The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7182 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.4.0.

    Security Fix(es):

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server     administrators (CVE-2022-39249)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-7184 advisory.

    - Fix for expat CVE-2022-40674

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 102.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1900 advisory.

    2024-05-09: CVE-2021-28429 was added to this advisory.

    Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2,     allows local attackers to cause a denial of service (DoS) via crafted .mov file. (CVE-2021-28429)

    When receiving an HTML email that contained an <code>iframe</code> element, which used a     <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested     document, for example images or videos, were not blocked. Rather, the network was accessed, the objects     were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
    (CVE-2022-3032)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a Thunderbird     user replying to a crafted HTML email containing a meta tag, with the meta tag having the http-     equiv='refresh' attribute and the content attribute specifying an URL. Thunderbird started a network     request to that URL, regardless of the configuration, to block remote content. In combination with certain     other HTML elements and attributes in the email, it was possible to execute JavaScript code included in     the message in the context of the message compose document. The JavaScript code was able to perform     actions including, but probably not limited to, reading and modifying the contents of the message compose     document, including the quoted original message, which could potentially contain the decrypted plaintext     of encrypted data in the crafted email. The contents could then be transmitted to the network, either to     the URL specified in the META refresh tag or to a different URL, as the JavaScript code could modify the     URL specified in the document. This bug doesn't affect users who have changed the default Message Body     display setting to 'simple html' or 'plain text.' (CVE-2022-3033)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of sending a     request to the remote document when receiving an HTML email that specified to load an iframe element from     a remote location. However, Thunderbird didn't display the document. (CVE-2022-3034)

    matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0     events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from     functioning properly, potentially impacting the consumer's ability to process data safely. Note that the     matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to     the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users     unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor     to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all     storage will often fix most perceived issues. In some cases, no workarounds are possible. (CVE-2022-36059)

    A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who     use the Matrix chat protocol are vulnerable to a data corruption issue. An attacker could potentially     cause data integrity issues by sending specially crafted messages. (CVE-2022-39236)

    A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who     use the Matrix chat protocol are vulnerable to an impersonation attack. A malicious server administrator     could fake encrypted messages to look as if they were sent from another user on that server.
    (CVE-2022-39249)

    A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who     use the Matrix chat protocol are vulnerable to an impersonation attack. A malicious server administrator     could interfere with cross-device verification to authenticate their own device. (CVE-2022-39250)

    A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who     use the Matrix chat protocol are vulnerable to an impersonation attack. An attacker could spoof historical     messages from other users, and use a malicious key backup to the user's account under specific conditions     in order to exfiltrate message keys. (CVE-2022-39251)

    A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing     is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the     internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will     return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory     other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for     example, if processing a file line by line), problems occur. Using this vulnerability in the doContent     function allows an attacker to triage a denial of service or potentially arbitrary code execution.
    (CVE-2022-40674)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that when     injecting an HTML base element; some requests would ignore the CSP's base-uri settings and accept the     injected element's base instead. (CVE-2022-40956)

    Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially     exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects     Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. (CVE-2022-40957)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that by     injecting a cookie with certain special characters, an attacker on a shared subdomain, which is not a     secure context,could set and overwrite cookies from a secure context, leading to session fixation and     other attacks. (CVE-2022-40958)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that certain     pages did not have their FeaturePolicy fully initialized during iframe navigation, leading to a bypass     that leaked device permissions into untrusted subdocuments. (CVE-2022-40959)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent     use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and     causing a potentially exploitable crash. (CVE-2022-40960)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla     developers Nika Layzell, Timothy Nikkel, Jeff Muizelaar, Sebastian Hengst, Andreas Pehrson, and the     Mozilla Fuzzing Team reporting memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of     these bugs showed evidence of memory corruption and the presumption that with enough effort, some have     been exploited to run arbitrary code. (CVE-2022-40962)

    Mozilla: A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking     the result of a redirect, via performance.getEntries(). (CVE-2022-42927)

    Mozilla: Certain types of allocations were missing annotations that, if the Garbage Collector was in a     specific state, could have lead to memory corruption and a potentially exploitable crash. (CVE-2022-42928)

    A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a website     called window.print() causing a denial of service of the browser, which may persist beyond browser restart     depending on the user's session restore settings. (CVE-2022-42929)

    Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox     105 and Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. This vulnerability     affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (CVE-2022-42932)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3800-1 advisory.

    - Mozilla Thunderbird 102.4.0 (bsc#1204421)
      * changed: Thunderbird will automatically detect and repair OpenPGP key storage corruption caused by     using the profile import tool in Thunderbird 102
      * fixed: POP message download into a large folder (~13000 messages) caused Thunderbird to temporarily     freeze
      * fixed: Forwarding messages with special characters in Subject failed on Windows
      * fixed: Links for FileLink attachments were not added when attachment filename contained Unicode     characters
      * fixed: Address Book display pane continued to show contacts after deletion
      * fixed: Printing address book did not include all contact details
      * fixed: CardDAV contacts without a Name property did not save to Google Contacts
      * fixed: 'Publish Calendar' did not work
      * fixed: Calendar database storage improvements
      * fixed: Incorrectly handled error responses from CalDAV servers sometimes caused events to disappear     from calendar
      * fixed: Various visual and UX improvements
    - Mozilla Thunderbird 102.3.3
      * new: Option added to show containing address book for a         contact when using `All Address Books` in vertical mode         (bmo#1778871)
      * changed: Thunderbird will try to use POP NTLM authentication         even if not advertised by server (bmo#1793349)
      * changed: Task List and Today Pane sidebars will no longer         load when not visible (bmo#1788549)
      * fixed: Sending a message while a recipient pill was being         modified did not save changes (bmo#1779785)
      * fixed: Nickname column was not available in horizontal view         of Address Book (bmo#1778000)
      * fixed: Multiline organization values were displayed across         two columns in horizontal view of Address Book (bmo#1777780)
      * fixed: Contact vCard fields with multiple values such as         Categories were truncated when saved (bmo#1792399)
      * fixed: ICS calendar files with a `FREEBUSY` property could         not be imported (bmo#1783441)
      * fixed: Thunderbird would hang if calendar event exceeded the         year 2035 (bmo#1789999)
    - Mozilla Thunderbird 102.3.2
      * changed: Thunderbird will try to use POP CRAM-MD5         authentication even if not advertised by server (bmo#1789975)
      * fixed: Checking messages on POP3 accounts caused POP folder         to lock if mail server was slow or non-responsive         (bmo#1792451)
      * fixed: Newsgroups named with consecutive dots would not         appear when refreshing list of newsgroups (bmo#1787789)
      * fixed: Sending news articles containing lines starting with         dot were sometimes clipped (bmo#1787955)
      * fixed: CardDAV server sync silently failed if sync token         expired (bmo#1791183)
      * fixed: Contacts from LDAP on macOS address books were not         displayed (bmo#1791347)
      * fixed: Chat account input now accepts URIs for supported chat         protocols (bmo#1776706)
      * fixed: Chat ScreenName field was not migrated to new address         book (bmo#1789990)
      * fixed: Creating a New Event from the Today Pane used the         currently selected day from the main calendar instead of from         the Today Pane (bmo#1791203)
      * fixed: `New Event` button in Today Pane was incorrectly         disabled sometimes (bmo#1792058)
      * fixed: Event reminder windows did not close after being         dismissed or snoozed (bmo#1791228)
      * fixed: Improved performance of recurring event date         calculation (bmo#1787677)
      * fixed: Quarterly calendar events on the last day of the month         repeated one month early (bmo#1789362)
      * fixed: Thunderbird would hang if calendar event exceeded the         year 2035 (bmo#1789999)
      * fixed: Whitespace in calendar events was incorrectly handled         when upgrading from Thunderbird 91 to 102 (bmo#1790339)
      * fixed: Various visual and UX improvements (bmo#1755623,bmo#17         83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178         9728,bmo#1790499)
    - Mozilla Thunderbird 102.3.1
      * changed: Compose window encryption options now only appear         for encryption technologies that have already been configured         (bmo#1788988)
      * changed: Number of contacts in currently selected address         book now displayed at bottom of Address Book list column         (bmo#1745571)
      * fixed: Password prompt did not include server hostname for         POP servers (bmo#1786920)
      * fixed: `Edit Contact` was missing from Contacts sidebar         context menus (bmo#1771795)
      * fixed: Address Book contact lists cut off display of some         characters, the result being unreadable (bmo#1780909)
      * fixed: Menu items for dark-themed alarm dialog were invisible         on Windows 7 (bmo#1791738)
      * fixed: Various security fixes       MFSA 2022-43 (bsc#1204411)
      * CVE-2022-39249 (bmo#1791765)         Matrix SDK bundled with Thunderbird vulnerable to an         impersonation attack by malicious server administrators
      * CVE-2022-39250 (bmo#1791765)         Matrix SDK bundled with Thunderbird vulnerable to a device         verification attack
      * CVE-2022-39251 (bmo#1791765)         Matrix SDK bundled with Thunderbird vulnerable to an         impersonation attack
      * CVE-2022-39236 (bmo#1791765)         Matrix SDK bundled with Thunderbird vulnerable to a data         corruption issue
    - Mozilla Thunderbird 102.3
      * changed: Thunderbird will no longer attempt to import account         passwords when importing from another Thunderbird profile in         order to prevent profile corruption and permanent data loss.
        (bmo#1790605)
      * changed: Devtools performance profile will use Thunderbird         presets instead of Web Developer presets (bmo#1785954)
      * fixed: Thunderbird startup performance improvements         (bmo#1785967)
      * fixed: Saving email source and images failed         (bmo#1777323,bmo#1778804)
      * fixed: Error message was shown repeatedly when temporary disk         space was full (bmo#1788580)
      * fixed: Attaching OpenPGP keys without a set size to non-         encrypted messages briefly displayed a size of zero bytes         (bmo#1788952)
      * fixed: Global Search entry box initially contained         'undefined' (bmo#1780963)
      * fixed: Delete from POP Server mail filter rule intermittently         failed to trigger (bmo#1789418)
      * fixed: Connections to POP3 servers without UIDL support         failed (bmo#1789314)
      * fixed: Pop accounts with 'Fetch headers only' set downloaded         complete messages if server did not advertise TOP capability         (bmo#1789356)
      * fixed: 'File -> New -> Address Book Contact' from Compose         window did not work (bmo#1782418)
      * fixed: Attach 'My vCard' option in compose window was not         available (bmo#1787614)
      * fixed: Improved performance of matching a contact to an email         address (bmo#1782725)
      * fixed: Address book only recognized a contact's first two         email addresses (bmo#1777156)
      * fixed: Address book search and autocomplete failed if a         contact vCard could not be parsed (bmo#1789793)
      * fixed: Downloading NNTP messages for offline use failed         (bmo#1785773)
      * fixed: NNTP client became stuck when connecting to Public-         Inbox servers (bmo#1786203)
      * fixed: Various visual and UX improvements         (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
      * fixed: Various security fixes
      * unresolved: No dedicated 'Department' field in address book         (bmo#1777780)       MFSA 2022-42 (bsc#1203477)
      * CVE-2022-3266 (bmo#1767360)         Out of bounds read when decoding H264
      * CVE-2022-40959 (bmo#1782211)         Bypassing FeaturePolicy restrictions on transient pages
      * CVE-2022-40960 (bmo#1787633)         Data-race when parsing non-UTF-8 URLs in threads
      * CVE-2022-40958 (bmo#1779993)         Bypassing Secure Context restriction for cookies with __Host         and __Secure prefix
      * CVE-2022-40956 (bmo#1770094)         Content-Security-Policy base-uri bypass
      * CVE-2022-40957 (bmo#1777604)         Incoherent instruction cache when building WASM on ARM64
      * CVE-2022-3155 (bmo#1789061)         Attachment files saved to disk on macOS could be executed         without warning
      * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,         bmo#1785109, bmo#1786502, bmo#1789440)         Memory safety bugs fixed in Thunderbird 102.3

