The version of firefox installed on the remote host is prior to 91.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-012 advisory.

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla     developers and the Mozilla Fuzzing Team reporting memory safety bugs in Firefox 102. Some of these bugs     showed evidence of memory corruption, and we presume that with enough effort, some of these could have     been exploited to run arbitrary code. (CVE-2022-2505)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when visiting     directory listings for `chrome://` URLs as source text, some parameters were reflected. (CVE-2022-36318)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when     combining CSS properties for overflow and transform, the mouse cursor could interact with different     coordinates than displayed. (CVE-2022-36319)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker     abusing XSLT error handling to associate attacker-controlled content with another origin, which was     displayed in the address bar. This issue could be used to fool the user into submitting data intended for     the spoofed origin. (CVE-2022-38472)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a cross-     origin iframe referencing an XSLT document inheriting the parent domain's permissions (such as microphone     or camera access). (CVE-2022-38473)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a data race     that could occur in the `PK11_ChangePW` function, potentially leading to a use-after-free vulnerability.
    In Firefox, this lock protected the data when a user changed their master password. (CVE-2022-38476)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla     developer Nika Layzell and the Mozilla Fuzzing Team, reporting memory safety bugs present in Firefox 103     and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption, and we presume that with     enough effort, some of these could have been exploited to run arbitrary code. (CVE-2022-38477)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of members on     the Mozilla Fuzzing Team reporting memory safety bugs present in Firefox 103, Firefox ESR 102.1, and     Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption, and we presume that with     enough effort, some of these could have been exploited to run arbitrary code. (CVE-2022-38478)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 102.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-36 advisory.

  - Members the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.1 and Thunderbird     91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. (CVE-2022-38478)

  - An attacker could have abused XSLT error handling to associate attacker-controlled content with another     origin which was displayed in the address bar. This could have been used to fool the user into submitting     data intended for the spoofed origin. (CVE-2022-38472)

  - A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as     microphone or camera access). (CVE-2022-38473)

  - A data race could occur in the <code>PK11ChangePW</code> function, potentially leading to a use-after-free     vulnerability.  In Thunderbird, this lock protected the data when a user changed their master password.
    (CVE-2022-38476)

  - Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in     Thunderbird 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code. (CVE-2022-38477)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5581-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the     contents of the addressbar, bypass security restrictions, or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6166 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.13.0.

    Security Fix(es):

    * Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)

    * Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions (CVE-2022-38473)

    * Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2 (CVE-2022-38477)

    * Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13     (CVE-2022-38478)

    * Mozilla: Data race and potential use-after-free in PK11_ChangePW (CVE-2022-38476)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6169-1 advisory.

  - Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)

  - Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions (CVE-2022-38473)

  - Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2 (CVE-2022-38477)

  - Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13     (CVE-2022-38478)

  - Mozilla: Data race and potential use-after-free in PK11_ChangePW (CVE-2022-38476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-37 (Mozilla Firefox: Multiple Vulnerabilities)

  - An attacker could have abused XSLT error handling to associate attacker-controlled content with another     origin which was displayed in the address bar. This could have been used to fool the user into submitting     data intended for the spoofed origin.  (CVE-2022-38472)

  - Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions (CVE-2022-38473)

  - A website that had permission to access the microphone could record audio without the audio notification     being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the     notification shown once permission has been granted.<br />This bug only affects Firefox for Android. Other     operating systems are unaffected.  (CVE-2022-38474)

  - An attacker could have written a value to the first element in a zero-length JavaScript array. Although     the array was zero-length, the value was not written to an invalid memory address.  (CVE-2022-38475)

  - A data race could occur in the <code>PK11ChangePW</code> function, potentially leading to a use-after-free     vulnerability.  In Thunderbird, this lock protected the data when a user changed their master password.
    (CVE-2022-38476)

  - Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in     Thunderbird 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code.  (CVE-2022-38477)

  - Members the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.1 and Thunderbird     91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code.  (CVE-2022-38478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6179 advisory.

  - An attacker could have abused XSLT error handling to associate attacker-controlled content with another     origin which was displayed in the address bar. This could have been used to fool the user into submitting     data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13,     Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. (CVE-2022-38472)

  - A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as     microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox     ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. (CVE-2022-38473)

  - A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-     free vulnerability. In Firefox, this lock protected the data when a user changed their master password.
    This vulnerability affects Firefox ESR < 102.2 and Thunderbird < 102.2. (CVE-2022-38476)

  - Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     103 and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. This vulnerability     affects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104. (CVE-2022-38477)

  - Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1,     and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
    (CVE-2022-38478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of mozilla-firefox installed on the remote host is prior to 102.2.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-249-01 advisory.

  - Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions (CVE-2022-38473)

  - A data race could occur in the <code>PK11ChangePW</code> function, potentially leading to a use-after-free     vulnerability.  In Thunderbird, this lock protected the data when a user changed their master password.
    (CVE-2022-38476)

  - Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in     Thunderbird 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code.  (CVE-2022-38477)

  - Members the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.1 and Thunderbird     91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code.  (CVE-2022-38478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3281-1 advisory.

    Updated to Mozilla Thunderbird 102.2.2:
    - CVE-2022-3033: Fixed leaking of sensitive information when composing a response to an HTML email with a     META refresh tag (bsc#1203007).
    - CVE-2022-3032: Fixed missing blocking of remote content specified in an HTML document that was nested     inside an iframe's srcdoc attribute (bsc#1203007).
    - CVE-2022-3034: Fixed issue where iframe element in an HTML email could trigger a network request     (bsc#1203007).
    - CVE-2022-36059: Fixed DoS in Matrix SDK bundled with Thunderbird service attack (bsc#1203007).

    - CVE-2022-38472: Fixed Address bar spoofing via XSLT error handling (bsc#1202645).
    - CVE-2022-38473: Fixed cross-origin XSLT Documents inheriting the parent's permissions (bsc#1202645).
    - CVE-2022-38476: Fixed data race and potential use-after-free in PK11_ChangePW (bsc#1202645).
    - CVE-2022-38477: Fixed memory safety bugs (bsc#1202645).
    - CVE-2022-38478: Fixed memory safety bugs (bsc#1202645).

    - CVE-2022-36319: Fixed mouse position spoofing with CSS transforms (bsc#1201758).
    - CVE-2022-36318: Fixed directory indexes for bundled resources reflected URL parameters (bsc#1201758).
    - CVE-2022-36314: Fixed unexpected network loads when opening local .lnk files (bsc#1201758).
    - CVE-2022-2505: Fixed memory safety bugs (bsc#1201758).

    - CVE-2022-34479: Fixed vulnerability which could overlay the address bar with web content (bsc#1200793).
    - CVE-2022-34470: Fixed use-after-free in nsSHistory (bsc#1200793).
    - CVE-2022-34468: Fixed CSP sandbox header without `allow-scripts` bypass via retargeted javascript     (bsc#1200793).
    - CVE-2022-2226: Fixed emails with a mismatching OpenPGP signature date incorrectly accepted as valid     (bsc#1200793).
    - CVE-2022-34481: Fixed integer overflow in ReplaceElementsAt (bsc#1200793).
    - CVE-2022-31744: Fixed CSP bypass enabling stylesheet injection (bsc#1200793).
    - CVE-2022-34472: Fixed unavailable PAC file resulting in OCSP requests being blocked (bsc#1200793).
    - CVE-2022-34478: Fixed Microsoft protocols attacks if a user accepts a prompt (bsc#1200793).
    - CVE-2022-2200: Fixed vulnerability where undesired attributes could be set as part of prototype     pollution (bsc#1200793).
    - CVE-2022-34484: Fixed memory safety bugs (bsc#1200793).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
182051	Amazon Linux 2 : firefox (ALASFIREFOX-2023-012)	Nessus	Amazon Linux Local Security Checks	2023/9/27	2024/12/11	high
164353	Mozilla Thunderbird < 102.2	Nessus	Windows	2022/8/23	2025/11/18	high
164392	Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5581-1)	Nessus	Ubuntu Local Security Checks	2022/8/24	2024/8/28	high
164393	RHEL 8 : thunderbird (RHSA-2022:6166)	Nessus	Red Hat Local Security Checks	2022/8/24	2024/11/7	high
164485	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:6169)	Nessus	Scientific Linux Local Security Checks	2022/8/29	2023/1/2	high
164594	GLSA-202208-37 : Mozilla Firefox: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/9/1	2023/10/13	high
164621	CentOS 7 : firefox (RHSA-2022:6179)	Nessus	CentOS Local Security Checks	2022/9/1	2024/10/9	high
164795	Slackware Linux 15.0 mozilla-firefox Multiple Vulnerabilities (SSA:2022-249-01)	Nessus	Slackware Local Security Checks	2022/9/7	2023/1/2	high
165233	SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2022:3281-1)	Nessus	SuSE Local Security Checks	2022/9/17	2026/6/25	critical

検出

プラグインの検索

high

high

high

high

high

high

high

high

critical