遠端 Windows 主機上安裝的 Firefox 版本是 158.0.1 之前版本。因此，它會受到 mfsa2026-111 公告中提及的多個弱點的影響。

  - PDF 檢視器元件中的拒絕服務。此弱點已在 Firefox 158.0.1 中修正。
    (CVE-2026-113401)

  - Mozilla 於 10 月 17 日透過 OneCRL 封鎖了受損的中間 eMudhra 憑證，該憑證於同一天透過 RemoteSettings 分發給用戶端。此更新包含更新的 OneCRL 封鎖清單，確保用戶端會封鎖遭入侵的憑證，即使原則停用 RemoteSettings 或在使用者的網路環境中無法使用。（CVE-2026-113470）

  - Audio/Video： cubeb 元件中未初始化的記憶體。此弱點已在 Firefox 158.0.1 中修正。
    (CVE-2026-113400)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Windows 主机上安装的 Firefox 版本低于 158.0.1。因此，如公告 mfsa2026-111 所述，受到多个漏洞的影响。

  - PDF 查看器组件中的拒绝服务。在 Firefox 158.0.1中修复了此漏洞。
    (CVE-2026-113401)

  - Mozilla 于 10 月 17 日通过 OneCRL 阻止了受影响的中间 eMudhra 证书，这些证书于当天通过 RemoteSettings 分发给客户端。此更新包含更新后的 OneCRL 阻止列表，确保即使 RemoteSettings 被策略禁用或在用户的网络环境中不可用，客户端也将阻止受破坏的证书。（CVE-2026-113470）

  - Audio/Video： cubeb 组件中未初始化的内存。在 Firefox 158.0.1中修复了此漏洞。
    (CVE-2026-113400)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 158.0.1。因此，如公告 mfsa2026-111 所述，受到多个漏洞的影响。

  - PDF 查看器组件中的拒绝服务。在 Firefox 158.0.1中修复了此漏洞。
    (CVE-2026-113401)

  - Mozilla 于 10 月 17 日通过 OneCRL 阻止了受影响的中间 eMudhra 证书，这些证书于当天通过 RemoteSettings 分发给客户端。此更新包含更新后的 OneCRL 阻止列表，确保即使 RemoteSettings 被策略禁用或在用户的网络环境中不可用，客户端也将阻止受破坏的证书。（CVE-2026-113470）

  - Audio/Video： cubeb 组件中未初始化的内存。在 Firefox 158.0.1中修复了此漏洞。
    (CVE-2026-113400)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 macOS 或 Mac OS X 主機上安裝的 Firefox 版本低於 158.0.1。因此，它會受到 mfsa2026-111 公告中提及的多個弱點的影響。

  - PDF 檢視器元件中的拒絕服務。此弱點已在 Firefox 158.0.1 中修正。
    (CVE-2026-113401)

  - Mozilla 於 10 月 17 日透過 OneCRL 封鎖了受損的中間 eMudhra 憑證，該憑證於同一天透過 RemoteSettings 分發給用戶端。此更新包含更新的 OneCRL 封鎖清單，確保用戶端會封鎖遭入侵的憑證，即使原則停用 RemoteSettings 或在使用者的網路環境中無法使用。（CVE-2026-113470）

  - Audio/Video： cubeb 元件中未初始化的記憶體。此弱點已在 Firefox 158.0.1 中修正。
    (CVE-2026-113400)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートの Windows ホストにインストールされている Firefox のバージョンは、158.0.1 より前です。したがって、mfsa2026-111のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - PDF ビューアーコンポーネントのサービス拒否。この脆弱性は、Firefox 158.0.1 で修正されています。
    (CVE-2026-113401)

  - Mozilla は 10 月 17 日に、OneCRL を通じて危険にさらされている中間 eMudhra 証明書をブロックしました。これは、同日に RemoteSettings を通じてクライアントに配布されました。この更新には、更新された OneCRL ブロックリストが含まれており、RemoteSettings がポリシーにより無効になっている場合や、ユーザーのネットワーク環境で利用できない場合でも、セキュリティを危険にさらしている証明書をクライアントが確実にブロックするようにします。(CVE-2026-113470)

  - Audio/Video: cubeb コンポーネントの初期化されていないメモリ。この脆弱性は、Firefox 158.0.1 で修正されています。
    (CVE-2026-113400)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの macOS または Mac OS X ホストにインストールされている Firefox のバージョンは、158.0.1 より前のものです。したがって、mfsa2026-111のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - PDF ビューアーコンポーネントのサービス拒否。この脆弱性は、Firefox 158.0.1 で修正されています。
    (CVE-2026-113401)

  - Mozilla は 10 月 17 日に、OneCRL を通じて危険にさらされている中間 eMudhra 証明書をブロックしました。これは、同日に RemoteSettings を通じてクライアントに配布されました。この更新には、更新された OneCRL ブロックリストが含まれており、RemoteSettings がポリシーにより無効になっている場合や、ユーザーのネットワーク環境で利用できない場合でも、セキュリティを危険にさらしている証明書をクライアントが確実にブロックするようにします。(CVE-2026-113470)

  - Audio/Video: cubeb コンポーネントの初期化されていないメモリ。この脆弱性は、Firefox 158.0.1 で修正されています。
    (CVE-2026-113400)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of Firefox installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-111 advisory.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113401)

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's     AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the     user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from     incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request     that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would     then process as if sent by the user. This could be used to send messages or change contact and     subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's     chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's     challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include     uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge     consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected     accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only     affected NTLM. (CVE-2026-113868)

  - When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary     Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the     prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a     potentially exploitable crash. (CVE-2026-113869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's     AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the     user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from     incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request     that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would     then process as if sent by the user. This could be used to send messages or change contact and     subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's     chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's     challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include     uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge     consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected     accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only     affected NTLM. (CVE-2026-113868)

  - When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary     Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the     prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a     potentially exploitable crash. (CVE-2026-113869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-111 advisory.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113401)

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
367827	Mozilla Firefox < 158.0.1	Nessus	Windows	2026/10/20	2026/10/21	high
367827	Mozilla Firefox < 158.0.1	Nessus	Windows	2026/10/20	2026/10/21	high
367828	Mozilla Firefox < 158.0.1	Nessus	MacOS X Local Security Checks	2026/10/20	2026/10/21	high
367828	Mozilla Firefox < 158.0.1	Nessus	MacOS X Local Security Checks	2026/10/20	2026/10/21	high
367827	Mozilla Firefox < 158.0.1	Nessus	Windows	2026/10/20	2026/10/21	high
367828	Mozilla Firefox < 158.0.1	Nessus	MacOS X Local Security Checks	2026/10/20	2026/10/21	high
367827	Mozilla Firefox < 158.0.1	Nessus	Windows	2026/10/20	2026/10/21	high
369076	Mozilla Thunderbird < 158.0.1	Nessus	MacOS X Local Security Checks	2026/10/21	2026/10/21	medium
369077	Mozilla Thunderbird < 158.0.1	Nessus	Windows	2026/10/21	2026/10/21	medium
367828	Mozilla Firefox < 158.0.1	Nessus	MacOS X Local Security Checks	2026/10/20	2026/10/21	high

检测

插件搜索

high

high

high

high

high

high

high

medium

medium

high