The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-28 advisory.

  - When manipulating user events in nested loops while opening a document through script, it is possible to     trigger a potentially exploitable crash due to poor event handling. (CVE-2018-12392)

  - During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in     violation of security policies. Because the problem is in the underlying Android service, this issue is     addressed by treating all HLS streams as cross-origin and opaque to access.  Note: this issue only affects     Firefox for Android. Desktop versions of Firefox are unaffected. (CVE-2018-12391)

  - A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of     scripts to an internal UTF-16 representation could result in allocating a buffer too small for the     conversion. This leads to a possible out-of-bounds write.  Note: 64-bit builds are not vulnerable to this     issue. (CVE-2018-12393)

  - Mozilla developers and community members Daniel Veditz and Philipp reported memory safety bugs present in     Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort that some of these could be exploited to run arbitrary code. (CVE-2018-12389)

  - Mozilla developers and community members Christian Holler, Bob Owen, Boris Zbarsky, Calixte Denizet, Jason     Kratzer, Jed Davis, Taegeon Lee, Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond     Forbes, and Bogdan Tara reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of     these bugs showed evidence of memory corruption and we presume that with enough effort that some of these     could be exploited to run arbitrary code. (CVE-2018-12390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3376:08 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390)
    * Mozilla: Crash with nested event loops (CVE-2018-12392)
    * Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393)
    * Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395)
    * Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396)
    * Mozilla: WebExtension local file permission check bypass (CVE-2018-12397)
    * Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201811-13 (Mozilla Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
      Please review the referenced Mozilla Foundation Security Advisories and       CVE identifiers below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code, cause a Denial       of Service condition, obtain sensitive information, or conduct Cross-Site       Request Forgery (CSRF).
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:3006 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 60.3.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390)

    * Mozilla: Crash with nested event loops (CVE-2018-12392)

    * Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393)

    * Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395)

    * Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396)

    * Mozilla: WebExtension local file permission check bypass (CVE-2018-12397)

    * Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges     Christian Holler, Bob Owen, Boris Zbarsky, Calixte Denizet, Jason Kratzer, Jed Davis, Taegeon Lee,     Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond Forbes, Bogdan Tara, Nils, r, Rob Wu,     Andrew Swan, and Daniel Veditz as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.3.0 ESR.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390)

* Mozilla: Crash with nested event loops (CVE-2018-12392)

* Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393)

* Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395)

* Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396)

* Mozilla: WebExtension local file permission check bypass (CVE-2018-12397)

* Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Bob Owen, Boris Zbarsky, Calixte Denizet, Jason Kratzer, Jed Davis, Taegeon Lee, Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond Forbes, Bogdan Tara, Nils, r, Rob Wu, Andrew Swan, and Daniel Veditz as the original reporters.

This update for MozillaThunderbird fixes the following issues :

Thunderbird 63 ESR was updated to version 60.3.0 to fix the following issues (bsc#1112852) :

Security issues fixed (MFSA 2018-28) :

  - CVE-2018-12389: Fixed memory safety bugs.

  - CVE-2018-12390: Fixed memory safety bugs.

  - CVE-2018-12391: Fixed HTTP Live Stream audio data is     accessible cross-origin.

  - CVE-2018-12392: Fixed crash with nested event loops.

  - CVE-2018-12393: Fixed integer overflow during Unicode     conversion while loading JavaScript.

Non-security issues fixed :

  - various theme fixes

  - Shift+PageUp/PageDown in Write window

  - Gloda attachment filtering

  - Mailing list address auto-complete enter/return handling

  - Thunderbird hung if HTML signature references     non-existent image

  - Filters not working for headers that appear more than     once

Multiple security issues have been found in Thunderbird: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service.

Debian follows the Thunderbird upstream releases. Support for the 52.x series has ended, so starting with this update we're now following the 60.x releases.

Between 52.x and 60.x, Thunderbird has undergone significant internal updates, which makes it incompatible with a number of extensions. For more information please refer to https://support.mozilla.org/en-US/kb/new-thunderbird-60

For Debian 8 'Jessie', these problems have been fixed in version 1:60.3.0-1~deb8u1.

We recommend that you upgrade your thunderbird packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Mozilla: Memory safety bugs fixed in Firefox 63 and     Firefox ESR 60.3 (CVE-2018-12390)

  - Mozilla: Crash with nested event loops (CVE-2018-12392)

  - Mozilla: Integer overflow during Unicode conversion     while loading JavaScript (CVE-2018-12393)

  - Mozilla: WebExtension bypass of domain restrictions     through header rewriting (CVE-2018-12395)

  - Mozilla: WebExtension content scripts can execute in     disallowed contexts (CVE-2018-12396)

  - Mozilla: WebExtension local file permission check     bypass (CVE-2018-12397)

  - Mozilla: Memory safety bugs fixed in Firefox ESR 60.3     (CVE-2018-12389)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390)

Crash with nested event loops (CVE-2018-12392)

Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)

Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3431:07 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390)
    * Mozilla: Crash with nested event loops (CVE-2018-12392)
    * Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393)
    * Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
275627	Mozilla Thunderbird < 60.3	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
289878	MiracleLinux 7 : firefox-60.3.0-1.0.1.el7.AXS7 (AXSA:2018-3376:08)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
119133	GLSA-201811-13 : Mozilla Thunderbird: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/11/26	2024/7/19	critical
118375	RHEL 6 : firefox (RHSA-2018:3006)	Nessus	Red Hat Local Security Checks	2018/10/25	2025/4/15	critical
118406	CentOS 6 : firefox (CESA-2018:3006)	Nessus	CentOS Local Security Checks	2018/10/26	2022/2/3	critical
118817	openSUSE Security Update : MozillaThunderbird (openSUSE-2018-1340)	Nessus	SuSE Local Security Checks	2018/11/8	2024/7/24	critical
118890	Debian DLA-1575-1 : thunderbird security update	Nessus	Debian Local Security Checks	2018/11/13	2024/7/24	critical
119903	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2018-1414)	Nessus	Huawei Local Security Checks	2018/12/28	2024/7/12	critical
122158	Amazon Linux 2 : thunderbird (ALAS-2019-1157)	Nessus	Amazon Linux Local Security Checks	2019/2/14	2024/6/20	critical
290039	MiracleLinux 4 : thunderbird-60.3.0-1.AXS4 (AXSA:2018-3431:07)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical