Detections
Analytics
Mozilla Thunderbird < 7.0 Multiple Vulnerabilities
high Nessus Plugin ID 56336
Language:
Synopsis
The remote Windows host contains a mail client that may be affected by multiple vulnerabilities.Description
The installed version of Thunderbird is earlier than 7.0 and thus, is potentially affected by the following security issues :- If an attacker could trick a user into holding down the 'Enter' key, via a malicious game, for example, a malicious application or extension could be downloaded and executed.(CVE-2011-2372, CVE-2011-3001)
- Unspecified errors exist that can be exploited to corrupt memory. No additional information is available at this time. (CVE-2011-2995, CVE-2011-2997)
- A weakness exists when handling the 'Location' header.
This can lead to response splitting attacks when visiting a vulnerable web server. The same fix has been applied to the headers 'Content-Length' and 'Content-Disposition'. (CVE-2011-3000)
- A use-after-free error exists when parsing OGG headers.
(CVE-2011-3005)
- There is an unspecified error within the YARR regular expression library that can be exploited to corrupt memory. (CVE-2011-3232)
Solution
Upgrade to Thunderbird 7.0 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2011-36/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-39/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-40/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-42/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-44/
Plugin Details
Severity: High
ID: 56336
File Name: mozilla_thunderbird_70.nasl
Version: 1.9
Type: local
Agent: windows
Family: Windows
Published: 9/29/2011
Updated: 7/16/2018
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:mozilla:thunderbird
Required KB Items: Mozilla/Thunderbird/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 9/27/2011
Vulnerability Publication Date: 9/27/2011
Reference Information
CVE: CVE-2011-2372, CVE-2011-2995, CVE-2011-2997, CVE-2011-3000, CVE-2011-3001, CVE-2011-3005, CVE-2011-3232