The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23856 advisory.

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)

    * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

    * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

    * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.6. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-96 advisory.

  - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR <     140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14328, CVE-2025-14329)

  - Use-after-free in the WebRTC: Signaling component. This vulnerability affects Firefox < 146, Firefox ESR <     140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14321)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and     Thunderbird < 140.6. (CVE-2025-14322)

  - Privilege escalation in the DOM: Notifications component. This vulnerability affects Firefox < 146,     Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14323)

  - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146,     Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14324)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6078 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6078-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     December 10, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : firefox-esr     CVE ID         : CVE-2025-14321 CVE-2025-14322 CVE-2025-14323 CVE-2025-14324                      CVE-2025-14325 CVE-2025-14328 CVE-2025-14329 CVE-2025-14330                      CVE-2025-14331 CVE-2025-14333

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code, sandbox escape, same-origin policy bypass or privilege escalation.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 140.6.0esr-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 140.6.0esr-1~deb13u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23034 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)

    * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

    * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

    * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0026 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)

    * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

    * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

    * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0019 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)

    * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

    * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

    * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-0026 advisory.

    [140.6.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079820]
    - Add Oracle prefs file

    [140.6.0]
    - Add OpenELA debranding

    [140.6.0-1]
    - Update to 140.6.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-23128 advisory.

    [140.6.0-1.0.1]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789]

    [140.6.0]
    - Add debranding patches (Mustafa Gezen)
    - Add OpenELA default preferences (Louis Abel)

    [140.6.0-1]
    - Update to 140.6.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23128 advisory.

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)

    * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

    * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

    * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:23034 advisory.

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)
      * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)
      * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)
      * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)
      * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)
      * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)
      * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)
      * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)
      * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)
      * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_23034 advisory.

    * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and     Thunderbird 146 (CVE-2025-14333)

    * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component     (CVE-2025-14322)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

    * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

    * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

    * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

    * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 146.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-95 advisory.

  - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR <     140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14328, CVE-2025-14329)

  - Use-after-free in the WebRTC: Signaling component. This vulnerability affects Firefox < 146, Firefox ESR <     140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14321)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and     Thunderbird < 140.6. (CVE-2025-14322)

  - Privilege escalation in the DOM: Notifications component. This vulnerability affects Firefox < 146,     Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14323)

  - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146,     Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14324)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 146.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-95 advisory.

  - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR <     140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14328, CVE-2025-14329)

  - Use-after-free in the WebRTC: Signaling component. This vulnerability affects Firefox < 146, Firefox ESR <     140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14321)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and     Thunderbird < 140.6. (CVE-2025-14322)

  - Privilege escalation in the DOM: Notifications component. This vulnerability affects Firefox < 146,     Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14323)

  - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146,     Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. (CVE-2025-14324)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
279630	RockyLinux 9 : thunderbird (RLSA-2025:23856)	Nessus	Rocky Linux Local Security Checks	2025/12/23	2026/2/20	critical
278134	Mozilla Thunderbird < 140.6	Nessus	MacOS X Local Security Checks	2025/12/10	2026/2/25	critical
278139	Debian dsa-6078 : firefox-esr - security update	Nessus	Debian Local Security Checks	2025/12/10	2026/2/25	critical
278145	RHEL 9 : firefox (RHSA-2025:23034)	Nessus	Red Hat Local Security Checks	2025/12/10	2026/2/25	critical
281657	RHEL 8 : thunderbird (RHSA-2026:0026)	Nessus	Red Hat Local Security Checks	2026/1/5	2026/2/18	critical
281668	RHEL 9 : thunderbird (RHSA-2026:0019)	Nessus	Red Hat Local Security Checks	2026/1/5	2026/2/18	critical
281832	Oracle Linux 8 : thunderbird (ELSA-2026-0026)	Nessus	Oracle Linux Local Security Checks	2026/1/6	2026/2/18	critical
278409	Oracle Linux 8 : firefox (ELSA-2025-23128)	Nessus	Oracle Linux Local Security Checks	2025/12/11	2026/2/25	critical
278520	RockyLinux 8 : firefox (RLSA-2025:23128)	Nessus	Rocky Linux Local Security Checks	2025/12/12	2026/2/24	critical
278555	AlmaLinux 9 : firefox (ALSA-2025:23034)	Nessus	Alma Linux Local Security Checks	2025/12/12	2026/2/24	critical
355494	Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2025_23034)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
278135	Mozilla Thunderbird < 146.0	Nessus	Windows	2025/12/10	2026/2/25	critical
278137	Mozilla Thunderbird < 146.0	Nessus	MacOS X Local Security Checks	2025/12/10	2026/2/25	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical