and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11744) - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11746) - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11752) - A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. (CVE-2019-11705) - A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affects Thunderbird < 60.7.1. (CVE-2019-11706) - When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use- after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11757) - Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11758) - If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11762) - Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11763) - Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11764) - An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11759) - A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11760) - By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11761) - Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after- free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17010) - Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17011) - Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17012) - When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17008) - The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17005) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.</article></body></html>

The remote NewStart CGSL host, running version MAIN 4.05, has thunderbird packages installed that are affected by multiple vulnerabilities: - Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2. (CVE-2019-11708) - A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. (CVE-2019-11707) - Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. (CVE-2019-11709) - When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. (CVE-2019-11711) - POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. (CVE-2019-11712) - A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. (CVE-2019-11713) - Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. (CVE-2019-11715) - A vulnerability exists where the caret (^) character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. (CVE-2019-11717) - A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. (CVE-2019-11730) - As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. (CVE-2019-9811) - A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. (CVE-2019-11704) - A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. (CVE-2019-11703) - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9. (CVE-2019-11739) - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. (CVE-2019-15903) - Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11740) - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a

ID	Name	Product	Family	Severity
144463	Amazon Linux AMI : expat (ALAS-2020-1460) (deprecated)	Nessus	Amazon Linux Local Security Checks	high
143071	RHEL 8 : expat (RHSA-2020:4484)	Nessus	Red Hat Local Security Checks	high
142796	Oracle Linux 8 : expat (ELSA-2020-4484)	Nessus	Oracle Linux Local Security Checks	high
141963	Amazon Linux 2 : expat (ALAS-2020-1513)	Nessus	Amazon Linux Local Security Checks	high
141698	Scientific Linux Security Update : expat on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	high
141594	CentOS 7 : expat (CESA-2020:3952)	Nessus	CentOS Local Security Checks	high
141223	Oracle Linux 7 : expat (ELSA-2020-3952)	Nessus	Oracle Linux Local Security Checks	high
141017	RHEL 7 : expat (RHSA-2020:3952)	Nessus	Red Hat Local Security Checks	high
138081	Apple iCloud 7.x < 7.16 Multiple Vulnerabilities	Nessus	Windows	high
138078	Apple iCloud 10.x < 10.9 Multiple Vulnerabilities	Nessus	Windows	high
137716	Photon OS 2.0: Expat PHSA-2020-2.0-0254	Nessus	PhotonOS Local Security Checks	medium
137705	RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 (RHSA-2020:2644)	Nessus	Red Hat Local Security Checks	medium
137638	Photon OS 1.0: Expat PHSA-2020-1.0-0301	Nessus	PhotonOS Local Security Checks	medium
135896	Ubuntu 16.04 LTS : Thunderbird vulnerabilities (USN-4335-1)	Nessus	Ubuntu Local Security Checks	high
135607	EulerOS Virtualization 3.0.2.2 : expat (EulerOS-SA-2020-1445)	Nessus	Huawei Local Security Checks	high
134506	EulerOS Virtualization for ARM 64 3.0.2.0 : expat (EulerOS-SA-2020-1217)	Nessus	Huawei Local Security Checks	high
134410	NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0022)	Nessus	NewStart CGSL Local Security Checks	critical
133448	SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1)	Nessus	SuSE Local Security Checks	high
133172	openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	critical
133071	NewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0003)	Nessus	NewStart CGSL Local Security Checks	medium
133036	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	critical
132829	EulerOS Virtualization for ARM 64 3.0.5.0 : expat (EulerOS-SA-2020-1075)	Nessus	Huawei Local Security Checks	medium
132416	Apple iTunes < 12.10.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	medium
132415	Apple iTunes < 12.10.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	medium
132264	Amazon Linux 2 : thunderbird (ALAS-2019-1376)	Nessus	Amazon Linux Local Security Checks	medium
132045	Apple TV < 13.3 Multiple Vulnerabilities	Nessus	Misc.	high
132024	Apple iOS < 13.3 Multiple Vulnerabilities	Nessus	Mobile Devices	high
132011	Ubuntu 18.04 LTS / 19.10 : Thunderbird regression (USN-4202-2)	Nessus	Ubuntu Local Security Checks	medium
131957	macOS 10.15.x < 10.15.2 / 10.14.x < 10.14.6 Security Update 2019-002 / 10.13.x < 10.13.6 Security Update 2019-007	Nessus	MacOS X Local Security Checks	high
131587	EulerOS 2.0 SP2 : expat (EulerOS-SA-2019-2433)	Nessus	Huawei Local Security Checks	high
131405	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0215)	Nessus	NewStart CGSL Local Security Checks	medium
131268	GLSA-201911-08 : Expat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
131139	Debian DSA-4571-1 : thunderbird - security update	Nessus	Debian Local Security Checks	medium
131136	Debian DLA-1997-1 : thunderbird security update	Nessus	Debian Local Security Checks	medium
130977	CentOS 6 : thunderbird (CESA-2019:3756)	Nessus	CentOS Local Security Checks	medium
130937	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2464)	Nessus	SuSE Local Security Checks	medium
130936	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2452)	Nessus	SuSE Local Security Checks	medium
130890	openSUSE Security Update : MozillaFirefox / MozillaFirefox-branding-SLE (openSUSE-2019-2459)	Nessus	SuSE Local Security Checks	medium
130885	openSUSE Security Update : MozillaFirefox / MozillaFirefox-branding-SLE (openSUSE-2019-2451)	Nessus	SuSE Local Security Checks	medium
130854	EulerOS 2.0 SP5 : expat (EulerOS-SA-2019-2145)	Nessus	Huawei Local Security Checks	high
130812	EulerOS 2.0 SP8 : expat (EulerOS-SA-2019-2103)	Nessus	Huawei Local Security Checks	medium
130772	Debian DLA-1987-1 : firefox-esr security update	Nessus	Debian Local Security Checks	medium
130750	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20191106)	Nessus	Scientific Linux Local Security Checks	medium
130742	RHEL 6 : thunderbird (RHSA-2019:3756)	Nessus	Red Hat Local Security Checks	medium
130718	EulerOS 2.0 SP3 : expat (EulerOS-SA-2019-2256)	Nessus	Huawei Local Security Checks	high
130500	openSUSE Security Update : chromium / re2 (openSUSE-2019-2420)	Nessus	SuSE Local Security Checks	medium
130450	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2872-1)	Nessus	SuSE Local Security Checks	critical
130449	SUSE SLED15 / SLES15 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2019:2871-1)	Nessus	SuSE Local Security Checks	medium
130436	CentOS 7 : thunderbird (CESA-2019:3210)	Nessus	CentOS Local Security Checks	medium
130434	CentOS 7 : firefox (CESA-2019:3193)	Nessus	CentOS Local Security Checks	medium
130415	Oracle Linux 8 : thunderbird (ELSA-2019-3237)	Nessus	Oracle Linux Local Security Checks	medium
130414	Oracle Linux 7 : thunderbird (ELSA-2019-3210)	Nessus	Oracle Linux Local Security Checks	medium
130386	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20191029)	Nessus	Scientific Linux Local Security Checks	medium
130382	RHEL 8 : thunderbird (RHSA-2019:3237)	Nessus	Red Hat Local Security Checks	medium
130371	RHEL 7 : thunderbird (RHSA-2019:3210)	Nessus	Red Hat Local Security Checks	medium
130365	Mozilla Thunderbird < 68.2	Nessus	Windows	medium
130364	Mozilla Thunderbird < 68.2	Nessus	MacOS X Local Security Checks	medium
130288	Debian DSA-4549-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	medium
130275	Google Chrome < 78.0.3904.70 Multiple Vulnerabilities	Nessus	Windows	medium
130274	Google Chrome < 78.0.3904.70 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium
130248	RHEL 8 : firefox (RHSA-2019:3196)	Nessus	Red Hat Local Security Checks	high
130247	Oracle Linux 8 : firefox (ELSA-2019-3196)	Nessus	Oracle Linux Local Security Checks	high
130200	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : Firefox vulnerabilities (USN-4165-1)	Nessus	Ubuntu Local Security Checks	medium
130190	RHEL 7 : firefox (RHSA-2019:3193)	Nessus	Red Hat Local Security Checks	high
130184	Oracle Linux 7 : firefox (ELSA-2019-3193)	Nessus	Oracle Linux Local Security Checks	high
130172	Mozilla Firefox ESR 68.x < 68.2 Multiple vulnerabilities	Nessus	Windows	medium
130171	Mozilla Firefox ESR 68.x < 68.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium
130170	Mozilla Firefox < 70.0 Multiple Vulnerabilities	Nessus	Windows	medium
130169	Mozilla Firefox < 70.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium
130158	Slackware 14.2 / current : mozilla-firefox (SSA:2019-295-01)	Nessus	Slackware Local Security Checks	medium
130079	Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2019-293-01)	Nessus	Slackware Local Security Checks	medium
130077	FreeBSD : python 3.7 -- multiple vulnerabilities (9b7491fb-f253-11e9-a50c-000c29c4dc65)	Nessus	FreeBSD Local Security Checks	medium
129620	Fedora 31 : expat (2019-613edfe68b)	Nessus	Fedora Local Security Checks	medium
129511	Fedora 29 : expat (2019-672ae0f060)	Nessus	Fedora Local Security Checks	medium
129457	openSUSE Security Update : expat (openSUSE-2019-2205)	Nessus	SuSE Local Security Checks	medium
129456	openSUSE Security Update : expat (openSUSE-2019-2204)	Nessus	SuSE Local Security Checks	medium
129322	Fedora 30 : expat (2019-9505c6b555)	Nessus	Fedora Local Security Checks	medium
129288	SUSE SLED12 / SLES12 Security Update : expat (SUSE-SU-2019:2440-1)	Nessus	SuSE Local Security Checks	medium
129283	SUSE SLED15 / SLES15 Security Update : expat (SUSE-SU-2019:2429-1)	Nessus	SuSE Local Security Checks	medium
129108	Debian DSA-4530-1 : expat - security update	Nessus	Debian Local Security Checks	medium
128963	Slackware 14.0 / 14.1 / 14.2 / current : expat (SSA:2019-259-01)	Nessus	Slackware Local Security Checks	medium
128874	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : Expat vulnerability (USN-4132-1)	Nessus	Ubuntu Local Security Checks	medium

CVE-2019-15903

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0