The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3529-1 advisory.

    It was discovered that a From address encoded with a null character is cut off in the message header     display. An attacker could potentially exploit this to spoof the sender address. (CVE-2017-7829)

    It was discovered that it is possible to execute JavaScript in RSS feeds in some circumstances. If a user     were tricked in to opening a specially crafted RSS feed, an attacker could potentially exploit this in     combination with another vulnerability, in order to cause unspecified problems. (CVE-2017-7846)

    It was discovered that the RSS feed can leak local path names. If a user were tricked in to opening a     specially crafted RSS feed, an attacker could potentially exploit this to obtain sensitive information.
    (CVE-2017-7847)

    It was discovered that RSS feeds are vulnerable to new line injection. If a user were tricked in to     opening a specially crafted RSS feed, an attacker could potentially exploit this to cause unspecified     problems. (CVE-2017-7848)

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, execute arbitrary code, or cause other unspecified effects. (CVE-2018-5089, CVE-2018-5095,     CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104,     CVE-2018-5117)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for Mozilla Thunderbird to version 52.5.2 fixes the following vulnerabilities :

  - CVE-2017-7846: JavaScript Execution via RSS in     mailbox:// origin (bsc#1074043)

  - CVE-2017-7847: Local path string can be leaked from RSS     feed (bsc#1074044)

  - CVE-2017-7848: RSS Feed vulnerable to new line Injection     (bsc#1074045)

  - CVE-2017-7829: From address with encoded null character     is cut off in message header display (bsc#1074046)

An update for thunderbird is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 52.5.2.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7846, CVE-2017-7847, CVE-2017-7848, CVE-2017-7829)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges cure53 and Sabri Haddouche as the original reporters.

This update upgrades Thunderbird to version 52.5.2.

Security Fix(es) :

  - Multiple flaws were found in the processing of malformed     web content. A web page containing malicious content     could cause Thunderbird to crash or, potentially,     execute arbitrary code with the privileges of the user     running Thunderbird. (CVE-2017-7846, CVE-2017-7847,     CVE-2017-7848, CVE-2017-7829)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
106482	Ubuntu 14.04 LTS / 16.04 LTS : Thunderbird vulnerabilities (USN-3529-1)	Nessus	Ubuntu Local Security Checks	2018/1/30	2024/8/27	critical
105457	openSUSE Security Update : Mozilla Thunderbird (openSUSE-2017-1419)	Nessus	SuSE Local Security Checks	2017/12/26	2025/11/10	high
105658	CentOS 6 / 7 : thunderbird (CESA-2018:0061)	Nessus	CentOS Local Security Checks	2018/1/9	2025/11/10	high
105683	Scientific Linux Security Update : thunderbird on SL6.x, SL7.x i386/x86_64 (20180107)	Nessus	Scientific Linux Local Security Checks	2018/1/9	2025/11/10	high

检测

插件搜索

critical

high

high

high