The version of Firefox ESR installed on the remote Windows host is prior to 115.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-34 advisory.

  - Unexpected marking work at the start of sweeping could have led to a use-after-free. (CVE-2024-7527)

  - Insufficient checks when processing graphics shared memory could have led to memory corruption. This could     be leveraged by an attacker to perform a sandbox escape. (CVE-2024-7519)

  - Incomplete WebAssembly exception handing could have led to a use-after-free. (CVE-2024-7521)

  - Editor code failed to check an attribute value. This could have led to an out-of-bounds read.
    (CVE-2024-7522)

  - Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking     Protection.  On a site protected by Content Security Policy in strict-dynamic mode, an attacker able to     inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS,     bypassing the CSP strict-dynamic protection. (CVE-2024-7524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 128.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-35 advisory.

  - Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. (CVE-2024-7528)

  - Insufficient checks when processing graphics shared memory could have led to memory corruption. This could     be leveraged by an attacker to perform a sandbox escape. (CVE-2024-7519)

  - Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to     perform a spoofing attack. (CVE-2024-7518)

  - A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code     execution. (CVE-2024-7520)

  - Incomplete WebAssembly exception handing could have led to a use-after-free. (CVE-2024-7521)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 115.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-38 advisory.

  - Unexpected marking work at the start of sweeping could have led to a use-after-free. (CVE-2024-7527)

  - Insufficient checks when processing graphics shared memory could have led to memory corruption. This could     be leveraged by an attacker to perform a sandbox escape. (CVE-2024-7519)

  - Incomplete WebAssembly exception handing could have led to a use-after-free. (CVE-2024-7521)

  - Editor code failed to check an attribute value. This could have led to an out-of-bounds read.
    (CVE-2024-7522)

  - It was possible for a web extension with minimal permissions to create a <code>StreamFilter</code> which     could be used to read and modify the response body of requests on any site. (CVE-2024-7525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-37 advisory.

  - Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. (CVE-2024-7528)

  - Insufficient checks when processing graphics shared memory could have led to memory corruption. This could     be leveraged by an attacker to perform a sandbox escape. (CVE-2024-7519)

  - Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to     perform a spoofing attack. (CVE-2024-7518)

  - A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code     execution. (CVE-2024-7520)

  - Incomplete WebAssembly exception handing could have led to a use-after-free. (CVE-2024-7521)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5322 advisory.

    [115.14.0-2.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [115.14.0]
    - Add debranding patches (Mustafa Gezen)
    - Add OpenELA default preferences (Louis Abel)

    [115.14.0-2]
    - Update to 115.14.0 build2

    [115.14.0-1]
    - Update to 115.14.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:5327 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * Firefox: 115.14/128.1 ESR ()

    * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)

    * mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)

    * mozilla: Type confusion in WebAssembly (CVE-2024-7520)

    * mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)

    * mozilla: Out of bounds read in editor component (CVE-2024-7522)

    * mozilla: CSP strict-dynamic bypass using web-compatibility shims (CVE-2024-7524)

    * mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)

    * mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)

    * mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)

    * mozilla: Use-after-free in IndexedDB (CVE-2024-7528)

    * mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

    * mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines     (CVE-2024-7531)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:5391 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * Firefox: 115.14/128.1 ESR ()

    * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)

    * mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)

    * mozilla: Type confusion in WebAssembly (CVE-2024-7520)

    * mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)

    * mozilla: Out of bounds read in editor component (CVE-2024-7522)

    * mozilla: CSP strict-dynamic bypass using web-compatibility shims (CVE-2024-7524)

    * mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)

    * mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)

    * mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)

    * mozilla: Use-after-free in IndexedDB (CVE-2024-7528)

    * mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:5527 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * Thunderbird: 115.14/128.1 ()

    * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)

    * mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)

    * mozilla: Type confusion in WebAssembly (CVE-2024-7520)

    * mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)

    * mozilla: Out of bounds read in editor component (CVE-2024-7522)

    * mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)

    * mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)

    * mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)

    * mozilla: Use-after-free in IndexedDB (CVE-2024-7528)

    * mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6966-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information across domains, or execute arbitrary code. (CVE-2024-7518, CVE-2024-7521,     CVE-2024-7524, CVE-2024-7526, CVE-2024-7527, CVE-2024-7528, CVE-2024-7529, CVE-2024-7530, CVE-2024-7531)

    It was discovered that Firefox did not properly manage certain memory operations when processing graphics     shared memory. An attacker could potentially exploit this issue to escape the sandbox. (CVE-2024-7519)

    Nan Wang discovered that Firefox did not properly handle type check in WebAssembly. An attacker could     potentially exploit this issue to execute arbitrary code. (CVE-2024-7520)

    Irvan Kurniawan discovered that Firefox did not properly check an attribute value in the editor component,     leading to an out-of-bounds read vulnerability. An attacker could possibly use this issue to cause a     denial of service or expose sensitive information. (CVE-2024-7522)

    Rob Wu discovered that Firefox did not properly check permissions when creating a StreamFilter. An     attacker could possibly use this issue to modify response body of requests on any site using a web     extension. (CVE-2024-7525)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3112-1 advisory.

