The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-22 advisory.

  - Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 68.8. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2020-12410)

  - NSS has shown timing differences when performing DSA signatures, which was exploitable and could     eventually leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2020-12406)

  - If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response,     then Thunderbird will continue with an unencrypted connection, causing email data to be sent without     protection. (CVE-2020-12398)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the nss-softokn packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. This vulnerability affects     Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <     68.9.(CVE-2020-12399)

  - A flaw was found in the way CHACHA20-POLY1305 was     implemented in NSS. When using multi-part Chacha20, it     could cause out-of-bounds reads. This issue was fixed     by explicitly disabling multi-part ChaCha20 (which was     not functioning correctly) and strictly enforcing tag     length. The highest threat from(CVE-2020-12403)

  - When converting coordinates from projective to affine,     the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel     attack. This vulnerability affects Firefox < 80 and     Firefox for Android < 80.(CVE-2020-12400)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4397-1 advisory.

    It was discovered that NSS incorrectly handled the TLS State Machine. A remote attacker could possibly use     this issue to cause NSS to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04     LTS and Ubuntu 19.10. (CVE-2019-17023)

    Cesar Pereida Garcia discovered that NSS incorrectly handled DSA key generation. A local attacker could     possibly use this issue to perform a timing attack and recover DSA keys. (CVE-2020-12399)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 68.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-21 advisory.

  - Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76 and     Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code. (CVE-2020-12410)

  - NSS has shown timing differences when performing DSA signatures, which was exploitable and could     eventually leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2020-12406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or a timing attack on cryptographic keys.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or a timing attack on cryptographic keys.

For Debian 8 'Jessie', these problems have been fixed in version 68.9.0esr-1~deb8u2.

NOTE: 68.9.0esr-1~deb8u2 fixes an i386 build error in the otherwise identical 68.9.0esr-1~deb8u1 that was uploaded but not announced.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. This vulnerability affects     Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <     68.9.(CVE-2020-12399)

  - When converting coordinates from projective to affine,     the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel     attack. This vulnerability affects Firefox < 80 and     Firefox for Android < 80.(CVE-2020-12400)

  - A flaw was found in the way CHACHA20-POLY1305 was     implemented in NSS. When using multi-part Chacha20, it     could cause out-of-bounds reads. This issue was fixed     by explicitly disabling multi-part ChaCha20 (which was     not functioning correctly) and strictly enforcing tag     length. The highest threat from(CVE-2020-12403)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
137086	Mozilla Thunderbird < 68.9.0	Nessus	MacOS X Local Security Checks	2020/6/4	2025/11/18	high
144169	EulerOS 2.0 SP8 : nss-softokn (EulerOS-SA-2020-2523)	Nessus	Huawei Local Security Checks	2020/12/14	2021/6/11	critical
137555	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : NSS vulnerabilities (USN-4397-1)	Nessus	Ubuntu Local Security Checks	2020/6/17	2025/9/3	medium
137051	Mozilla Firefox ESR < 68.9	Nessus	Windows	2020/6/2	2025/11/18	high
137155	Debian DSA-4695-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	2020/6/5	2024/3/7	high
137284	Debian DLA-2243-1 : firefox-esr security update	Nessus	Debian Local Security Checks	2020/6/10	2024/3/7	high
143400	EulerOS 2.0 SP9 : nss (EulerOS-SA-2020-2487)	Nessus	Huawei Local Security Checks	2020/12/1	2024/2/7	critical

検出

プラグインの検索

high

critical

medium

high

high

high

critical