Detections
Analytics
Mozilla Thunderbird 16.x < 16.0.2 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 6614
Synopsis
The remote host has an email client installed that is vulnerable to multiple attack vectors.Description
Versions of Mozilla Thunderbird 16.x prior to 16.0.2 are affected by the following security issues :- The true value of 'window.location' can be shadowed by user content through the use of the 'valueOf' method, which can be combined with some plugins to perform cross-site scripting attacks. (CVE-2012-4194)
- The 'CheckURL' function of 'window.location' can be forced to return the wrong calling document and principal, allowing a cross-site scripting attack. (CVE-2012-4195)
- It is possible to use property injection by prototype to bypass security wrapper protections on the 'Location' object, allowing the cross-origin reading of the 'Location' object. (CVE-2012-4196)
Solution
Upgrade to Thunderbird 16.0.2 or later.See Also
http://www.mozilla.org/security/announce/2012/mfsa2012-90.html
Plugin Details
Severity: Medium
ID: 6614
Family: SMTP Clients
Published: 11/5/2012
Updated: 3/6/2019
Nessus ID: 62746
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:thunderbird
Patch Publication Date: 10/26/2012
Vulnerability Publication Date: 10/26/2012