Detections
Analytics
Mozilla Thunderbird < 31.4 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 8625
Synopsis
The remote host has an email client installed that is vulnerable to multiple attack vectors.Description
Versions of Mozilla Thunderbird prior to 31.4 are prone to the following vulnerabilities :- Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635)
- A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header. This allows malicious sites to perform XSRF attacks. (CVE-2014-8638)
- A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)
Solution
Upgrade to Thunderbird 31.4, or later.See Also
http://www.mozilla.org/security/announce/2014/mfsa2015-01.html
http://www.mozilla.org/security/announce/2014/mfsa2015-03.html
http://www.mozilla.org/security/announce/2014/mfsa2015-04.html
Plugin Details
Severity: High
ID: 8625
Family: SMTP Clients
Published: 1/16/2015
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:thunderbird
Patch Publication Date: 1/13/2015
Vulnerability Publication Date: 1/13/2015
Reference Information
CVE: CVE-2014-8634, CVE-2014-8635, CVE-2014-8638, CVE-2014-8639