Vulnerabilities > CVE-2019-11743 - Information Exposure Through Discrepancy vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
mozilla
CWE-203
nessus

Summary

Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history through timing side-channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Vulnerable Configurations

Part Description Count
Application
Mozilla
984

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0231_THUNDERBIRD.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has thunderbird packages installed that are affected by multiple vulnerabilities: - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9. (CVE-2019-11739) - Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11740) - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11742) - Navigation events were not fully adhering to the W3C
    last seen2020-06-01
    modified2020-06-02
    plugin id132473
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132473
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0231)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from ZTE advisory NS-SA-2019-0231. The text
    # itself is copyright (C) ZTE, Inc.
    
    include('compat.inc');
    
    if (description)
    {
      script_id(132473);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/02");
    
      script_cve_id(
        "CVE-2019-11739",
        "CVE-2019-11740",
        "CVE-2019-11742",
        "CVE-2019-11743",
        "CVE-2019-11744",
        "CVE-2019-11746",
        "CVE-2019-11752"
      );
    
      script_name(english:"NewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0231)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote machine is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has thunderbird packages installed that are
    affected by multiple vulnerabilities:
    
      - Encrypted S/MIME parts in a crafted
        multipart/alternative message can leak plaintext when
        included in a a HTML reply/forward. This vulnerability
        affects Thunderbird < 68.1 and Thunderbird < 60.9.
        (CVE-2019-11739)
    
      - Mozilla developers and community members reported memory
        safety bugs present in Firefox 68, Firefox ESR 68, and
        Firefox 60.8. Some of these bugs showed evidence of
        memory corruption and we presume that with enough effort
        that some of these could be exploited to run arbitrary
        code. This vulnerability affects Firefox < 69,
        Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR <
        60.9, and Firefox ESR < 68.1. (CVE-2019-11740)
    
      - A same-origin policy violation occurs allowing the theft
        of cross-origin images through a combination of SVG
        filters and a <canvas> element due to an error in
        how same-origin policy is applied to cached image
        content. The resulting same-origin policy violation
        could allow for data theft. This vulnerability affects
        Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9,
        Firefox ESR < 60.9, and Firefox ESR < 68.1.
        (CVE-2019-11742)
    
      - Navigation events were not fully adhering to the W3C's
        Navigation-Timing Level 2 draft specification in some
        instances for the unload event, which restricts access
        to detailed timing attributes to only be same-origin.
        This resulted in potential cross-origin information
        exposure of history through timing side-channel attacks.
        This vulnerability affects Firefox < 69, Thunderbird <
        68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and
        Firefox ESR < 68.1. (CVE-2019-11743)
    
      - Some HTML elements, such as <title> and
        <textarea>, can contain literal angle brackets
        without treating them as markup. It is possible to pass
        a literal closing tag to .innerHTML on these elements,
        and subsequent content after that will be parsed as if
        it were outside the tag. This can lead to XSS if a site
        does not filter user input as strictly for these
        elements as it does for other elements. This
        vulnerability affects Firefox < 69, Thunderbird < 68.1,
        Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR
        < 68.1. (CVE-2019-11744)
    
      - A use-after-free vulnerability can occur while
        manipulating video elements if the body is freed while
        still in use. This results in a potentially exploitable
        crash. This vulnerability affects Firefox < 69,
        Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR <
        60.9, and Firefox ESR < 68.1. (CVE-2019-11746)
    
      - It is possible to delete an IndexedDB key value and
        subsequently try to extract it during conversion. This
        results in a use-after-free and a potentially
        exploitable crash. This vulnerability affects Firefox <
        69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR
        < 60.9, and Firefox ESR < 68.1. (CVE-2019-11752)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0231");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the vulnerable CGSL thunderbird packages. Note that updated packages may not be available yet. Please contact
    ZTE for more information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-11752");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/09/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/31");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"NewStart CGSL Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/ZTE-CGSL/release");
    if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
    
    if (release !~ "CGSL CORE 5.05" &&
        release !~ "CGSL MAIN 5.05")
      audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.05 / NewStart CGSL MAIN 5.05');
    
    if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
    
    flag = 0;
    
    pkgs = {
      "CGSL CORE 5.05": [
        "thunderbird-60.9.0-1.el7.centos",
        "thunderbird-debuginfo-60.9.0-1.el7.centos"
      ],
      "CGSL MAIN 5.05": [
        "thunderbird-60.9.0-1.el7.centos",
        "thunderbird-debuginfo-60.9.0-1.el7.centos"
      ]
    };
    pkg_list = pkgs[release];
    
    foreach (pkg in pkg_list)
      if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird");
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_THUNDERBIRD_68_1.NASL
    descriptionThe version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-30 advisory, including the following: - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. (CVE-2019-11746) - Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. (CVE-2019-11744) - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. (CVE-2019-11752) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id128971
    published2019-09-18
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128971
    titleMozilla Thunderbird < 68.1 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from Mozilla Foundation Security Advisory mfsa2019-30.
    # The text itself is copyright (C) Mozilla Foundation.
    
    
    include("compat.inc");
    
    if (description)
    {
      script_id(128971);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2019-11739",
        "CVE-2019-11740",
        "CVE-2019-11742",
        "CVE-2019-11743",
        "CVE-2019-11744",
        "CVE-2019-11746",
        "CVE-2019-11752"
      );
      script_xref(name:"MFSA", value:"2019-30");
    
      script_name(english:"Mozilla Thunderbird < 68.1 Multiple Vulnerabilities");
    
      script_set_attribute(attribute:"synopsis", value:
    "A mail client installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.1. It is, therefore, affected
    by multiple vulnerabilities as referenced in the mfsa2019-30 advisory, including the following:
    
      - A use-after-free vulnerability can occur while
        manipulating video elements if the body is freed while
        still in use. This results in a potentially exploitable
        crash. (CVE-2019-11746)
    
      - Some HTML elements, such as <title> and <textarea>, can
        contain literal angle brackets without treating them as
        markup. It is possible to pass a literal closing tag to
        .innerHTML on these elements, and subsequent content
        after that will be parsed as if it were outside the tag.
        This can lead to XSS if a site does not filter user
        input as strictly for these elements as it does for
        other elements. (CVE-2019-11744)
    
      - It is possible to delete an IndexedDB key value and
        subsequently try to extract it during conversion. This
        results in a use-after-free and a potentially
        exploitable crash. (CVE-2019-11752)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2019-30/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Mozilla Thunderbird version 68.1 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-11752");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/09/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/09/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/18");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_thunderbird_installed.nasl");
      script_require_keys("MacOSX/Thunderbird/Installed");
    
      exit(0);
    }
    
    include('mozilla_version.inc');
    
    kb_base = 'MacOSX/Thunderbird';
    get_kb_item_or_exit(kb_base+'/Installed');
    
    version = get_kb_item_or_exit(kb_base+'/Version', exit_code:1);
    path = get_kb_item_or_exit(kb_base+'/Path', exit_code:1);
    
    is_esr = get_kb_item(kb_base+'/is_esr');
    if (is_esr) exit(0, 'The Mozilla Thunderbird installation is in the ESR branch.');
    
    mozilla_check_version(version:version, path:path, product:'thunderbird', esr:FALSE, fix:'68.1', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2436-1.NASL
    descriptionThis update for MozillaFirefox to ESR 60.9 fixes the following issues : Security issues fixed : CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303) CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297) CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304) CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295) CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296) CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298) CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id129286
    published2019-09-24
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129286
    titleSUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2436-1)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2020-0017_FIREFOX.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has firefox packages installed that are affected by multiple vulnerabilities: - Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user
    last seen2020-03-18
    modified2020-03-11
    plugin id134411
    published2020-03-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134411
    titleNewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2020-0017)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2019-2694.NASL
    descriptionFrom Red Hat Security Advisory 2019:2694 : An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 25 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages. Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.9.0 ESR. Security Fix(es) : * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * firefox: stored passwords in
    last seen2020-05-31
    modified2019-09-11
    plugin id128656
    published2019-09-11
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128656
    titleOracle Linux 6 : firefox (ELSA-2019-2694)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2774.NASL
    descriptionAn update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.9.0. Security Fix(es) : * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2019-09-17
    plugin id128962
    published2019-09-17
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128962
    titleRHEL 8 : thunderbird (RHSA-2019:2774)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4516.NASL
    descriptionMultiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, bypass of the same-origin policy, sandbox escape, information disclosure or denial of service.
    last seen2020-06-01
    modified2020-06-02
    plugin id128534
    published2019-09-06
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128534
    titleDebian DSA-4516-1 : firefox-esr - security update
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2694.NASL
    descriptionAn update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 25 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages. Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.9.0 ESR. Security Fix(es) : * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * firefox: stored passwords in
    last seen2020-05-31
    modified2019-09-11
    plugin id128660
    published2019-09-11
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128660
    titleRHEL 6 : firefox (RHSA-2019:2694)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0192_FIREFOX.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has firefox packages installed that are affected by multiple vulnerabilities: - When a master password is set, it is required to be entered again before stored passwords can be accessed in the
    last seen2020-06-01
    modified2020-06-02
    plugin id129926
    published2019-10-15
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129926
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : firefox Multiple Vulnerabilities (NS-SA-2019-0192)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2663.NASL
    descriptionAn update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 24 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages. Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 68.1.0 ESR. Security Fix(es) : * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1 (CVE-2019-11735) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) * Mozilla: Persistence of WebRTC permissions in a third party context (CVE-2019-11748) * Mozilla: Camera information available without prompting using getUserMedia (CVE-2019-11749) * Mozilla: Type confusion in Spidermonkey (CVE-2019-11750) * Mozilla: Content security policy bypass through hash-based sources in directives (CVE-2019-11738) * Mozilla:
    last seen2020-05-31
    modified2019-09-05
    plugin id128517
    published2019-09-05
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128517
    titleRHEL 8 : firefox (RHSA-2019:2663)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2773.NASL
    descriptionAn update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.9.0. Security Fix(es) : * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2019-09-19
    plugin id129024
    published2019-09-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129024
    titleCentOS 7 : thunderbird (CESA-2019:2773)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_05463E0AABD34FA4BD5FCD5ED132D4C6.NASL
    descriptionMozilla Foundation reports : CVE-2019-11751: Malicious code execution through command line parameters CVE-2019-11746: Use-after-free while manipulating video CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB CVE-2019-9812: Sandbox escape through Firefox Sync CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com CVE-2019-11743: Cross-origin access to unload event attributes CVE-2019-11748: Persistence of WebRTC permissions in a third party context CVE-2019-11749: Camera information available without prompting using getUserMedia CVE-2019-5849: Out-of-bounds read in Skia CVE-2019-11750: Type confusion in Spidermonkey CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard CVE-2019-11738: Content security policy bypass through hash-based sources in directives CVE-2019-11747:
    last seen2020-06-01
    modified2020-06-02
    plugin id128491
    published2019-09-04
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128491
    titleFreeBSD : mozilla -- multiple vulnerabilities (05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2251.NASL
    descriptionThis update for MozillaFirefox to 68.1 fixes the following issues : Security issues fixed : - CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868) - CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868) - CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868) - CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin
    last seen2020-06-01
    modified2020-06-02
    plugin id129664
    published2019-10-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129664
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-2019-2251)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2773.NASL
    descriptionAn update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.9.0. Security Fix(es) : * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2019-09-19
    plugin id129037
    published2019-09-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129037
    titleRHEL 7 : thunderbird (RHSA-2019:2773)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_69_0.NASL
    descriptionThe version of Firefox installed on the remote Windows host is prior to 69.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-25 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id128525
    published2019-09-05
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128525
    titleMozilla Firefox < 69.0
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_FIREFOX_69_0.NASL
    descriptionThe version of Firefox installed on the remote macOS or Mac OS X host is prior to 69.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-25 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id128524
    published2019-09-05
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128524
    titleMozilla Firefox < 69.0
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2019-2729.NASL
    descriptionFrom Red Hat Security Advisory 2019:2729 : An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 25 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages. Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.9.0 ESR. Security Fix(es) : * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * firefox: stored passwords in
    last seen2020-05-31
    modified2019-09-12
    plugin id128747
    published2019-09-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128747
    titleOracle Linux 7 : firefox (ELSA-2019-2729)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0233_FIREFOX.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has firefox packages installed that are affected by multiple vulnerabilities: - When a master password is set, it is required to be entered again before stored passwords can be accessed in the
    last seen2020-06-01
    modified2020-06-02
    plugin id132503
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132503
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0233)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190918_THUNDERBIRD_ON_SL7_X.NASL
    descriptionThis update upgrades Thunderbird to version 60.9.0. Security Fix(es) : - Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) - Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) - Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) - Mozilla: Use-after-free while manipulating video (CVE-2019-11746) - Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) - Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)
    last seen2020-05-31
    modified2019-09-19
    plugin id129042
    published2019-09-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129042
    titleScientific Linux Security Update : thunderbird on SL7.x x86_64 (20190918)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1910.NASL
    descriptionMultiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, bypass of the same-origin policy, sandbox escape, information disclosure or denial of service. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id128555
    published2019-09-09
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128555
    titleDebian DLA-1910-1 : firefox-esr security update
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2545-1.NASL
    descriptionThis update for MozillaFirefox to 68.1 fixes the following issues : Security issues fixed : CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868) CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294) CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868) CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868) CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868) CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin
    last seen2020-06-01
    modified2020-06-02
    plugin id129583
    published2019-10-04
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129583
    titleSUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2019:2545-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2620-1.NASL
    descriptionThis update for MozillaFirefox fixes the following issues : Updated to new ESR version 68.1 (bsc#1149323). In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735. Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810). The version displayed in Help > About is now correct (bsc#1087200). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id129772
    published2019-10-10
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129772
    titleSUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2620-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2807.NASL
    descriptionAn update for thunderbird is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.9.0. Security Fix(es) : * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2019-09-19
    plugin id129041
    published2019-09-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129041
    titleRHEL 6 : thunderbird (RHSA-2019:2807)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2248.NASL
    descriptionThis update for MozillaThunderbird to version 68.1.1 fixes the following issues : - CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868) - CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868) - CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868) - CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868) - CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868) - CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868) - CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868) - CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed domain spoofing through unicode latin
    last seen2020-06-01
    modified2020-06-02
    plugin id129662
    published2019-10-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129662
    titleopenSUSE Security Update : MozillaThunderbird (openSUSE-2019-2248)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_68_1_ESR.NASL
    descriptionThe version of Firefox ESR installed on the remote Windows host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-26 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id128528
    published2019-09-05
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128528
    titleMozilla Firefox ESR < 68.1
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4122-1.NASL
    descriptionMultiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, bypass Content Security Policy (CSP) protections, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, cause a denial of service, or execute arbitrary code. (CVE-2019-5849, CVE-2019-11734, CVE-2019-11735, CVE-2019-11737, CVE-2019-11738, CVE-2019-11740, CVE-2019-11742, CVE-2019-11743, CVE-2019-11744, CVE-2019-11746, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11752) It was discovered that a compromised content process could log in to a malicious Firefox Sync account. An attacker could potentially exploit this, in combination with another vulnerability, to disable the sandbox. (CVE-2019-9812) It was discovered that addons.mozilla.org and accounts.firefox.com could be loaded in to the same content process. An attacker could potentially exploit this, in combination with another vulnerability that allowed a cross-site scripting (XSS) attack, to modify browser settings. (CVE-2019-11741) It was discovered that the
    last seen2020-06-01
    modified2020-06-02
    plugin id128521
    published2019-09-05
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128521
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.04 : firefox vulnerabilities (USN-4122-1)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_60_9_ESR.NASL
    descriptionThe version of Firefox ESR installed on the remote Windows host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-27 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-30
    modified2019-09-05
    plugin id128530
    published2019-09-05
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128530
    titleMozilla Firefox ESR < 60.9
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2019-2774.NASL
    descriptionFrom Red Hat Security Advisory 2019:2774 : An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.9.0. Security Fix(es) : * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2019-09-18
    plugin id128980
    published2019-09-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128980
    titleOracle Linux 8 : thunderbird (ELSA-2019-2774)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_THUNDERBIRD_60_9.NASL
    descriptionThe version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-29 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id128774
    published2019-09-16
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128774
    titleMozilla Thunderbird < 60.9 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2260.NASL
    descriptionThis update for MozillaFirefox to 68.1 fixes the following issues : Security issues fixed : - CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868) - CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868) - CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868) - CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin
    last seen2020-06-01
    modified2020-06-02
    plugin id129665
    published2019-10-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129665
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-2019-2260)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1926.NASL
    descriptionMultiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, information disclosure and a covert content attack on S/MIME encryption using a crafted multipart/alternative message. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id129025
    published2019-09-19
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129025
    titleDebian DLA-1926-1 : thunderbird security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2249.NASL
    descriptionThis update for MozillaThunderbird to version 68.1.1 fixes the following issues : - CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868) - CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868) - CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868) - CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868) - CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868) - CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868) - CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868) - CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed domain spoofing through unicode latin
    last seen2020-06-01
    modified2020-06-02
    plugin id129663
    published2019-10-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129663
    titleopenSUSE Security Update : MozillaThunderbird (openSUSE-2019-2249)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4523.NASL
    descriptionMultiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, information disclosure and a covert content attack on S/MIME encryption using a crafted multipart/alternative message.
    last seen2020-06-01
    modified2020-06-02
    plugin id128783
    published2019-09-16
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128783
    titleDebian DSA-4523-1 : thunderbird - security update
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_FIREFOX_60_9_ESR.NASL
    descriptionThe version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-27 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-30
    modified2019-09-05
    plugin id128529
    published2019-09-05
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128529
    titleMozilla Firefox ESR < 60.9
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2694.NASL
    descriptionAn update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 25 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages. Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.9.0 ESR. Security Fix(es) : * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * firefox: stored passwords in
    last seen2020-06-01
    modified2020-06-02
    plugin id128976
    published2019-09-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128976
    titleCentOS 6 : firefox (CESA-2019:2694)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2020-0022_THUNDERBIRD.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has thunderbird packages installed that are affected by multiple vulnerabilities: - Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user
    last seen2020-03-18
    modified2020-03-11
    plugin id134410
    published2020-03-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134410
    titleNewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0022)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201911-07.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201911-07 (Mozilla Firefox: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id131267
    published2019-11-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131267
    titleGLSA-201911-07 : Mozilla Firefox: Multiple vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2729.NASL
    descriptionAn update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 25 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages. Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.9.0 ESR. Security Fix(es) : * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * firefox: stored passwords in
    last seen2020-05-31
    modified2019-09-16
    plugin id128853
    published2019-09-16
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128853
    titleRHEL 7 : firefox (RHSA-2019:2729)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2019-2807.NASL
    descriptionFrom Red Hat Security Advisory 2019:2807 : An update for thunderbird is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.9.0. Security Fix(es) : * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2019-09-20
    plugin id129088
    published2019-09-20
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129088
    titleOracle Linux 6 : thunderbird (ELSA-2019-2807)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_FIREFOX_68_1_ESR.NASL
    descriptionThe version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-26 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id128527
    published2019-09-05
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128527
    titleMozilla Firefox ESR < 68.1
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2729.NASL
    descriptionAn update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 25 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages. Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.9.0 ESR. Security Fix(es) : * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * firefox: stored passwords in
    last seen2020-06-01
    modified2020-06-02
    plugin id129023
    published2019-09-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129023
    titleCentOS 7 : firefox (CESA-2019:2729)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190919_THUNDERBIRD_ON_SL6_X.NASL
    descriptionThis update upgrades Thunderbird to version 60.9.0. Security Fix(es) : - Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) - Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) - Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) - Mozilla: Use-after-free while manipulating video (CVE-2019-11746) - Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) - Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)
    last seen2020-05-31
    modified2019-09-20
    plugin id129093
    published2019-09-20
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129093
    titleScientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190919)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_68_1.NASL
    descriptionThe version of Thunderbird installed on the remote Windows host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-30 advisory, including the following: - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. (CVE-2019-11746) - Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. (CVE-2019-11744) - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. (CVE-2019-11752) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id128972
    published2019-09-18
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128972
    titleMozilla Thunderbird < 68.1 Multiple Vulnerabilities
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190910_FIREFOX_ON_SL6_X.NASL
    descriptionThis update upgrades Firefox to version 60.9.0 ESR.&#13; &#13; Security Fix(es):&#13; &#13; - Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812)&#13; &#13; - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and&#13; Firefox ESR 60.9 (CVE-2019-11740)&#13; &#13; - Mozilla: Same-origin policy violation with SVG filters and canvas to&#13; steal cross-origin images (CVE-2019-11742)&#13; &#13; - Mozilla: XSS by breaking out of title and textarea elements using&#13; innerHTML (CVE-2019-11744)&#13; &#13; - Mozilla: Use-after-free while manipulating video (CVE-2019-11746)&#13; &#13; - Mozilla: Use-after-free while extracting a key value in IndexedDB&#13; (CVE-2019-11752)&#13; &#13; - firefox: stored passwords in
    last seen2020-05-31
    modified2019-09-11
    plugin id128667
    published2019-09-11
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128667
    titleScientific Linux Security Update : firefox on SL6.x i386/x86_64 (20190910)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0190_THUNDERBIRD.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9. (CVE-2019-11739) - Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11740) - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11742) - Navigation events were not fully adhering to the W3C
    last seen2020-06-01
    modified2020-06-02
    plugin id129935
    published2019-10-15
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129935
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0190)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1304.NASL
    descriptionEncrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9. (CVE-2019-11739) A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11742) A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11746) It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11752) Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11744) Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11740) Navigation events were not fully adhering to the W3C
    last seen2020-05-31
    modified2019-10-04
    plugin id129562
    published2019-10-04
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129562
    titleAmazon Linux 2 : thunderbird (ALAS-2019-1304)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190911_FIREFOX_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) - Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) - Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) - Mozilla: Use-after-free while manipulating video (CVE-2019-11746) - Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) - firefox: stored passwords in
    last seen2020-05-31
    modified2019-09-16
    plugin id128861
    published2019-09-16
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128861
    titleScientific Linux Security Update : firefox on SL7.x x86_64 (20190911)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2019-2773.NASL
    descriptionFrom Red Hat Security Advisory 2019:2773 : An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.9.0. Security Fix(es) : * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2019-09-17
    plugin id128961
    published2019-09-17
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128961
    titleOracle Linux 7 : thunderbird (ELSA-2019-2773)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2019-2663.NASL
    descriptionFrom Red Hat Security Advisory 2019:2663 : An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 24 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages. Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 68.1.0 ESR. Security Fix(es) : * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1 (CVE-2019-11735) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743) * Mozilla: Persistence of WebRTC permissions in a third party context (CVE-2019-11748) * Mozilla: Camera information available without prompting using getUserMedia (CVE-2019-11749) * Mozilla: Type confusion in Spidermonkey (CVE-2019-11750) * Mozilla: Content security policy bypass through hash-based sources in directives (CVE-2019-11738) * Mozilla:
    last seen2020-05-31
    modified2019-09-09
    plugin id128599
    published2019-09-09
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128599
    titleOracle Linux 8 : firefox (ELSA-2019-2663)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_60_9.NASL
    descriptionThe version of Thunderbird installed on the remote Windows host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-29 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id128775
    published2019-09-16
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128775
    titleMozilla Thunderbird < 60.9 Multiple Vulnerabilities

Redhat

rpms
  • firefox-0:68.1.0-1.el8_0
  • firefox-debuginfo-0:68.1.0-1.el8_0
  • firefox-debugsource-0:68.1.0-1.el8_0
  • firefox-0:60.9.0-1.el6_10
  • firefox-debuginfo-0:60.9.0-1.el6_10
  • firefox-0:60.9.0-1.el7_7
  • firefox-debuginfo-0:60.9.0-1.el7_7
  • thunderbird-0:60.9.0-1.el7_7
  • thunderbird-debuginfo-0:60.9.0-1.el7_7
  • thunderbird-0:60.9.0-2.el8_0
  • thunderbird-debuginfo-0:60.9.0-2.el8_0
  • thunderbird-debugsource-0:60.9.0-2.el8_0
  • thunderbird-0:60.9.0-1.el6_10
  • thunderbird-debuginfo-0:60.9.0-1.el6_10