The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5423 advisory.

  - The error page for sites with invalid TLS certificates was missing the activation-delay Thunderbird uses     to protect prompts and permission dialogs from attacks that exploit human response time delays. If a     malicious page elicited user clicks in precise locations immediately before navigating to a site with a     certificate error and made the renderer extremely busy at the same time, it could create a gap between     when the error page was loaded and when the display actually refreshed. With the right timing the elicited     clicks could land in that gap and  activate the button that overrides the certificate error for that site.
    (CVE-2023-34414)

  - Mozilla developers and community members Gabriele Svelto, Andrew McCreight, the Mozilla Fuzzing Team, Sean     Feng, and Sebastian Hengst reported memory safety bugs present in Thunderbird 102.11. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code.  (CVE-2023-34416)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5423-1 : thunderbird - security update

critical Nessus Plugin ID 177104

Version 1.3