It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0845 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26381)

  - When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
    (CVE-2022-26383)

  - If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not     <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript     execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26384)

  - Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in     <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be     affected by other local users. This behavior was reverted to the original, user-specific directory.
    <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This     vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7. (CVE-2022-26386)

  - When installing an add-on, Firefox verified the signature before prompting the user; but while the user     was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have     noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
    (CVE-2022-26387)

  - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR     < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. (CVE-2022-26485)

  - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox <     97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
    (CVE-2022-26486)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-14 (Mozilla Thunderbird: Multiple Vulnerabilities)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-29967, CVE-2021-29969,     CVE-2021-29970, CVE-2021-29976, CVE-2021-29980, CVE-2021-29984, CVE-2021-29985, CVE-2021-29986,     CVE-2021-29988, CVE-2021-29989, CVE-2021-30547, CVE-2021-38492, CVE-2021-38493, CVE-2021-38495,     CVE-2021-38503, CVE-2021-38504, CVE-2021-38506, CVE-2021-38507, CVE-2021-38508, CVE-2021-38509,     CVE-2021-40529, CVE-2021-4129, CVE-2021-4140, CVE-2021-43528, CVE-2021-43529, CVE-2021-43536,     CVE-2021-43537, CVE-2021-43538, CVE-2021-43539, CVE-2021-43541, CVE-2021-43542, CVE-2021-43543,     CVE-2021-43545, CVE-2021-43546, CVE-2022-0566, CVE-2022-1196, CVE-2022-1197, CVE-2022-1520, CVE-2022-1529,     CVE-2022-1802, CVE-2022-1834, CVE-2022-2200, CVE-2022-2226, CVE-2022-22737, CVE-2022-22738,     CVE-2022-22739, CVE-2022-22740, CVE-2022-22741, CVE-2022-22742, CVE-2022-22743, CVE-2022-22745,     CVE-2022-22747, CVE-2022-22748, CVE-2022-22751, CVE-2022-22754, CVE-2022-22756, CVE-2022-22759,     CVE-2022-22760, CVE-2022-22761, CVE-2022-22763, CVE-2022-22764, CVE-2022-24713, CVE-2022-26381,     CVE-2022-26383, CVE-2022-26384, CVE-2022-26386, CVE-2022-26387, CVE-2022-26485, CVE-2022-26486,     CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289, CVE-2022-29909,     CVE-2022-29911, CVE-2022-29912, CVE-2022-29913, CVE-2022-29914, CVE-2022-29916, CVE-2022-29917,     CVE-2022-31736, CVE-2022-31737, CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,     CVE-2022-31747, CVE-2022-34468, CVE-2022-34470, CVE-2022-34472, CVE-2022-34478, CVE-2022-34479,     CVE-2022-34481, CVE-2022-34484, CVE-2022-36318, CVE-2022-36319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 91.7.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1779 advisory.

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26381)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0850 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26381)

  - When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
    (CVE-2022-26383)

  - If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not     <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript     execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26384)

  - Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in     <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be     affected by other local users. This behavior was reverted to the original, user-specific directory.
    <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This     vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7. (CVE-2022-26386)

  - When installing an add-on, Firefox verified the signature before prompting the user; but while the user     was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have     noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
    (CVE-2022-26387)

  - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR     < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. (CVE-2022-26485)

  - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox <     97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
    (CVE-2022-26486)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5345-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, bypass security restrictions, obtain sensitive information, cause undefined behaviour, spoof the     browser UI, or execute arbitrary code. (CVE-2022-22759, CVE-2022-22760, CVE-2022-22761, CVE-2022-22763,     CVE-2022-22764, CVE-2022-26381, CVE-2022-26383, CVE-2022-26384)

    It was discovered that extensions of a particular type could auto-update themselves and bypass the prompt     that requests permissions. If a user were tricked into installing a specially crafted extension, an     attacker could potentially exploit this to bypass security restrictions. (CVE-2022-22754)

    It was discovered that dragging and dropping an image into a folder could result in it being marked as     executable. If a user were tricked into dragging and dropping a specially crafted image, an attacker could     potentially exploit this to execute arbitrary code. (CVE-2022-22756)

    It was discovered that files downloaded to /tmp were accessible to other users. A local attacker could     exploit this to obtain sensitive information. (CVE-2022-26386)

    A TOCTOU bug was discovered when verifying addon signatures during install. A local attacker could     potentially exploit this to trick a user into installing an addon with an invalid signature.
    (CVE-2022-26387)

    An out-of-bounds write by one byte was discovered when processing messages in some circumstances. If a     user were tricked into opening a specially crafted message, an attacker could potentially exploit this to     cause a denial of service. (CVE-2022-0566)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0850-1 advisory.

  - Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

  - Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

  - expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code  execution (CVE-2022-25235)

  - expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

  - expat: Integer overflow in storeRawNames() (CVE-2022-25315)

  - Mozilla: Use-after-free in text reflows (CVE-2022-26381)

  - Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

  - Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

  - Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

  - thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

  - Mozilla: Temporary files downloaded to /tmp and accessible by other local  users (CVE-2022-26386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0847 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

    * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * Mozilla: Use-after-free in text reflows (CVE-2022-26381)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

    * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

    * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

    * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

    * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0853 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

    * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * Mozilla: Use-after-free in text reflows (CVE-2022-26381)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

    * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

    * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

    * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

    * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0845 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

    * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * Mozilla: Use-after-free in text reflows (CVE-2022-26381)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

    * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

    * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

    * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

    * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0850 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

    * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * Mozilla: Use-after-free in text reflows (CVE-2022-26381)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

    * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

    * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

    * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

    * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0843 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

    * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * Mozilla: Use-after-free in text reflows (CVE-2022-26381)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

    * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

    * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

    * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

    * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-0845 advisory.

