The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-9922206495 advisory.

    - New upstream update (130.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-1304d7f338 advisory.

    - New upstream update (130.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0490 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-7652:
    An error in the ECMA-262 specification relating to Async Generators could have resulted in a type     confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects     Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

    CVE-2024-8381:
    A potentially exploitable type confusion could be triggered when looking up a property name on an object     being used as the with environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and     Firefox ESR < 115.15.

    CVE-2024-8382:
    Internal browser event interfaces were exposed to web content when privileged EventHandler listener     callbacks ran for those events. Web content that tried to use those interfaces would not be able to use     them with elevated privileges, but their presence would indicate certain browser features had been used,     such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR <     128.2, and Firefox ESR < 115.15.

    CVE-2024-8384:
    The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected     at the right point between two passes. This could have led to memory corruption. This vulnerability     affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.

    CVE-2024-8385:
    A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an     exploitable type confusion vulnerability. This vulnerability affects Firefox < 130 and Firefox ESR <     128.2.

    CVE-2024-8386:
    If a site had been granted the permission to open popup windows, it could cause Select elements to appear     on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130 and Firefox     ESR < 128.2.

    CVE-2024-8387:
    Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 130 and Firefox ESR < 128.2.

    CVE-2024-8394:
    When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug     leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8860:21 advisory.

    * thunderbird: 115.15/128.2 ()
      * mozilla: Type confusion when looking up a property name in a with block (CVE-2024-8381)
      * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener     callbacks ran (CVE-2024-8382)
      * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions     (CVE-2024-8384)
      * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
      * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
      * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2     (CVE-2024-8387)
      * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394)
      * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
206746	Fedora 40 : firefox (2024-9922206495)	Nessus	Fedora Local Security Checks	2024/9/7	2025/2/3	critical
206866	Fedora 39 : firefox (2024-1304d7f338)	Nessus	Fedora Local Security Checks	2024/9/10	2025/2/3	critical
239891	TencentOS Server 3: thunderbird (TSSA-2024:0490)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
293464	MiracleLinux 9 : thunderbird-128.2.0-1.el9_4.ML.1 (AXSA:2024-8860:21)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical