Detections
Analytics
Mozilla Thunderbird < 31.3 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 8589
Synopsis
The remote host has an email client installed that is vulnerable to multiple attack vectors.Description
Versions of Mozilla Thunderbird prior to 31.3 are prone to the following vulnerabilities :- Multiple Unspecified Memory Corruption Vulnerabilities.(CVE-2014-1587)(CVE-2014-1588)
- Multiple Local Information Disclosure Vulnerabilities requiring interactive access to exploit.(CVE-2014-1595)
- Security Vulnerability due to bad casting from BasicThebesLayer to BasicContainerLayer.(CVE-2014-1594)
- Denial of Service Vulnerability can occur when passing a js object to XMLHttpRequest that mimics an input stream.(CVE-2014-1590)
- Use After Free Memory Corruption Vulnerability when creating a second root element during the parsing of an HTML5 document which contains 'document.open()'.(CVE-2014-1592)
- Buffer Overflow Vulnerability when handling specially crafted media content.(CVE-2014-1593)
Solution
Upgrade to Thunderbird 31.3, or later.See Also
https://www.mozilla.org/security/announce/2014/mfsa2014-83.html
https://www.mozilla.org/security/announce/2014/mfsa2014-85.html
https://www.mozilla.org/security/announce/2014/mfsa2014-87.html
https://www.mozilla.org/security/announce/2014/mfsa2014-88.html
https://www.mozilla.org/security/announce/2014/mfsa2014-89.html
https://www.mozilla.org/security/announce/2014/mfsa2014-90.html
https://www.mozilla.org/security/announce/2014/mfsa2014-91.html
Plugin Details
Severity: Medium
ID: 8589
Family: SMTP Clients
Published: 12/4/2014
Updated: 3/6/2019
Nessus ID: 79663, 79666, 79680, 79683
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.6
Temporal Score: 4.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:firefox
Patch Publication Date: 12/3/2014
Vulnerability Publication Date: 12/2/2014
Reference Information
CVE: CVE-2014-1587, CVE-2014-1588, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593, CVE-2014-1594, CVE-2014-1595