    [91.7.0-2.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [91.7.0-2]
    - Update to 91.7.0 build2

    [91.7.0-1]
    - Update to 91.7.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-0850 advisory.

    [91.7.0-2.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
    - Enabled aarch64 build

    [91.7.0-2]
    - Update to 91.7.0 build2

    [91.7.0-1]
    - Update to 91.7.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2930 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0559-1 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message.  (CVE-2022-0566)

  - A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant     Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access. This     bug only affects Thunderbird on Windows. Other operating systems are unaffected.  (CVE-2022-22753)

  - If a user installed an extension of a particular type, the extension could have auto-updated itself and     while doing so, bypass the prompt which grants the new version the new requested permissions.
    (CVE-2022-22754)

  - If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object     could have been changed into an executable script which would have run arbitrary code after the user     clicked on it.  (CVE-2022-22756)

  - If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an     element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have     run despite the iframe's sandbox.  (CVE-2022-22759)

  - When importing resources using Web Workers, error messages would distinguish the difference between     <code>application/javascript</code> responses and non-script responses.  This could have been abused to     learn information cross-origin.  (CVE-2022-22760)

  - Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the     frame-ancestors directive when it was used in the Web Extension's Content Security Policy.
    (CVE-2022-22761)

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible.  (CVE-2022-22763)

  - Mozilla developers and community members Paul Adenot and the Mozilla Fuzzing Team reported memory safety     bugs present in Thunderbird 91.5. Some of these bugs showed evidence of memory corruption and we presume     that with enough effort some of these could have been exploited to run arbitrary code.  (CVE-2022-22764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0559-1 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

  - A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant     Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM     access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22753)

  - If a user installed an extension of a particular type, the extension could have auto-updated itself and     while doing so, bypass the prompt which grants the new version the new requested permissions. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22754)

  - If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object     could have been changed into an executable script which would have run arbitrary code after the user     clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
    (CVE-2022-22756)

  - If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an     element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have     run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22759)

  - When importing resources using Web Workers, error messages would distinguish the difference between     <code>application/javascript</code> responses and non-script responses. This could have been abused to     learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22760)

  - Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the     frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This     vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22761)

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox     ESR < 91.6. (CVE-2022-22763)

  - Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22764)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5086 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mozilla-thunderbird installed on the remote host is prior to 91.6.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-048-01 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 91.6.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2022-07 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. (CVE-2022-0566)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.6.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2022-07 advisory.

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. (CVE-2022-0566)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184749	Rocky Linux 8 : thunderbird (RLSA-2022:0845)	Nessus	Rocky Linux Local Security Checks	critical
163986	GLSA-202208-14 : Mozilla Thunderbird: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
160270	Amazon Linux 2 : thunderbird (ALAS-2022-1779)	Nessus	Amazon Linux Local Security Checks	critical
159320	CentOS 7 : thunderbird (RHSA-2022:0850)	Nessus	CentOS Local Security Checks	critical
159189	Ubuntu 18.04 LTS / 20.04 LTS : Thunderbird vulnerabilities (USN-5345-1)	Nessus	Ubuntu Local Security Checks	critical
158922	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:0850)	Nessus	Scientific Linux Local Security Checks	critical
158918	RHEL 8 : thunderbird (RHSA-2022:0847)	Nessus	Red Hat Local Security Checks	critical
158914	RHEL 8 : thunderbird (RHSA-2022:0853)	Nessus	Red Hat Local Security Checks	critical
158913	RHEL 8 : thunderbird (RHSA-2022:0845)	Nessus	Red Hat Local Security Checks	critical
158907	RHEL 7 : thunderbird (RHSA-2022:0850)	Nessus	Red Hat Local Security Checks	critical
158906	RHEL 8 : thunderbird (RHSA-2022:0843)	Nessus	Red Hat Local Security Checks	critical
158904	Oracle Linux 8 : thunderbird (ELSA-2022-0845)	Nessus	Oracle Linux Local Security Checks	critical
158903	Oracle Linux 7 : thunderbird (ELSA-2022-0850)	Nessus	Oracle Linux Local Security Checks	critical
158511	Debian DLA-2930-1 : thunderbird - LTS security update	Nessus	Debian Local Security Checks	high
158340	openSUSE 15 Security Update : MozillaThunderbird (openSUSE-SU-2022:0559-1)	Nessus	SuSE Local Security Checks	critical
158339	SUSE SLED15 / SLES15 Security Update : MozillaThunderbird (SUSE-SU-2022:0559-1)	Nessus	SuSE Local Security Checks	critical
158335	Debian DSA-5086-1 : thunderbird - security update	Nessus	Debian Local Security Checks	high
158149	Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2022-048-01)	Nessus	Slackware Local Security Checks	high
158069	Mozilla Thunderbird < 91.6.1	Nessus	Windows	high
158068	Mozilla Thunderbird < 91.6.1	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2022-0566

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

high

high

high

high