The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2428-1 advisory.

    Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, and Max Jonas Werner discovered multiple memory     safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with     scripting enabled, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird.
    (CVE-2014-1587)

    Joe Vennix discovered a crash when using XMLHttpRequest in some circumstances. If a user were tricked in     to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this     to cause a denial of service. (CVE-2014-1590)

    Berend-Jan Wever discovered a use-after-free during HTML parsing. If a user were tricked in to opening a     specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a     denial of service via application crash or execute arbitrary code with the privileges of the user invoking     Thunderbird. (CVE-2014-1592)

    Abhishek Arya discovered a buffer overflow when parsing media content. If a user were tricked in to     opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to     cause a denial of service via application crash or execute arbitrary code with the privileges of the user     invoking Thunderbird. (CVE-2014-1593)

    Byoungyoung Lee, Chengyu Song, and Taesoo Kim discovered a bad cast in the compositor. If a user were     tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause     undefined behaviour, a denial of service via application crash or execute abitrary code with the     privileges of the user invoking Thunderbird. (CVE-2014-1594)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2428-1)

critical Nessus Plugin ID 79716

Version 1.17