Detections
Analytics
Thunderbird 3.1 < 3.1.16 Multiple Vulnerabilities (Mac OS X)
high Nessus Plugin ID 56757
Language:
Synopsis
The remote Mac OS X host contains an email client that is potentially affected by multiple vulnerabilities.Description
The installed version of Thunderbird 3.1 is earlier than 3.1.16. Such versions are potentially affected by the following security issues :- There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'. By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code.
(CVE-2011-3647)
- Certain invalid sequences are not handled properly in 'Shift-JIS' encoding, which can allow cross-site scripting attacks. (CVE-2011-3648)
- Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
Solution
Upgrade to Thunderbird 3.1.16 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2011-46/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-47/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-49/
Plugin Details
Severity: High
ID: 56757
File Name: macosx_thunderbird_3_1_16.nasl
Version: 1.9
Type: local
Agent: macosx
Family: MacOS X Local Security Checks
Published: 11/9/2011
Updated: 7/14/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:mozilla:thunderbird
Required KB Items: MacOSX/Thunderbird/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 11/8/2011
Vulnerability Publication Date: 11/8/2011