The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6723 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-6683 advisory.

    [128.2.0-1.0.2]
    - Fix prefs for new nss [Orabug: 37079813]

    [128.2.0-1.0.1]
    - Add Oracle prefs

    [128.2.0]
    - Add OpenELA debranding

    [128.2.0-1]
    - Update to 128.2.0

    [128.1.1-2]
    - Update to 128.1.1

    [128.0-1]
    - Update to 128.0 final

    [128.0b4-1]
    - Update to 128.0b4

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6681 advisory.

    [128.2.0-1.0.2]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773]

    [128.2.0-1.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [128.2.0]
    - Add debranding patches (Mustafa Gezen)
    - Add OpenELA default preferences (Louis Abel)

    [128.2.0-1]
    - Update to 128.2.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:6682 advisory.

    * firefox: 115.15/128.2 ESR ()
    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
    * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)
    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6681 advisory.

    * firefox: 115.15/128.2 ESR ()
    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
    * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)
    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:6683 advisory.

    * thunderbird: 115.15/128.2 ()
    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)
    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6683 advisory.

    * thunderbird: 115.15/128.2 ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6681 advisory.

    * firefox: 115.15/128.2 ESR ()

    * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)

    * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)

    * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)

    * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

    * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)

    * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

    * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)

    * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 130.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-39 advisory.

  - Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2024-8389)

  - A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an     exploitable type confusion vulnerability. (CVE-2024-8385)

  - A potentially exploitable type confusion could be triggered when looking up a property name on an object     being used as the <code>with</code> environment. (CVE-2024-8381)

  - Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification     announcing the transition to fullscreen mode after the fix for CVE-2023-6870 in Firefox 121. This could     lead to spoofing the browser UI if the sudden appearance of the prompt distracted the user from noticing     the visual transition happening behind the prompt. These notifications now use the Android Toast feature.
    This bug only affects Firefox on Android. Other operating systems are unaffected. (CVE-2024-8388)

  - Internal browser event interfaces were exposed to web content when privileged EventHandler listener     callbacks ran for those events. Web content that tried to use those interfaces would not be able to use     them with elevated privileges, but their presence would indicate certain browser features had been used,     such as when a user opened the Dev Tools console. (CVE-2024-8382)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 128.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-40 advisory.

  - Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2024-8387)

  - A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an     exploitable type confusion vulnerability. (CVE-2024-8385)

  - A potentially exploitable type confusion could be triggered when looking up a property name on an object     being used as the <code>with</code> environment. (CVE-2024-8381)

  - Internal browser event interfaces were exposed to web content when privileged EventHandler listener     callbacks ran for those events. Web content that tried to use those interfaces would not be able to use     them with elevated privileges, but their presence would indicate certain browser features had been used,     such as when a user opened the Dev Tools console. (CVE-2024-8382)

  - Firefox normally asks for confirmation before asking the operating system to find an application to handle     a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes     news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an     unscrupulous program that the user downloaded could register itself as a handler. The website that served     the application download could then launch that application at will. (CVE-2024-8383)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6992-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information across domains, or execute arbitrary code. (CVE-2024-8382, CVE-2024-8383,     CVE-2024-8386, CVE-2024-8387, CVE-2024-8389)

    Nils Bars discovered that Firefox contained a type confusion vulnerability when performing certain     property name lookups. An attacker could potentially exploit this issue to cause a denial of service, or     execute arbitrary code. (CVE-2024-8381)

    It was discovered that Firefox did not properly manage memory during garbage collection. An attacker could     potentially exploit this issue to

    cause a denial of service, or execute arbitrary code. (CVE-2024-8384)

    Seunghyun Lee discovered that Firefox contained a type confusion

    vulnerability when handling certain ArrayTypes. An attacker could potentially exploit this issue to cause     a denial of service, or execute arbitrary code. (CVE-2024-8385)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6850 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6786 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0512 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2024-7652:
    An error in the ECMA-262 specification relating to Async Generators could have resulted in a type     confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects     Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

    CVE-2024-8381:
    A potentially exploitable type confusion could be triggered when looking up a property name on an object     being used as the with environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and     Firefox ESR < 115.15.