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5724-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, bypass Content Security Policy (CSP) or other security restrictions, or execute arbitrary code.
    These issues only affect Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-3266,     CVE-2022-40956, CVE-2022-40957, CVE-2022-40958, CVE-2022-40959, CVE-2022-40960, CVE-2022-40962)

    Multiple security issues were discovered in the Matrix SDK bundled with Thunderbird. An attacker could     potentially exploit these in order to impersonate another user. These issues only affect Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-39236, CVE-2022-39249, CVE-2022-39250, CVE-2022-39251)

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, obtain sensitive information, or execute arbitrary code. (CVE-2022-42927, CVE-2022-42928,     CVE-2022-42929, CVE-2022-42932)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
166490	RHEL 8 : thunderbird (RHSA-2022:7182)	Nessus	Red Hat Local Security Checks	2022/10/25	2024/11/7	high
166575	Oracle Linux 7 : thunderbird (ELSA-2022-7184)	Nessus	Oracle Linux Local Security Checks	2022/10/26	2024/10/22	high
168453	Amazon Linux 2 : thunderbird (ALAS-2022-1900)	Nessus	Amazon Linux Local Security Checks	2022/12/7	2024/12/11	high
166692	SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2022:3800-1)	Nessus	SuSE Local Security Checks	2022/10/28	2026/6/26	high
167286	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Thunderbird vulnerabilities (USN-5724-1)	Nessus	Ubuntu Local Security Checks	2022/11/11	2024/8/27	high

检测

插件搜索

high

high

high

high

high