    - Mozilla Thunderbird 115.14
      * fixed: When using an external installation of GnuPG,         Thunderbird occassionally sent/received corrupted messages
      * fixed: Users of external GnuPG were unable to decrypt         incorrectly encoded messages (bmo#1906903)
      * fixed: Flatpak install of 128.0esr was incorrectly downgraded         to 115.13.0esr (bmo#1908299)
      * fixed: Security fixes       MFSA 2024-38 (bsc#1228648)
      * CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
      * CVE-2024-7521: Incomplete WebAssembly exception handing
      * CVE-2024-7522: Out of bounds read in editor component
      * CVE-2024-7525: Missing permission check when creating a StreamFilter
      * CVE-2024-7526: Uninitialized memory used by WebGL
      * CVE-2024-7527: Use-after-free in JavaScript garbage collection
      * CVE-2024-7529: Document content could partially obscure security prompts

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8690:18 advisory.

    * EMBARGOED Thunderbird: 115.14/128.1 ()
      * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
      * mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
      * mozilla: Type confusion in WebAssembly (CVE-2024-7520)
      * mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
      * mozilla: Out of bounds read in editor component (CVE-2024-7522)
      * mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
      * mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
      * mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
      * mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
      * mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8693:19 advisory.

    * Thunderbird: 115.14/128.1
      * mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
      * mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
      * mozilla: Type confusion in WebAssembly (CVE-2024-7520)
      * mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
      * mozilla: Out of bounds read in editor component (CVE-2024-7522)
      * mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
      * mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
      * mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
      * mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
      * mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8710:29 advisory.

    * Firefox: 115.14/128.1 ESR ()
      * mozilla: Fullscreen notification dialog can be obscured by document content     (CVE-2024-7518)
      * mozilla: Out of bounds memory access in graphics shared memory handling     (CVE-2024-7519)
      * mozilla: Type confusion in WebAssembly (CVE-2024-7520)
      * mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
      * mozilla: Out of bounds read in editor component (CVE-2024-7522)
      * mozilla: CSP strict-dynamic bypass using web-compatibility shims     (CVE-2024-7524)
      * mozilla: Missing permission check when creating a StreamFilter     (CVE-2024-7525)
      * mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
      * mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
      * mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
      * mozilla: Document content could partially obscure security prompts     (CVE-2024-7529)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
205012	Mozilla Firefox ESR < 115.14	Nessus	Windows	2024/8/6	2025/11/18	critical
205014	Mozilla Firefox ESR < 128.1	Nessus	Windows	2024/8/6	2025/11/18	critical
205038	Mozilla Thunderbird < 115.14	Nessus	Windows	2024/8/6	2025/11/18	critical
205040	Mozilla Thunderbird < 128.1	Nessus	MacOS X Local Security Checks	2024/8/6	2025/11/18	critical
205488	Oracle Linux 9 : firefox (ELSA-2024-5322)	Nessus	Oracle Linux Local Security Checks	2024/8/14	2025/9/9	critical
205510	RHEL 9 : firefox (RHSA-2024:5327)	Nessus	Red Hat Local Security Checks	2024/8/14	2024/11/7	critical
205555	RHEL 8 : firefox (RHSA-2024:5391)	Nessus	Red Hat Local Security Checks	2024/8/15	2025/3/10	critical
205769	RHEL 8 : thunderbird (RHSA-2024:5527)	Nessus	Red Hat Local Security Checks	2024/8/19	2024/11/7	critical
205779	Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-6966-1)	Nessus	Ubuntu Local Security Checks	2024/8/19	2024/9/6	critical
206583	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2024:3112-1)	Nessus	SuSE Local Security Checks	2024/9/4	2024/9/4	critical
292574	MiracleLinux 9 : thunderbird-115.14.0-1.el9_4.ML.1 (AXSA:2024-8690:18)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
293105	MiracleLinux 8 : thunderbird-115.14.0-1.el8_10.ML.1 (AXSA:2024-8693:19)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
293499	MiracleLinux 7 : firefox-115.14.0-2.0.1.el7.AXS7 (AXSA:2024-8710:29)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical