Several flaws were discovered in the JavaScript engine of Thunderbird.
If a user had JavaScript enabled and were tricked into viewing malicious web content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0689, CVE-2009-2463, CVE-2009-3075)

Josh Soref discovered that the BinHex decoder used in Thunderbird contained a flaw. If a user were tricked into viewing malicious content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3072)

It was discovered that Thunderbird did not properly manage memory when using XUL tree elements. If a user were tricked into viewing malicious content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3077)

Jesse Ruderman and Sid Stamm discovered that Thunderbird did not properly display filenames containing right-to-left (RTL) override characters. If a user were tricked into opening a malicious file with a crafted filename, an attacker could exploit this to trick the user into opening a different file than the user expected. (CVE-2009-3376)

Takehiro Takahashi discovered flaws in the NTLM implementation in Thunderbird. If an NTLM authenticated user opened content containing links to a malicious website, a remote attacker could send requests to other applications, authenticated as the user. (CVE-2009-3983)

Ludovic Hirlimann discovered a flaw in the way Thunderbird indexed certain messages with attachments. A remote attacker could send specially crafted content and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-0163).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Project reports :

MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch

MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail

MFSA 2009-68 NTLM reflection vulnerability

MFSA 2009-62 Download filename spoofing with RTL override

MFSA 2009-59 Heap buffer overflow in string to number conversion

MFSA 2009-49 TreeColumns dangling pointer vulnerability

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0154 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Several flaws were found in the processing of malformed HTML mail content.
    An HTML mail message containing malicious content could cause Thunderbird     to crash or, potentially, execute arbitrary code with the privileges of the     user running Thunderbird. (CVE-2009-2462, CVE-2009-2463, CVE-2009-2466,     CVE-2009-3072, CVE-2009-3075, CVE-2009-3380, CVE-2009-3979, CVE-2010-0159)

    A use-after-free flaw was found in Thunderbird. An attacker could use this     flaw to crash Thunderbird or, potentially, execute arbitrary code with the     privileges of the user running Thunderbird. (CVE-2009-3077)

    A heap-based buffer overflow flaw was found in the Thunderbird string to     floating point conversion routines. An HTML mail message containing     malicious JavaScript could crash Thunderbird or, potentially, execute     arbitrary code with the privileges of the user running Thunderbird.
    (CVE-2009-0689)

    A use-after-free flaw was found in Thunderbird. Under low memory     conditions, viewing an HTML mail message containing malicious content could     result in Thunderbird executing arbitrary code with the privileges of the     user running Thunderbird. (CVE-2009-1571)

    A flaw was found in the way Thunderbird created temporary file names for     downloaded files. If a local attacker knows the name of a file Thunderbird     is going to download, they can replace the contents of that file with     arbitrary contents. (CVE-2009-3274)

    A flaw was found in the way Thunderbird displayed a right-to-left override     character when downloading a file. In these cases, the name displayed in     the title bar differed from the name displayed in the dialog body. An     attacker could use this flaw to trick a user into downloading a file that     has a file name or extension that is different from what the user expected.
    (CVE-2009-3376)

    A flaw was found in the way Thunderbird processed SOCKS5 proxy replies. A     malicious SOCKS5 server could send a specially-crafted reply that would     cause Thunderbird to crash. (CVE-2009-2470)

    Descriptions in the dialogs when adding and removing PKCS #11 modules were     not informative. An attacker able to trick a user into installing a     malicious PKCS #11 module could use this flaw to install their own     Certificate Authority certificates on a user's machine, making it possible     to trick the user into believing they are viewing trusted content or,     potentially, execute arbitrary code with the privileges of the user running     Thunderbird. (CVE-2009-3076)

    All Thunderbird users should upgrade to this updated package, which     resolves these issues. All running instances of Thunderbird must be     restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Thunderbird was updated to 2.0.0.14 fixing several security issues and bugs.

MFSA 2010-07: Mozilla developers took fixes from previously fixed memory safety bugs in newer Mozilla-based products and ported them to the Mozilla 1.8.1 branch so they can be utilized by Thunderbird 2 and SeaMonkey 1.1.

Paul Fisher reported a crash when joined to an Active Directory server under Vista or Windows 7 and using SSPI authentication.
(CVE-2010-0161) Ludovic Hirlimann reported a crash indexing some messages with attachments (CVE-2010-0163) Carsten Book reported a crash in the JavaScript engine (CVE-2009-3075) Josh Soref reported a crash in the BinHex decoder used on non-Mac platforms. (CVE-2009-3072) monarch2000 reported an integer overflow in a base64 decoding function (CVE-2009-2463)

MFSA 2009-68 / CVE-2009-3983: Security researcher Takehiro Takahashi of the IBM X-Force reported that Mozilla's NTLM implementation was vulnerable to reflection attacks in which NTLM credentials from one application could be forwarded to another arbitary application via the browser. If an attacker could get a user to visit a web page he controlled he could force NTLM authenticated requests to be forwarded to another application on behalf of the user.

MFSA 2009-62 / CVE-2009-3376: Mozilla security researchers Jesse Ruderman and Sid Stamm reported that when downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. An attacker could use this vulnerability to obfuscate the name and file extension of a file to be downloaded and opened, potentially causing a user to run an executable file when they expected to open a non-executable file.

MFSA 2009-59 / CVE-2009-0689: Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code containing a very long string to be converted to a floating point number which would result in improper memory allocation and the execution of an arbitrary memory location. This vulnerability could thus be leveraged by the attacker to run arbitrary code on a victim's computer.

Update: The underlying flaw in the dtoa routines used by Mozilla appears to be essentially the same as that reported against the libc gdtoa routine by Maksymilian Arciemowicz.

MFSA 2009-49 / CVE-2009-3077: An anonymous security researcher, via TippingPoint's Zero Day Initiative, reported that the columns of a XUL tree element could be manipulated in a particular way which would leave a pointer owned by the column pointing to freed memory. An attacker could potentially use this vulnerability to crash a victim's browser and run arbitrary code on the victim's computer.

Please see http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.ht ml

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
45108	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : thunderbird vulnerabilities (USN-915-1)	Nessus	Ubuntu Local Security Checks	2010/3/19	2019/9/19	critical
45114	FreeBSD : mozilla -- multiple vulnerabilities (56cfe192-329f-11df-abb2-000f20797ede)	Nessus	FreeBSD Local Security Checks	2010/3/22	2021/1/6	critical
46271	RHEL 4 : thunderbird (RHSA-2010:0154)	Nessus	Red Hat Local Security Checks	2010/5/11	2024/11/4	medium
45376	openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-2189)	Nessus	SuSE Local Security Checks	2010/3/30	2021/1/14	critical

检测

插件搜索

critical

critical

medium

critical