The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5663-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service,

    spoof the mouse pointer position, obtain sensitive information, spoof the contents of the addressbar,     bypass security restrictions, or execute arbitrary code. (CVE-2022-2505, CVE-2022-36318, CVE-2022-36319,     CVE-2022-38472, CVE-2022-38473, CVE-2022-38476 CVE-2022-38477, CVE-2022-38478)

    Multiple security issues were discovered in Thunderbird. An attacker could potentially exploit these in     order to determine when a user opens a specially crafted message. (CVE-2022-3032, CVE-2022-3034)

    It was discovered that Thunderbird did not correctly handle HTML messages that contain a meta tag in some     circumstances. If a user were tricked into replying to a specially crafted message, an attacker could     potentially exploit this to obtain sensitive information. (CVE-2022-3033)

    A security issue was discovered with the Matrix SDK in Thunderbird. An attacker sharing a room with a user     could potentially exploit this to cause a denial of service. (CVE-2022-36059)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Thunderbird vulnerabilities (USN-5663-1)

high Nessus Plugin ID 165820

Version 1.7

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.3

Version 1.7 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.6 Jul 11, 2023, 4:01 AM Detection Plugin Feed: 202307110401
Version 1.5 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.5 Jul 11, 2023, 1:48 AM Detection Plugin Feed: 202307110148
Version 1.4 Jan 2, 2023, 2:02 PM CVSS metrics ("CVSSv2 score" changed from "5.8" to "10.0") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" changed from "7.5" to "8.8") CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2022-3033" to "CVE-2022-38478") CVSSv2 severity (based on CVE-2022-38478, severity increased from "Medium" to "High") Plugin Feed: 202301021402
Version 1.3 Oct 11, 2022, 10:05 AM IAVM reference Plugin Feed: 202210111005