The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-0850 advisory.

    [91.7.0-2.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
    - Enabled aarch64 build

    [91.7.0-2]
    - Update to 91.7.0 build2

    [91.7.0-1]
    - Update to 91.7.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-0845 advisory.

    [91.7.0-2.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [91.7.0-2]
    - Update to 91.7.0 build2

    [91.7.0-1]
    - Update to 91.7.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0850 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

    * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * Mozilla: Use-after-free in text reflows (CVE-2022-26381)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

    * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

    * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

    * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

    * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0844-1 advisory.

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:14934-1 advisory.

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with     a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

  - Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. (CVE-2022-25314)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of thunderbird installed on the remote host is prior to 91.7.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1779 advisory.

    A flaw was found in Thunderbird. The vulnerability occurs due to an out-of-bounds write of one byte when     processing the message. This flaw allows an attacker to craft an email message that causes Thunderbird to     perform an out-of-bounds write. (CVE-2022-0566)

    A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences (for example, from start tag     names) to the XML processing application on top of expat can lead to arbitrary code execution. This issue     is dependent on how invalid UTF-8 is handled inside the XML processor. (CVE-2022-25235)

    A flaw was found in expat. Passing one or more namespace separator characters in the xmlns[:prefix]     attribute values made expat send malformed tag names to the XML processor on top of expat. This issue     causes arbitrary code execution depending on how unexpected cases are handled inside the XML processor.
    (CVE-2022-25236)

    An integer overflow was found in expat. The issue occurs in storeRawNames() by abusing the m_buffer     expansion logic to allow allocations very close to INT_MAX and out-of-bounds heap writes. This flaw can     cause a denial of service or potentially arbitrary code execution. (CVE-2022-25315)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. (CVE-2022-26381)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. (CVE-2022-26383)

    The Mozilla Foundation Security Advisory describes this flaw as:

    If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts,     they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the     sandbox. (CVE-2022-26384)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Previously Thunderbird for macOS and Linux would download temporary files to a user-specific directory in     /tmp, but this behavior was changed to download them to /tmp where they could be affected by other local     users. This behavior was reverted to the original, user-specific directory. (CVE-2022-26386)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When installing an add-on, Thunderbird verified the signature before prompting the user; but while the     user was confirming the prompt, the underlying add-on file could have been modified and Thunderbird would     not have noticed. (CVE-2022-26387)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. (CVE-2022-26485)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape. We have had reports of attacks in the wild abusing this flaw. (CVE-2022-26486)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2294-1 advisory.

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. (CVE-2022-25314)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize. (CVE-2021-46143)

  - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

  - build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823)

  - defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22824)

  - lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825)

  - nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22826)

  - storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827)

  - Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with     a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

  - Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. (CVE-2022-25314)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. (CVE-2022-25314)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7811 advisory.

    Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat     library for MinGW.

    The following packages have been upgraded to a later upstream version: mingw-expat (2.4.8). (BZ#2057023,     BZ#2057037, BZ#2057127)

    Security Fix(es):

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * expat: Stack exhaustion in doctype parsing (CVE-2022-25313)

    * expat: Integer overflow in copyString() (CVE-2022-25314)

    * expat: Integer overflow in the doProlog function (CVE-2022-23990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has expat packages installed that are affected by multiple vulnerabilities:

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize. (CVE-2021-46143)

  - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

  - build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823)

  - defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22824)

  - lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825)

  - nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22826)

  - storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827)

  - Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with     a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. (CVE-2022-40674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0142 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-40674:
      A vulnerability was found in expat. With this flaw, it is possible to create a situation in which     parsing is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the     internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will     return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory     other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for     example, if processing a file line by line), problems occur. Using this vulnerability in the doContent     function allows an attacker to triage a denial of service or potentially arbitrary code execution.

      CVE-2022-25236:
      A flaw was found in expat. Passing one or more namespace separator characters in the xmlns[:prefix]     attribute values made expat send malformed tag names to the XML processor on top of expat. This issue     causes arbitrary code execution depending on how unexpected cases are handled inside the XML processor.

      CVE-2022-25235:
      A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences (for example, from start tag     names) to the XML processing application on top of expat can lead to arbitrary code execution. This issue     is dependent on how invalid UTF-8 is handled inside the XML processor.

      CVE-2022-25313:
      A flaw was found in expat. A stack exhaustion in doctype parsing could be triggered by a file with a     large number of opening braces, resulting in a denial of service.

      CVE-2022-25314:
      An integer overflow flaw was found in expat. This issue affects the encoding name parameter at the     parser creation time, which is often hard-coded (rather than user input), takes a value in the gigabytes     to trigger, and on a 64-bit machine. This flaw can cause a denial of service.

      CVE-2022-25315:
      An integer overflow was found in expat. The issue occurs in storeRawNames() by abusing the m_buffer     expansion logic to allow allocations very close to INT_MAX and out-of-bounds heap writes. This flaw can     cause a denial of service or potentially arbitrary code execution.

      CVE-2018-20843:
      It was discovered that the setElementTypePrefix() function incorrectly extracted XML namespace     prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause     unusually high consumption of memory resources and possibly lead to a denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0039 advisory.

    This advisory aggregates security fixes for the expat SRPM in CIQ LTS 8.6. It addresses 25 CVEs:
    CVE-2022-22826, CVE-2024-8176, CVE-2022-25313, CVE-2022-25236, CVE-2009-3560, and 20 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
158903	Oracle Linux 7 : thunderbird (ELSA-2022-0850)	Nessus	Oracle Linux Local Security Checks	2022/3/14	2024/10/22	critical
158904	Oracle Linux 8 : thunderbird (ELSA-2022-0845)	Nessus	Oracle Linux Local Security Checks	2022/3/14	2024/10/22	critical
158907	RHEL 7 : thunderbird (RHSA-2022:0850)	Nessus	Red Hat Local Security Checks	2022/3/14	2025/8/15	critical
159046	openSUSE 15 Security Update : expat (openSUSE-SU-2022:0844-1)	Nessus	SuSE Local Security Checks	2022/3/17	2022/5/25	critical
159388	SUSE SLES11 Security Update : expat (SUSE-SU-2022:14934-1)	Nessus	SuSE Local Security Checks	2022/4/1	2023/7/13	critical
160143	EulerOS 2.0 SP8 : expat (EulerOS-SA-2022-1562)	Nessus	Huawei Local Security Checks	2022/4/25	2023/10/31	critical
160270	Amazon Linux 2 : thunderbird (ALAS-2022-1779)	Nessus	Amazon Linux Local Security Checks	2022/4/27	2024/12/11	critical
162913	SUSE SLED15 / SLES15 Security Update : expat (SUSE-SU-2022:2294-1)	Nessus	SuSE Local Security Checks	2022/7/8	2023/7/14	critical
163220	EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2022-2022)	Nessus	Huawei Local Security Checks	2022/7/15	2023/10/17	critical
163627	EulerOS Virtualization 2.9.1 : expat (EulerOS-SA-2022-2178)	Nessus	Huawei Local Security Checks	2022/7/29	2023/10/17	critical
167142	RHEL 8 : mingw-expat (RHSA-2022:7811)	Nessus	Red Hat Local Security Checks	2022/11/9	2025/3/15	critical
187329	NewStart CGSL MAIN 6.06 : expat Multiple Vulnerabilities (NS-SA-2023-0082)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2023/12/27	critical
239666	TencentOS Server 3: mingw-expat (TSSA-2023:0142)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/22	critical
358871	Rocky Linux 8.6 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel / etc Multiple Vulnerabilities (ciqsa-2026_0039)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical