This script is Copyright (C) 2005-2014 Tenable Network Security, Inc.
The remote Red Hat host is missing a security update.
Updated thunderbird package that fixes various bugs is now available
for Red Hat Enterprise Linux 4.
This update has been rated as having important security impact by the
Red Hat Security Response Team.
Mozilla Thunderbird is a standalone mail and newsgroup client.
A bug was found in the way Thunderbird handled anonymous functions
during regular expression string replacement. It is possible for a
malicious HTML mail to capture a random block of client memory. The
Common Vulnerabilities and Exposures project has assigned this bug the
A bug was found in the way Thunderbird validated several XPInstall
interpreter jumping to arbitrary locations in memory. (CVE-2005-1159)
A bug was found in the way the Thunderbird privileged UI code handled
DOM nodes from the content window. An HTML message could install
commonplace actions such as clicking a link or opening the context
level, preventing dangerous actions. It is possible that a malicious
allowing access to protected data and functions. (CVE-2005-1532)
controls. It is possible for a malicious HTML mail to leverage this
functions. It is possible for a malicious HTML mail to crash the
A bug was found in the way Thunderbird handled child frames. It is
possible for a malicious framed HTML mail to steal sensitive
information from its parent frame. (CVE-2005-2266)
A bug was found in the way Thunderbird handled DOM node names. It is
possible for a malicious HTML mail to overwrite a DOM node name,
allowing certain privileged chrome actions to execute the malicious
A bug was found in the way Thunderbird cloned base objects. It is
possible for HTML content to navigate up the prototype chain to gain
access to privileged chrome objects. (CVE-2005-2270)
Users of Thunderbird are advised to upgrade to this updated package
that contains Thunderbird version 1.0.6 and is not vulnerable to these
See also :
Update the affected thunderbird package.
Risk factor :
High / CVSS Base Score : 7.5
Public Exploit Available : true