Detections
Analytics
AlmaLinux 9 : thunderbird (ALSA-2023:3150)
high Nessus Plugin ID 176054
Synopsis
The remote AlmaLinux host is missing one or more security updates.Description
The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:3150 advisory.- In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. (CVE-2023-32205)
- An out-of-bound read could have led to a crash in the RLBox Expat driver. (CVE-2023-32206)
- A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. (CVE-2023-32207)
- A type checking bug would have led to invalid code being compiled. (CVE-2023-32211)
- An attacker could have positioned a <code>datalist</code> element to obscure the address bar.
(CVE-2023-32212)
- When reading a file, an uninitialized value could have been used as read limit. (CVE-2023-32213)
- Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2023-32215)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected thunderbird package.See Also
Plugin Details
Severity: High
ID: 176054
File Name: alma_linux_ALSA-2023-3150.nasl
Version: 1.3
Type: local
Family: Alma Linux Local Security Checks
Published: 5/18/2023
Updated: 6/16/2023
Supported Sensors: Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-32215
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:alma:linux:9::baseos, cpe:/o:alma:linux:9::highavailability, cpe:/o:alma:linux:9::resilientstorage, cpe:/o:alma:linux:9::appstream, cpe:/o:alma:linux:9::realtime, cpe:/o:alma:linux:9, cpe:/o:alma:linux:9::sap_hana, p-cpe:/a:alma:linux:thunderbird, cpe:/o:alma:linux:9::supplementary, cpe:/o:alma:linux:9::sap, cpe:/o:alma:linux:9::nfv, cpe:/o:alma:linux:9::crb
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 5/16/2023
Vulnerability Publication Date: 5/9/2023
Reference Information
CVE: CVE-2023-32205, CVE-2023-32206, CVE-2023-32207, CVE-2023-32211, CVE-2023-32212, CVE-2023-32213, CVE-2023-32215