The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4909 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)

  - chromium-browser: Use after free in WebRTC (CVE-2020-15969)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4948 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)

  - chromium-browser: Use after free in WebRTC (CVE-2020-15969)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Mozilla: Memory safety bugs fixed in Firefox 82 and     Firefox ESR 78.4 (CVE-2020-15683)

  - chromium-browser: Use after free in WebRTC     (CVE-2020-15969)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4913 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)

  - chromium-browser: Use after free in WebRTC (CVE-2020-15969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4317 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)

  - chromium-browser: Use after free in WebRTC (CVE-2020-15969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4599-1 advisory.

  - Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the     bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number     of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The     destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes     described above. This is unsound and causing deallocation with the incorrect capacity when     `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed     in crossbeam-channel 0.4.4. (CVE-2020-15254)

  - If a valid external protocol handler was referenced in an image tag, the resulting broken image size could     be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to     successfully probe whether an external protocol handler was registered. This vulnerability affects Firefox     < 82. (CVE-2020-15680)

  - When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM     thread could have overwritten another's entry in a shared stub table, resulting in a potentially     exploitable crash. This vulnerability affects Firefox < 82. (CVE-2020-15681)

  - When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose     what application to open it in. An attacker could induce that prompt to be associated with an origin they     didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be     tab-modal while also ensuring they could not be incorrectly associated with a different origin. This     vulnerability affects Firefox < 82. (CVE-2020-15682)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence     of memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 82. (CVE-2020-15684)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14522-1 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

Firefox Extended Support Release 78.4.0 ESR

  - Fixed: Various stability, functionality, and security     fixes MFSA 2020-46 (bsc#1177872, bsc#1176756)

  - CVE-2020-15969 Use-after-free in usersctp

  - CVE-2020-15683 Memory safety bugs fixed in Firefox 82     and Firefox ESR 78.4

  - Fixed: Fixed legacy preferences not being properly     applied when set via GPO

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
142459	RHEL 7 : thunderbird (RHSA-2020:4909)	Nessus	Red Hat Local Security Checks	11/4/2020	5/25/2023	critical
142477	RHEL 8 : thunderbird (RHSA-2020:4948)	Nessus	Red Hat Local Security Checks	11/5/2020	5/25/2023	critical
142548	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20201104)	Nessus	Scientific Linux Local Security Checks	11/6/2020	11/12/2020	critical
145844	CentOS 8 : thunderbird (CESA-2020:4913)	Nessus	CentOS Local Security Checks	2/1/2021	3/23/2021	critical
145924	CentOS 8 : firefox (CESA-2020:4317)	Nessus	CentOS Local Security Checks	2/1/2021	3/23/2021	critical
141863	Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4599-1)	Nessus	Ubuntu Local Security Checks	10/24/2020	10/21/2023	critical
150643	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2020:14522-1)	Nessus	SuSE Local Security Checks	6/10/2021	6/10/2021	critical
143862	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:3021-1)	Nessus	SuSE Local Security Checks	12/9/2020	2/5/2024	critical
147312	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0002)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	4/25/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical