The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1336 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1337 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:1337 advisory.

  - Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

  - Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

  - Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

  - Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

  - Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0835-1 advisory.

    Update to version 102.9.0 ESR (bsc#1209173):

    - CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
    - CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
    - CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
    - CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
    - CVE-2023-25751: Incorrect code generation during JIT compilation
    - CVE-2023-28160: Redirect to Web Extension files may have leaked local path
    - CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered     navigation
    - CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded     in the same tab
    - CVE-2023-28162: Invalid downcast in Worklets
    - CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
    - CVE-2023-28163: Windows Save As dialog resolved environment variables
    - CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
    - CVE-2023-28177: Memory safety bugs fixed in Firefox 111

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1402 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.9.0.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1444 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1479 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1736-1 advisory.

    MFSA 2023-12 (bsc#1209953):

    - CVE-2023-28427: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (bmo#1822595)

    MFSA 2023-11 (bsc#1209173):

    - CVE-2023-25751: Incorrect code generation during JIT compilation (bmo#1814899).
    - CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered     navigation (bmo#1809122).
    - CVE-2023-28162: Invalid downcast in Worklets (bmo#1811327).
    - CVE-2023-25752: Potential out-of-bounds when accessing throttled streams (bmo#1811627).
    - CVE-2023-28163: Windows Save As dialog resolved environment variables (bmo#1817768)
    - CVE-2023-28176: Memory safety bugs fixed in Thunderbird 102.9 (bmo#1808352, bmo#1811637, bmo#1815904,     bmo#1817442, bmo#1818674).

    Mozilla Thunderbird 102.9:

    - fixed: Notification about a sender's changed OpenPGP key was not immediately visible (bmo#1814003)
    - fixed: TLS Certificate Override dialog did not appear when retrieving messages via IMAP using 'Get     Messages' context menu (bmo#1816596)
    - fixed: Spellcheck dictionaries were missing from localized Thunderbird builds that should have included     them (bmo#1818257)
    - fixed: Tooltips for 'Show/Hide' calendar toggle did not display (bmo#1809557)
    - fixed: Various security fixes

    Mozilla Thunderbird 102.9.1:

    - fixed: Thunderbird was unable to open file URLs from command line (URLs beginning with 'file://')     (bmo#1816343)
    - fixed: Source strings for localized builds not uploaded to FTP as expected (bmo#1817086)
    - fixed: Visual and theme improvements (bmo#1821358, bmo#1822286)
    - fixed: Security fixes

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5235:13 advisory.

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)
      * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)
      * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)
      * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)
      * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0043 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-25752:
      The Mozilla Foundation Security Advisory describes the issue that when accessing throttled streams, the     count of available bytes needs to be checked in the calling function to be within bounds. This may have     led future code to be incorrect and vulnerable.

      CVE-2023-25751:
      The Mozilla Foundation Security Advisory describes the issue of invalidating JIT code while following an     iterator. The newly generated code could be overwritten incorrectly, leading to a potentially exploitable     crash.

      CVE-2023-28176:
      The Mozilla Foundation Security Advisory described the issue in which Mozilla developers Timothy Nikkel,     Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and ESR     102.8. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort,     some of these could have been exploited to run arbitrary code.

      CVE-2023-28164:
      The Mozilla Foundation Security Advisory described the issue of dragging a URL from a cross-origin     iframe that was removed during the drag could have led to user confusion and website spoofing attacks.

      CVE-2023-28162:
      The Mozilla Foundation Security Advisory describes the issue that while implementing AudioWorklets, some     code may have cast one type to another, invalid, dynamic type. This could have led to a potentially     exploitable crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2023_1407 advisory.

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2023_1403 advisory.

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has firefox packages installed that are affected by multiple vulnerabilities:

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This     vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2021-4140)

  - crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in     Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in     the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks     are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a     logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are     affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. (CVE-2021-32810)

  - Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14,     and Firefox < 92. (CVE-2021-38493)

  - During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in     memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15,     Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. (CVE-2021-38496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
173041	RHEL 8 : firefox (RHSA-2023:1336)	Nessus	Red Hat Local Security Checks	2023/3/20	2024/11/7	high
173042	RHEL 9 : firefox (RHSA-2023:1337)	Nessus	Red Hat Local Security Checks	2023/3/20	2024/11/7	high
173053	AlmaLinux 9 : firefox (ALSA-2023:1337)	Nessus	Alma Linux Local Security Checks	2023/3/21	2023/6/12	high
173226	SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-upstream / etc (SUSE-SU-2023:0835-1)	Nessus	SuSE Local Security Checks	2023/3/22	2026/6/26	high
173314	RHEL 9 : thunderbird (RHSA-2023:1402)	Nessus	Red Hat Local Security Checks	2023/3/23	2024/11/7	high
173317	RHEL 8 : firefox (RHSA-2023:1444)	Nessus	Red Hat Local Security Checks	2023/3/23	2024/11/7	high
173435	RHEL 8 : firefox (RHSA-2023:1479)	Nessus	Red Hat Local Security Checks	2023/3/27	2024/11/7	high
173824	SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2023:1736-1)	Nessus	SuSE Local Security Checks	2023/4/4	2026/6/26	high
292886	MiracleLinux 8 : firefox-102.9.0-3.el8.ML.1 (AXSA:2023-5235:13)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
239802	TencentOS Server 3: firefox (TSSA-2023:0043)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
355695	Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_1407)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
354284	Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_1403)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
206859	NewStart CGSL MAIN 6.02 : firefox Multiple Vulnerabilities (NS-SA-2024-0066)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2025/9/25	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

critical