29914, CVE-2022-29916, CVE-2022-29917,     CVE-2022-31736, CVE-2022-31737, CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,     CVE-2022-31747, CVE-2022-34468, CVE-2022-34470, CVE-2022-34472, CVE-2022-34478, CVE-2022-34479,     CVE-2022-34481, CVE-2022-34484, CVE-2022-36318, CVE-2022-36319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161632	RHEL 8 : thunderbird (RHSA-2022:4774)	Nessus	Red Hat Local Security Checks	2022/5/27	2024/11/7	high
162850	Rocky Linux 8 : firefox (RLSA-2022:4776)	Nessus	Rocky Linux Local Security Checks	2022/7/8	2023/11/7	high
161961	Debian DSA-5158-1 : thunderbird - security update	Nessus	Debian Local Security Checks	2022/6/8	2025/1/24	critical
163256	Oracle Linux 9 : thunderbird (ELSA-2022-4772)	Nessus	Oracle Linux Local Security Checks	2022/7/15	2024/10/22	high
161631	RHEL 8 : firefox (RHSA-2022:4767)	Nessus	Red Hat Local Security Checks	2022/5/27	2024/11/7	high
161625	RHEL 8 : thunderbird (RHSA-2022:4773)	Nessus	Red Hat Local Security Checks	2022/5/27	2024/11/7	high
161451	Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5434-1)	Nessus	Ubuntu Local Security Checks	2022/5/24	2024/8/27	high
161637	RHEL 8 : thunderbird (RHSA-2022:4769)	Nessus	Red Hat Local Security Checks	2022/5/27	2024/11/8	high
161657	Oracle Linux 8 : thunderbird (ELSA-2022-4769)	Nessus	Oracle Linux Local Security Checks	2022/5/30	2024/10/22	high
161937	Amazon Linux 2 : thunderbird (ALAS-2022-1804)	Nessus	Amazon Linux Local Security Checks	2022/6/7	2024/12/11	high
162793	Oracle Linux 9 : firefox (ELSA-2022-4765)	Nessus	Oracle Linux Local Security Checks	2022/7/7	2024/10/22	high
164849	RHEL 9 : thunderbird (RHSA-2022:4772)	Nessus	Red Hat Local Security Checks	2022/9/8	2024/11/8	high
167706	AlmaLinux 9 : firefox (ALSA-2022:4765)	Nessus	Alma Linux Local Security Checks	2022/11/16	2022/12/30	high
208634	CentOS 7 : thunderbird (RHSA-2022:4730)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/14	high
163986	GLSA-202208-14 : Mozilla Thunderbird: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/8/10	2023/10/16	critical

检测

插件搜索

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

critical