Detections
Analytics
Mozilla Thunderbird < 3.0.5 Multiple Vulnerabilities
high Nessus Plugin ID 47125
Language:
Synopsis
The remote Windows host contains a mail client that is affected by multiple vulnerabilities.Description
The installed version of Thunderbird is earlier than 3.0.5. Such versions are potentially affected by the following security issues :- A memory corruption vulnerability can lead to arbitrary code execution if garbage collection is carefully timed after DOM nodes are moved between documents.
(MFSA 2010-25)
- Multiple crashes can result in arbitrary code execution. (MFSA 2010-26)
- An error in 'nsGenericDOMDataNode' allows a buffer overflow in certain DOM nodes leading to arbitrary code execution. (MFSA 2010-29)
- An error in a XSLT node sorting function contains an integer overflow leading to application crashes and possible arbitrary code execution. (MFSA 2010-30)
Solution
Upgrade to Thunderbird 3.0.5 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2010-25/
https://www.mozilla.org/en-US/security/advisories/mfsa2010-26/
https://www.mozilla.org/en-US/security/advisories/mfsa2010-29/
https://www.mozilla.org/en-US/security/advisories/mfsa2010-30/
Plugin Details
Severity: High
ID: 47125
File Name: mozilla_thunderbird_305.nasl
Version: 1.15
Type: local
Agent: windows
Family: Windows
Published: 6/23/2010
Updated: 7/16/2018
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:mozilla:thunderbird
Required KB Items: Mozilla/Thunderbird/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/22/2010
Vulnerability Publication Date: 3/24/2010
Reference Information
CVE: CVE-2010-1121, CVE-2010-1196, CVE-2010-1199
Secunia: 40323