The version of thunderbird installed on the remote host is prior to 91.7.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1779 advisory.

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-     bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
    (CVE-2022-0566)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and     Thunderbird < 91.7. (CVE-2022-26381)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : thunderbird (ALAS-2022-1779)

critical Nessus Plugin ID 160270

Version 1.6

Version 1.5

Version 1.6 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 1.5 Mar 21, 2023, 7:30 PM Plugin metadata Plugin Feed: 202303211930