The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2939 advisory.

  - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox <     97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
    (CVE-2022-26486)

  - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR     < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. (CVE-2022-26485)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-2939-1 : thunderbird - LTS security update

critical Nessus Plugin ID 158747

Version 1.5

Version 1.4

Version 1.3

Version 1.5 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 1.4 Mar 21, 2023, 7:30 PM Plugin metadata Plugin Feed: 202303211930
Version 1.3 Jan 3, 2023, 2:02 PM CVSS metrics ("CVSSv2 score" changed from "7.5" to "10.0") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" changed from "9.8" to "9.6") CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H") CVSSv3 score source (set to "CVE-2022-26486") Plugin Feed: 202301031402