據發現，CVE-2011-3004 可以解決附加元件中可能的權限提升，也影響了 Thunderbird 3.1。攻擊者可能惡意利用已安裝附加元件的使用者，該附加元件會以容易遭受攻擊的方式使用 loadSubscript。(CVE-2011-3647)

Yosuke Hasegawa 發現 Mozilla 瀏覽器引擎錯誤處理 Shift-JIS 編碼中的無效序列。若在不使用偵錯 API 的情況下觸發此損毀情況，可能會讓惡意網站惡意利用此弱點。攻擊者可能利用此瑕疵來竊取資料，或將惡意指令碼插入到 web 內容。(CVE-2011-3648)

Marc Schoenefeld 發現使用 Firebug 分析帶多個函式的 JavaScript 檔案，可導致 Firefox 損毀。攻擊者可在不使用除錯 API 的情況下，惡意利用此問題，可能允許攻擊者遠端損毀 Thunderbird。
(CVE-2011-3650)。

遠端主機受到 GLSA-201301-01 中所述的弱點影響 (Mozilla 產品：多個弱點)

在 Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat 與 XULRunner 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者或許能夠執行攔截式攻擊、取得敏感資訊、繞過限制及保護機制、強制檔案下載、發動 XML 插入攻擊、發動 XSS 攻擊、繞過同源原則、偽造 URL 以發動網路釣魚攻擊、觸發垂直捲動、偽造位置列、偽造 SSL 指示器、修改瀏覽器的字型、發動點擊劫持攻擊，或造成其他不明的影響。
 本機攻擊者可取得提升的權限、取得敏感資訊，或取代任意下載檔案。
 因應措施：

目前尚無已知的因應措施。

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox prior to 8.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

Versions of Mozilla Thunderbird prior to 8.0 are affected by the following security issues :

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

Versions of Firefox earlier than 3.6.24 are potentially affected by multiple vulnerabilities :

 - A flaw exists within the 'JSSubScriptLoader' that incorrectly unwraps 'XPCNativeWrappers'.  By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code. (CVE-2011-3647)
 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting (XSS) attacks. (CVE-2011-3648)
 - Profiling JavaScript files with many functions can cause the application to crash.  It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 7.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
57393	Ubuntu 10.04 LTS / 10.10 / 11.04：thunderbird 弱點 (USN-1254-1)	Nessus	Ubuntu Local Security Checks	2011/12/23	2019/9/19	high
63402	GLSA-201301-01：Mozilla 產品：多個弱點 (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2022/12/5	critical
6788	Mozilla Firefox < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/5/6	2019/3/6	high
6789	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2013/5/6	2019/3/6	high
9377	Mozilla Firefox < 3.6.24 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/6/24	2019/3/6	high
801281	Mozilla Thunderbird 7.0 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	2013/5/6		high
801321	Mozilla Firefox 7.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/5/6		high

检测

插件搜索

high

critical

high

high

high

high

high