The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-05 advisory.

  - Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox < 146, Thunderbird <     146, Firefox ESR < 140.7, and Thunderbird < 140.7. (CVE-2025-14327)

  - Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR <     115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. (CVE-2026-0877)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.
    (CVE-2026-0878)

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects     Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.
    (CVE-2026-0879)

  - Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox <     147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.
    (CVE-2026-0880)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0694 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)

    * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147     and Thunderbird 147 (CVE-2026-0891)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2026-0878)

    * firefox: Use-after-free in the IPC component (CVE-2026-0882)

    * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)

    * firefox: Information disclosure in the Networking component (CVE-2026-0883)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)

    * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)

    * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)

    * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)

    * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:1320 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)

    * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147     and Thunderbird 147 (CVE-2026-0891)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2026-0878)

    * firefox: Use-after-free in the IPC component (CVE-2026-0882)

    * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)

    * firefox: Information disclosure in the Networking component (CVE-2026-0883)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)

    * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)

    * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)

    * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)

    * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:2047 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)

    * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147     and Thunderbird 147 (CVE-2026-0891)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2026-0878)

    * firefox: Use-after-free in the IPC component (CVE-2026-0882)

    * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)

    * firefox: Information disclosure in the Networking component (CVE-2026-0883)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)

    * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)

    * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)

    * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)

    * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:2220 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)

    * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147     and Thunderbird 147 (CVE-2026-0891)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2026-0878)

    * firefox: Use-after-free in the IPC component (CVE-2026-0882)

    * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)

    * firefox: Information disclosure in the Networking component (CVE-2026-0883)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)

    * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)

    * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)

    * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)

    * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:2231 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)

    * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147     and Thunderbird 147 (CVE-2026-0891)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2026-0878)

    * firefox: Use-after-free in the IPC component (CVE-2026-0882)

    * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)

    * firefox: Information disclosure in the Networking component (CVE-2026-0883)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)

    * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)

    * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)

    * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)

    * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-2271 advisory.

    [140.7.0-1.0.1]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [140.7.0-1]
    - Update to 140.7.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-2220 advisory.

    [140.7.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079820]
    - Add Oracle prefs file

    [140.7.0]
    - Add OpenELA debranding

    [140.7.0-1]
    - Update to 140.7.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:2286 advisory.

    * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)
      * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox     147 and Thunderbird 147 (CVE-2026-0891)
      * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2026-0878)
      * firefox: Use-after-free in the IPC component (CVE-2026-0882)
      * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)
      * firefox: Information disclosure in the Networking component (CVE-2026-0883)
      * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)
      * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)
      * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)
      * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)
      * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)
      * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1429 advisory.

    Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox < 146.
    (CVE-2025-14327)

    Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR <     115.32, and Firefox ESR < 140.7. (CVE-2026-0877)

    Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 147 and Firefox ESR < 140.7. (CVE-2026-0878)

    Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects     Firefox < 147, Firefox ESR < 115.32, and Firefox ESR < 140.7. (CVE-2026-0879)

    Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox <     147, Firefox ESR < 115.32, and Firefox ESR < 140.7. (CVE-2026-0880)

    Use-after-free in the IPC component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, and     Firefox ESR < 140.7. (CVE-2026-0882)

    Information disclosure in the Networking component. This vulnerability affects Firefox < 147 and Firefox     ESR < 140.7. (CVE-2026-0883)

    Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 147 and Firefox     ESR < 140.7. (CVE-2026-0884)

    Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 147 and Firefox ESR <     140.7. (CVE-2026-0885)

    Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox     ESR < 115.32, and Firefox ESR < 140.7. (CVE-2026-0886)

    Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox     < 147 and Firefox ESR < 140.7. (CVE-2026-0887)

    Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability affects Firefox <     147 and Firefox ESR < 140.7. (CVE-2026-0890)

    Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 147 and     Firefox ESR < 140.7. (CVE-2026-0891)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-240:03 advisory.

    * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)
      * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox     147 and Thunderbird 147 (CVE-2026-0891)
      * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2026-0878)
      * firefox: Use-after-free in the IPC component (CVE-2026-0882)
      * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)
      * firefox: Information disclosure in the Networking component (CVE-2026-0883)
      * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)
      * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)
      * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)
      * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)
      * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)
      * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
284837	Mozilla Thunderbird < 140.7	Nessus	MacOS X Local Security Checks	2026/1/15	2026/1/21	high
286369	RHEL 9 : firefox (RHSA-2026:0694)	Nessus	Red Hat Local Security Checks	2026/1/15	2026/1/15	high
296696	RHEL 9 : thunderbird (RHSA-2026:1320)	Nessus	Red Hat Local Security Checks	2026/1/27	2026/1/27	high
298017	RHEL 9 : firefox (RHSA-2026:2047)	Nessus	Red Hat Local Security Checks	2026/2/5	2026/2/5	high
298335	RHEL 8 : thunderbird (RHSA-2026:2220)	Nessus	Red Hat Local Security Checks	2026/2/9	2026/2/9	high
298339	RHEL 7 : firefox (RHSA-2026:2231)	Nessus	Red Hat Local Security Checks	2026/2/9	2026/2/9	high
298405	Oracle Linux 10 : firefox (ELSA-2026-2271)	Nessus	Oracle Linux Local Security Checks	2026/2/9	2026/2/9	high
298413	Oracle Linux 8 : thunderbird (ELSA-2026-2220)	Nessus	Oracle Linux Local Security Checks	2026/2/10	2026/2/10	high
298500	AlmaLinux 10 : thunderbird (ALSA-2026:2286)	Nessus	Alma Linux Local Security Checks	2026/2/10	2026/2/10	high
299567	Amazon Linux 2023 : firefox (ALAS2023-2026-1429)	Nessus	Amazon Linux Local Security Checks	2026/2/19	2026/2/19	high
300211	MiracleLinux 8 : thunderbird-140.7.0-1.el8_10.ML.1 (AXSA:2026-240:03)	Nessus	Miracle Linux Local Security Checks	2026/3/2	2026/3/2	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high