The version of thunderbird installed on the remote host is prior to 91.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1855 advisory.

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla     developers and the Mozilla Fuzzing Team reporting memory safety bugs in Firefox 102. Some of these bugs     showed evidence of memory corruption, and we presume that with enough effort, some of these could have     been exploited to run arbitrary code. (CVE-2022-2505)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when visiting     directory listings for `chrome://` URLs as source text, some parameters were reflected. (CVE-2022-36318)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when     combining CSS properties for overflow and transform, the mouse cursor could interact with different     coordinates than displayed. (CVE-2022-36319)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of an attacker     abusing XSLT error handling to associate attacker-controlled content with another origin, which was     displayed in the address bar. This issue could be used to fool the user into submitting data intended for     the spoofed origin. (CVE-2022-38472)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a cross-     origin iframe referencing an XSLT document inheriting the parent domain's permissions (such as microphone     or camera access). (CVE-2022-38473)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a data race     that could occur in the `PK11_ChangePW` function, potentially leading to a use-after-free vulnerability.
    In Firefox, this lock protected the data when a user changed their master password. (CVE-2022-38476)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla     developer Nika Layzell and the Mozilla Fuzzing Team, reporting memory safety bugs present in Firefox 103     and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption, and we presume that with     enough effort, some of these could have been exploited to run arbitrary code. (CVE-2022-38477)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of members on     the Mozilla Fuzzing Team reporting memory safety bugs present in Firefox 103, Firefox ESR 102.1, and     Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption, and we presume that with     enough effort, some of these could have been exploited to run arbitrary code. (CVE-2022-38478)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : thunderbird (ALAS-2022-1855)

high Nessus Plugin ID 166000

Version 1.5

Version 1.4

Version 1.3

Version 1.5 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955
Version 1.4 Jan 2, 2023, 2:02 PM CVSS metrics ("CVSSv2 score" changed from "7.5" to "10.0") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" changed from "7.5" to "8.8") CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H") CVSSv3 score source (set to "CVE-2022-38478") Plugin Feed: 202301021402
Version 1.3 Oct 18, 2022, 10:07 AM IAVM reference Plugin Feed: 202210181007