Detections
Analytics
AlmaLinux 8 : thunderbird (ALSA-2023:0463)
high Nessus Plugin ID 170698
Synopsis
The remote AlmaLinux host is missing one or more security updates.Description
The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:0463 advisory.- An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108. (CVE-2022-46871)
- By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108. (CVE-2022-46877)
- Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598)
- Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599)
- Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601)
- Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers (CVE-2023-23602)
- Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive (CVE-2023-23603)
- Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected thunderbird package.See Also
Plugin Details
Severity: High
ID: 170698
File Name: alma_linux_ALSA-2023-0463.nasl
Version: 1.2
Type: local
Family: Alma Linux Local Security Checks
Published: 1/27/2023
Updated: 10/24/2023
Supported Sensors: Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-23605
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:alma:linux:8, cpe:/o:alma:linux:8::appstream, p-cpe:/a:alma:linux:thunderbird
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 1/25/2023
Vulnerability Publication Date: 12/15/2022
Reference Information
CVE: CVE-2022-46871, CVE-2022-46877, CVE-2023-23598, CVE-2023-23599, CVE-2023-23601, CVE-2023-23602, CVE-2023-23603, CVE-2023-23605