    CVE-2024-8382:
    Internal browser event interfaces were exposed to web content when privileged EventHandler listener     callbacks ran for those events. Web content that tried to use those interfaces would not be able to use     them with elevated privileges, but their presence would indicate certain browser features had been used,     such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR <     128.2, and Firefox ESR < 115.15.

    CVE-2024-8383:
    Firefox normally asks for confirmation before asking the operating system to find an application to handle     a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes     news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an     unscrupulous program that the user downloaded could register itself as a handler. The website that served     the application download could then launch that application at will. This vulnerability affects Firefox <     130, Firefox ESR < 128.2, and Firefox ESR < 115.15.

    CVE-2024-8384:
    The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected     at the right point between two passes. This could have led to memory corruption. This vulnerability     affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.

    CVE-2024-8385:
    A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an     exploitable type confusion vulnerability. This vulnerability affects Firefox < 130 and Firefox ESR <     128.2.

    CVE-2024-8386:
    If a site had been granted the permission to open popup windows, it could cause Select elements to appear     on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130 and Firefox     ESR < 128.2.

    CVE-2024-8387:
    Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 130 and Firefox ESR < 128.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8869:31 advisory.

    * firefox: 115.15/128.2 ESR ()
      * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
      * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
      * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)
      * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions     (CVE-2024-8384)
      * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
      * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
      * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
      * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8867:30 advisory.

    * firefox: 115.15/128.2 ESR ()
      * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
      * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
      * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383)
      * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions     (CVE-2024-8384)
      * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
      * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
      * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
      * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
207353	RHEL 8 : thunderbird (RHSA-2024:6723)	Nessus	Red Hat Local Security Checks	2024/9/17	2025/2/3	critical
207431	Oracle Linux 9 : thunderbird (ELSA-2024-6683)	Nessus	Oracle Linux Local Security Checks	2024/9/19	2025/9/11	critical
207432	Oracle Linux 9 : firefox (ELSA-2024-6681)	Nessus	Oracle Linux Local Security Checks	2024/9/19	2025/9/11	critical
207527	AlmaLinux 8 : firefox (ALSA-2024:6682)	Nessus	Alma Linux Local Security Checks	2024/9/20	2025/2/3	critical
207535	AlmaLinux 9 : firefox (ALSA-2024:6681)	Nessus	Alma Linux Local Security Checks	2024/9/20	2025/2/3	critical
207536	AlmaLinux 9 : thunderbird (ALSA-2024:6683)	Nessus	Alma Linux Local Security Checks	2024/9/20	2025/2/3	critical
207923	Rocky Linux 9 : thunderbird (RLSA-2024:6683)	Nessus	Rocky Linux Local Security Checks	2024/9/30	2025/2/3	critical
207937	Rocky Linux 9 : firefox (RLSA-2024:6681)	Nessus	Rocky Linux Local Security Checks	2024/9/30	2025/2/3	critical
206467	Mozilla Firefox < 130.0	Nessus	Windows	2024/9/3	2025/11/18	critical
206470	Mozilla Firefox ESR < 128.2	Nessus	Windows	2024/9/3	2025/11/18	critical
206626	Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-6992-1)	Nessus	Ubuntu Local Security Checks	2024/9/5	2025/2/3	critical
233229	RHEL 8 : firefox update (Important) (RHSA-2024:6850)	Nessus	Red Hat Local Security Checks	2025/3/22	2025/3/22	critical
233247	RHEL 9 : firefox update (Important) (RHSA-2024:6786)	Nessus	Red Hat Local Security Checks	2025/3/22	2025/3/22	critical
239711	TencentOS Server 2: firefox update (Important) (TSSA-2024:0512)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	critical
292136	MiracleLinux 8 : firefox-128.2.0-1.el8_10.ML.1 (AXSA:2024-8869:31)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
292816	MiracleLinux 9 : firefox-128.2.0-1.el9_4.ML.1 (AXSA:2024-8867:30)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical