The installed version of Thunderbird is earlier than 2.0.0.18.  Such versions are potentially affected by the following security issues :

  - The canvas element can be used in conjunction with an     HTTP redirect to bypass same-origin restrictions and     gain access to the content in arbitrary images from     other domains. (MFSA 2008-48)

  - By tampering with the window.__proto__.__proto__ object,     one can cause the browser to place a lock on a non-     native object, leading to a crash and possible code     execution. (MFSA 2008-50)

  - There are several stability bugs in the browser engine     that could lead to crashes with evidence of memory     corruption. (MFSA 2008-52)

  - Crashes and remote code execution in nsFrameManager are     possible by modifying certain properties of a file     input element before it has finished initializing.
    (MFSA 2008-55)

  - The same-origin check in     'nsXMLHttpRequest::NotifyEventListeners()' can be     bypassed. (MFSA 2008-56)

  - There is an error in the method used to parse the     default namespace in an E4X document caused by quote     characters in the namespace not being properly escaped.
    (MFSA 2008-58)

  - Scripts in a malicous mail message can access the     .document URI and .textContext DOM properties.
    (MFSA 2008-59)

The installed version of SeaMonkey is earlier than 1.1.13.  Such versions are potentially affected by the following security issues :

  - Locally saved '.url' shortcut files can be used to read     information stored in the local cache. (MFSA 2008-47)

  - The canvas element can be used in conjunction with an     HTTP redirect to bypass same-origin restrictions and     gain access to the content in arbitrary images from     other domains. (MFSA 2008-48)

  - Arbitrary code execution is possible via Flash Player     dynamic module unloading. (MFSA 2008-49)

  - By tampering with the window.__proto__.__proto__ object,     one can cause the browser to place a lock on a non-     native object, leading to a crash and possible code     execution. (MFSA 2008-50)

  - There are several stability bugs in the browser engine     that may lead to crashes with evidence of memory     corruption. (MFSA 2008-52)

  - There is a buffer overflow that can be triggered by     sending a specially crafted 200 header line in the HTTP     index response. (MFSA 2008-54)

  - Crashes and remote code execution in nsFrameManager are     possible by modifying certain properties of a file     input element before it has finished initializing.
    (MFSA 2008-55)

  - The same-origin check in     'nsXMLHttpRequest::NotifyEventListeners()' can be     bypassed. (MFSA 2008-56)

  - The '-moz-binding' CSS property can be used to bypass     security checks which validate codebase principals.
    (MFSA 2008-57)

  - There is an error in the method used to parse the     default namespace in an E4X document caused by quote     characters in the namespace not being properly escaped.
    (MFSA 2008-58)

  - Scripts in a malicous mail message can access the     .document URI and .textContext. DOM properties.
    (MFSA 2008-59)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Versions of Mozilla Thunderbird prior to 2.0.0.18 are affected by the following vulnerabilities :

 - The canvas element can be used in conjunction with an HTTP redirect to bypass same-origin restrictions and gain access to the content in arbitrary images from other domains. (MFSA 2008-48)
 - By tampering with the 'window.__proto__' object, one can cause the browser to place a lock on a non-native object, leading to a crash and possible code execution. (MFSA 2008-50)
 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-52)
 - Crashes and remote code execution in nsFrameManager are possible by modifying certain properties of a file input element before it has finished initializing. (MFSA 2008-55)
 - The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)
 - There is an error in the method used to parse the default namespace in an E4X document caused by quote characters in the namespace not being properly escaped. (MFSA 2008-58)
 - Scripts in a malicious mail message can access the .document URI and .textContext DOM properties. (MFSA 2008-59)

The installed version of Thunderbird is earlier than 2.0.0.18.  Such versions are potentially affected by the following security issues : 


  - The canvas element can be used in conjunction with an HTTP redirect to bypass same-origin restrictions and gain access to the content in arbitrary images from other domains. (MFSA 2008-48)
  - By tampering with the window.__proto__.__proto__ object, one can cause the browser to place a lock on a non-native object, leading to a crash and possible code execution. (MFSA 2008-50)
  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-52)
  - Crashes and remote code execution in nsFrameManager are possible by modifying certain properties of a file input element before it has finished initializing. (MFSA 2008-55)
  - The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)
  - There is an error in the method used to parse the default namespace in an E4X document caused by quote characters in the namespace not being properly escaped. (MFSA 2008-58)
  - Scripts in a malicious mail message can access the .document URI and .textContext DOM properties. (MFSA 2008-59)

ID	Name	Product	Family	Published	Updated	Severity
34819	Mozilla Thunderbird < 2.0.0.18 Multiple Vulnerabilities	Nessus	Windows	11/20/2008	7/16/2018	high
34768	SeaMonkey < 1.1.13 Multiple Vulnerabilities	Nessus	Windows	11/13/2008	9/17/2018	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	12/5/2022	critical
4762	Mozilla Thunderbird < 2.0.0.18 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	11/20/2008	3/6/2019	medium
801316	Mozilla Thunderbird < 2.0.0.18 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients			high

Detections

Analytics

Plugins Search

high

high

critical

medium

high