The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-6162 advisory.

    - Add fix for CVE-2023-44488

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:6188 advisory.

  - VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. (CVE-2023-44488)

  - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR <     115.4, and Thunderbird < 115.4.1. (CVE-2023-5721)

  - Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led     to a crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
    (CVE-2023-5724)

  - A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be     leveraged to collect sensitive user data. This vulnerability affects Firefox < 119, Firefox ESR < 115.4,     and Thunderbird < 115.4.1. (CVE-2023-5725)

  - During garbage collection extra operations were performed on a object that should not be. This could have     led to a potentially exploitable crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5728)

  - Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5730)

  - An attacker could have created a malicious link using bidirectional characters to spoof the location in     the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5732)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6571:31 advisory.

    * Mozilla: Queued up rendering could have allowed websites to clickjack (CVE-2023-5721)
      * Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4     (CVE-2023-5730)
      * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488)
      * Mozilla: Large WebGL draw could have led to a crash (CVE-2023-5724)
      * Mozilla: WebExtensions could open arbitrary URLs (CVE-2023-5725)
      * Mozilla: Improper object tracking during GC in the JavaScript engine could have led to a crash.
    (CVE-2023-5728)
      * Mozilla: Address bar spoofing via bidirectional characters (CVE-2023-5732)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 115.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-47 advisory.

  - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an insufficient activation-delay. (CVE-2023-5721)

  - An attacker could have created a malicious link using bidirectional characters to spoof the location in     the address bar when visited. (CVE-2023-5732)

  - Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led     to a crash. (CVE-2023-5724)

  - A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be     leveraged to collect sensitive user data. (CVE-2023-5725)

  - A website could have obscured the full screen notification by using the file open dialog. This could have     led to user confusion and possible spoofing attacks.  Note: This issue only affected macOS operating     systems. Other operating systems are unaffected. (CVE-2023-5726)

  - The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle     files, which can run commands on a user's computer.   Note: This issue only affected Windows operating     systems. Other operating systems are unaffected. (CVE-2023-5727)

  - During garbage collection extra operations were performed on a object that should not be. This could have     led to a potentially exploitable crash. (CVE-2023-5728)

  - Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 115.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-47 advisory.

  - Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2023-5730)

  - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an insufficient activation-delay. (CVE-2023-5721)

  - An attacker could have created a malicious link using bidirectional characters to spoof the location in     the address bar when visited. (CVE-2023-5732)

  - Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led     to a crash. (CVE-2023-5724)

  - A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be     leveraged to collect sensitive user data. (CVE-2023-5725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of mozilla-thunderbird installed on the remote host is prior to 115.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-299-01 advisory.

  - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR <     115.4, and Thunderbird < 115.4.1. (CVE-2023-5721)

  - Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led     to a crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
    (CVE-2023-5724)

  - A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be     leveraged to collect sensitive user data. This vulnerability affects Firefox < 119, Firefox ESR < 115.4,     and Thunderbird < 115.4.1. (CVE-2023-5725)

  - A website could have obscured the full screen notification by using the file open dialog. This could have     led to user confusion and possible spoofing attacks. *Note: This issue only affected macOS operating     systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR <     115.4, and Thunderbird < 115.4.1. (CVE-2023-5726)

  - The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle     files, which can run commands on a user's computer. *Note: This issue only affected Windows operating     systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR <     115.4, and Thunderbird < 115.4.1. (CVE-2023-5727)

  - During garbage collection extra operations were performed on a object that should not be. This could have     led to a potentially exploitable crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5728)

  - Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5730)

  - An attacker could have created a malicious link using bidirectional characters to spoof the location in     the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5732)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4533-1 advisory.

    - Firefox Extended Support Release 115.5.0 ESR Placeholder changelog-entry (bsc#1217230)

      * Fixed: Various security fixes and other quality improvements. MFSA 2023-46 (bsc#1216338)
      * CVE-2023-5721: Queued up rendering could have allowed websites to clickjack
      * CVE-2023-5732: Address bar spoofing via bidirectional characters
      * CVE-2023-5724: Large WebGL draw could have led to a crash
      * CVE-2023-5725: WebExtensions could open arbitrary URLs
      * CVE-2023-5726: Full screen notification obscured by file open dialog on macOS
      * CVE-2023-5727: Download Protections were bypassed by .msix, .msixbundle, .appx, and .appxbundle files     on Windows
      * CVE-2023-5728: Improper object tracking during GC in the JavaScript engine could have led to a crash.
      * CVE-2023-5730: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.1

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
239048	TencentOS Server 4: firefox (TSSA-2024:0159)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/23	critical
184059	Oracle Linux 7 : firefox (ELSA-2023-6162)	Nessus	Oracle Linux Local Security Checks	2023/10/30	2025/9/9	critical
184350	AlmaLinux 9 : firefox (ALSA-2023:6188)	Nessus	Alma Linux Local Security Checks	2023/11/3	2023/12/1	critical
292813	MiracleLinux 8 : thunderbird-115.4.1-1.el8.ML.1 (AXSA:2023-6571:31)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
183809	Mozilla Thunderbird < 115.4	Nessus	Windows	2023/10/24	2023/11/2	critical
183832	Mozilla Thunderbird < 115.4.1	Nessus	MacOS X Local Security Checks	2023/10/24	2025/11/18	critical
183927	Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2023-299-01)	Nessus	Slackware Local Security Checks	2023/10/26	2023/11/2	critical
186236	SUSE SLES15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:4533-1)	Nessus	SuSE Local Security Checks	2023/11/24	2026/6/26	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical