Oracle Linux 7 : thunderbird (ELSA-2023-3563)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-3563 advisory. 102.12.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 102.12.0-1 - Update to...

Fedora 38 : thunderbird (2023-edb2509e26)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-edb2509e26 advisory. Update to 102.12.0 ; https://www.thunderbird.net/en-US/thunderbird/102.12.0/releasenotes/ ;...

Debian dla-3452 : thunderbird - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3452 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3452-1 [email protected]...

Mozilla Thunderbird < 102.12

The version of Thunderbird installed on the remote Windows host is prior to 102.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-21 advisory. - Mozilla developers and community members Gabriele Svelto, Andrew McCreight, the Mozilla Fuzzing Team, Sean Feng,...

SUSE: Security Advisory (SUSE-SU-2023:2469-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:2471-1 Security update for openssl1

This update for openssl1 fixes the following issues: - CVE-2023-2650: Fixed possible denial of service translating ASN.1 object identifiers bsc1211430. - Update further expiring certificates that affect tests bsc1201627...

SUSE-SU-2023:2469-1 Security update for openssl

This update for openssl fixes the following issues: - CVE-2023-2650: Fixed possible denial of service translating ASN.1 object identifiers bsc1211430. - Update further expiring certificates that affect test cases bsc1201627...

SUSE SLES15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:2440-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2440-1 advisory. Extended Support Release 102.12.0 ESR bsc1211922: - CVE-2023-34414: Click-jacking certificate exceptions through rendering lag -...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:2441-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2441-1 advisory. Extended Support Release 102.12.0 ESR bsc1211922: - CVE-2023-34414: Click-jacking certificate exceptions through rendering lag -...

(Pwn2Own) Western Digital MyCloud PR4100 Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Western Digital MyCloud PR4100 NAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the generation of TLS certificates. The issue results...

Debian dla-3448 : firefox-esr - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3448 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3448-1 [email protected]...

Debian DSA-5421-1 : firefox-esr - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5421 advisory. - The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that...

SUSE CVE-2023-34414

The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a sit...

[SECURITY] Fedora 38 Update: curl-8.0.1-2.fc38

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-6143-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6143-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially explo...

Fedora 38 : curl (2023-37eac50e9b)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-37eac50e9b advisory. - fix more POST-after-PUT confusion CVE-2023-28322 - fix IDN wildcard match CVE-2023-28321 Tenable has extracted the preceding description block...

Security Vulnerabilities fixed in Thunderbird 102.12 — Mozilla

The error page for sites with invalid TLS certificates was missing the activation-delay Thunderbird uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a...

Improper Certificate Validation

curl is vulnerable to Improper Certificate Validation. The vulnerability allows matching of wildcard patterns when listed as 'Subject Alternative Name' in TLS server certificates and could result in accepting patterns that otherwise should be mismatched...

CVE-2023-34414

The Mozilla Foundation Security Advisory describes this flaw as: The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user...

Mozilla Firefox ESR < 102.12

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 102.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-19 advisory. - Mozilla developers and community members Gabriele Svelto, Andrew McCreight, the Mozilla Fuzzing Team,...