Fedora 41 : thunderbird (2025-23fe8c5b7e)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-23fe8c5b7e advisory. Update to 128.10.0 https://www.thunderbird.net/en-US/thunderbird/128.10.0esr/releasenotes/ Tenable has extracted the preceding description block...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 9 : firefox (RHSA-2025:4443)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4443 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

SUSE: Security Advisory (SUSE-SU-2025:1436-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-upstream / etc (SUSE-SU-2025:1436-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1436-1 advisory. - Firefox Extended Support Release 128.10.0 ESR MFSA 2025-29 bsc1241621: CVE-2025-2817: Potentia...

SUSE: Security Advisory (SUSE-SU-2025:1414-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

firefox-esr-128.10.0-1.1 on GA media (moderate)

firefox-esr-128.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15040-1 Rating: moderate Cross-References: CVE-2025-2817 CVSS scores: CVE-2025-2817 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2025-2817 SUSE : 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA...

Slackware: Security Advisory (SSA:2025-119-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-2817

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the...

CVE-2025-2817

creationtimestamp| type| source ---|---|--- 2025-04-29 15:50:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnxn322ska2t 2025-04-29 16:49:03+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114422273849158475 2025-04-29 16:49:55+00:00| seen|...

CVE-2025-2817

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...

CVE-2025-2817

The CVE-2025-2817 issue describes a vulnerability in Thunderbird’s update mechanism where a medium-integrity user process could interfere with the SYSTEM updater by manipulating file-locking, enabling privilege escalation via code injection into a user-privileged process. Affected products includ...

CVE-2025-2817 Privilege escalation in Thunderbird Updater

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...

Mozilla Thunderbird ESR < 128.10

The version of Thunderbird ESR installed on the remote Windows host is prior to 128.10. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-32 advisory. - Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of...

Mozilla Firefox ESR < 115.23

The version of Firefox ESR installed on the remote Windows host is prior to 115.23. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-30 advisory. - A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allo...

Mozilla Firefox ESR < 115.23

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.23. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-30 advisory. - A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which...

Linux Distros Unpatched Vulnerability : CVE-2022-2817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use After Free in GitHub repository vim/vim prior to 9.0.0213. CVE-2022-2817 Note that Nessus relies on the presence of the package as reported by the vendor...

CVE-2020-2817

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite component: Miscellaneous. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attac...

openSUSE 15 Security Update : python-Django (SUSE-SU-2024:2817-1)

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2817-1 advisory. - CVE-2024-42005: Fixed SQL injection in QuerySet.values and valueslist bsc1228629 - CVE-2024-41989: Fixed Memory exhaustion in...

CVE-2024-2817

A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploi...