Mozilla Thunderbird < 15.0 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 6560

Synopsis

The remote host has an email client installed that is vulnerable to multiple attack vectors.

Description

Versions of Mozilla Thunderbird prior to 15.0 are affected by the following security issues :

- An error exists related to 'Object.defineProperty' and the location object that could allow cross-site scripting attacks. (CVE-2012-1956)
- Unspecified memory safety issues exist. (CVE-2012-1970, CVE-2012-1971)
- Multiple use-after-free errors exist. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)
- An error exists related to bitmap (BMP) and icon (ICO) file decoding that can lead to memory corruption, causing application crashes and potentially arbitrary code execution. (CVE-2012-3966)
- A use-after-free error exists related to WebGL shaders. (CVE-2012-3968)
- A buffer overflow exists related to SVG filters. (CVE-2012-3969)
- A use-after-free error exists related to elements having 'requiredFeatures' attributes. (CVE-2012-3970)
- A 'Graphite 2' library memory corruption error exists. (CVE-2012-3971)
- An XSLT out-of-bounds read error exists related to 'format-number'. (CVE-2012-3972)
- The installer can be tricked into running unauthorized executables. (CVE-2012-3974)
- The DOM parser can unintentionally load linked resources in extensions. (CVE-2012-3975)
- Security checks related to location objects can be bypassed if crafted calls are made to the browser chrome code. (CVE-2012-3978)
- Calling 'eval' in the web console can allow injected code to be executed with browser chrome privileges. (CVE-2012-3980)

Solution

Upgrade to Thunderbird 15.0 or later.

Plugin Details

Severity: High

ID: 6560

Family: SMTP Clients

Published: 8/30/2012

Updated: 3/6/2019

Nessus ID: 61717

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:thunderbird

Patch Publication Date: 8/28/2012

Vulnerability Publication Date: 8/28/2012

Reference Information

CVE: CVE-2012-1956, CVE-2012-1970, CVE-2012-1971, CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964, CVE-2012-3966, CVE-2012-3967, CVE-2012-3968, CVE-2012-3969, CVE-2012-3970, CVE-2012-3971, CVE-2012-3972, CVE-2012-3974, CVE-2012-3975, CVE-2012-3978, CVE-2012-3980

BID: 55260, 55257, 55264, 55266, 55274, 55276, 55277, 55278, 55292, 55304, 55306, 55310, 55314, 55316, 55317, 55318, 55319, 55320, 55321, 55322, 55323, 55324, 55325, 55340, 55341, 55342, 55311, 55312, 55249

Detections

Analytics