Detections
Analytics
Mozilla Thunderbird 3.1.x < 3.1.16 Multiple Vulnerabilities
high Nessus Plugin ID 56752
Language:
Synopsis
The remote Windows host contains a mail client that is potentially affected by multiple vulnerabilities.Description
The installed version of Thunderbird 3.1.x is earlier than 3.1.16 and is potentially affected by the following vulnerabilities:- There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'. By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code.
(CVE-2011-3647)
- Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
- Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
Solution
Upgrade to Thunderbird 3.1.16 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2011-46/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-47/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-49/
Plugin Details
Severity: High
ID: 56752
File Name: mozilla_thunderbird_3116.nasl
Version: 1.9
Type: local
Agent: windows
Family: Windows
Published: 11/9/2011
Updated: 7/16/2018
Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:mozilla:thunderbird
Required KB Items: Mozilla/Thunderbird/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 11/8/2011
Vulnerability Publication Date: 11/8/2011