The installed version of Thunderbird is 17.x or later but prior to 24. It is, therefore, potentially affected the following vulnerabilities:

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - The ANGLE library is vulnerable to an integer overflow,     which could result in a denial of service or arbitrary     code execution. (CVE-2013-1721)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724,     CVE-2013-1735, CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service attack.
    (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments could result in denial of service or     possibly arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker could     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch could result in a     denial of service or arbitrary code execution. Versions     of Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This could     result in access restrictions being bypassed.
    (CVE-2013-1737)

  - An input validation error exists related to email     messages containing HTML and iframes and the action of     replying to or forwarding such messages that could     allow cross-site scripting attacks. (CVE-2013-6674)

  - An input validation error exists related to email     messages containing HTML and object or embed elements     that could allow cross-site scripting attacks.
    (CVE-2014-2018)

The installed version of SeaMonkey is a version prior to 2.20. It is, therefore, potentially affected by the following vulnerabilities :

  - Various errors exist that could allow memory corruption     conditions. (CVE-2013-1701, CVE-2013-1702)

  - Use-after-free errors exist related to DOM modification     when using 'SetBody' and generating a 'Certificate     Request Message'. (CVE-2013-1704, CVE-2013-1705)

  - An error exists in the function 'nsCString::CharAt'     that could allow application crashes when decoding     specially crafted WAV audio files. (CVE-2013-1708)

  - Unspecified errors exist related to HTML frames and     history handling, 'XrayWrappers', JavaScript URI     handling and web workers using 'XMLHttpRequest' that     could allow cross-site scripting attacks.
    (CVE-2013-1709, CVE-2013-1711, CVE-2013-1713,     CVE-2013-1714)

  - An unspecified error exists related to generating     'Certificate Request Message Format' (CRMF) requests     that could allow cross-site scripting attacks.
    (CVE-2013-1710)

  - An error exists related to Java applets and 'file:///'     URIs that could allow read-only access to arbitrary     files. (CVE-2013-1717)

  - An input validation error exists related to email     messages containing HTML and iframes and the action of     replying to or forwarding such messages that could     allow cross-site scripting attacks. (CVE-2013-6674)

  - An input validation error exists related to email     messages containing HTML and object or embed elements     that could allow cross-site scripting attacks.
    (CVE-2014-2018)

The installed version of Thunderbird is a version prior to 24.0.
It is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724,     CVE-2013-1735, CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service attack.
    (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments could result in denial of service or     possibly arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker could     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch could result in a     denial of service or arbitrary code execution.  Versions     of Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This could     result in access restrictions being bypassed.
    (CVE-2013-1737)

  - An input validation error exists related to email     messages containing HTML and iframes and the action of     replying to or forwarding such messages that could     allow cross-site scripting attacks. (CVE-2013-6674)

  - An input validation error exists related to email     messages containing HTML and object or embed elements     that could allow cross-site scripting attacks.
    (CVE-2014-2018)

Versions of Mozilla Thunderbird prior to 17.0.8 are affected by the following vulnerabilities :

 - A flaw exists because the program does not validate URLs in IFRAME elements before returning it to users.
 - A flaw exists because the program does not validate input when handling a specially crafted EMBED or OBJECT element.

These vulnerabilities may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Versions of SeaMonkey earlier than version 2.20 are prone to the following vulnerabilities :

 - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)
 - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)
 - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)
 - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)
 - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)
 - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)
 - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)
 - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)
 - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)
 - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)
 - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)
 - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)
 - Stored cross-site scripting vulnerability due to insufficient input validation of 'data:' URLs in iframe elements. (CVE-2013-6674)

ID	Name	Product	Family	Published	Updated	Severity
69995	Mozilla Thunderbird 17.x through 23.x Multiple Vulnerabilities	Nessus	Windows	9/19/2013	11/27/2019	critical
69272	SeaMonkey < 2.20 Multiple Vulnerabilities	Nessus	Windows	8/8/2013	11/27/2019	critical
69991	Thunderbird 17.x through 23.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	9/19/2013	11/27/2019	critical
8273	Mozilla Thunderbird < 17.0.8 XSS	Nessus Network Monitor	SMTP Clients	5/27/2014	3/6/2019	low
6977	SeaMonkey < 2.20 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/8/2013	3/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

low

high