During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. This vulnerability affects Firefox <     85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects     Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23954)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox     ESR < 78.7. (CVE-2021-23960)

  - Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and     Firefox ESR < 78.7. (CVE-2021-23964)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If that's not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,     and the content of that error may have revealed information about the resource. This vulnerability affects     Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. (CVE-2021-23973)

  - Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and     Firefox ESR < 78.8. (CVE-2021-23978)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR <     78.6. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6,     and Firefox ESR < 78.6. (CVE-2020-26973)

  - When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly     cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially     exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
    (CVE-2020-26974)

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - Using techniques that built on the slipstream research, a malicious webpage could have exposed both an     internal network's hosts as well as services running on the user's local machine. This vulnerability     affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. (CVE-2020-26978)

  - When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback     was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening     View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84,     Thunderbird < 78.6, and Firefox ESR < 78.6. (CVE-2020-35111)

  - Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and     Firefox ESR < 78.6. (CVE-2020-35113)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. This vulnerability affects Firefox <     85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects     Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23954)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox     ESR < 78.7. (CVE-2021-23960)

  - Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and     Firefox ESR < 78.7. (CVE-2021-23964)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If that's not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,     and the content of that error may have revealed information about the resource. This vulnerability affects     Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. (CVE-2021-23973)

  - Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and     Firefox ESR < 78.8. (CVE-2021-23978)

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
    (CVE-2021-23982)

  - A malicious extension could have opened a popup window lacking an address bar. The title of the popup     lacking an address bar should not be fully controllable, but in this situation was. This could have been     used to spoof a website and attempt to trick the user into providing credentials. This vulnerability     affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23984)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR     78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9,     Firefox < 87, and Thunderbird < 78.9. (CVE-2021-23987)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. This vulnerability affects Firefox <     85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects     Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23954)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox     ESR < 78.7. (CVE-2021-23960)

  - Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and     Firefox ESR < 78.7. (CVE-2021-23964)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If that's not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,     and the content of that error may have revealed information about the resource. This vulnerability affects     Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. (CVE-2021-23973)

  - Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and     Firefox ESR < 78.8. (CVE-2021-23978)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 78.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1603 advisory.

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-0298 advisory.

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - Mozilla developers Alexis Beingessner, Christian Holler, Andrew McCreight, Tyson Smith, Jon Coppeard,     Andr Bargull, Jason Kratzer, Jesse Schwartzentruber, Steve Fink, Byron Campen reported memory safety bugs     present in Thunderbird 78.6. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code.  (CVE-2021-23964)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data.  (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4736-1 advisory.

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or an information leak.

For Debian 9 stretch, these problems have been fixed in version 1:78.7.0-1~deb9u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0397 advisory.

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:0298 advisory.

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for MozillaThunderbird fixes the following issues :

  - Mozilla Thunderbird was updated to 78.7.0 ESR (MFSA     2021-05, bsc#1181414)

  - CVE-2021-23953: Fixed a Cross-origin information leakage     via redirected PDF requests

  - CVE-2021-23954: Fixed a type confusion when using     logical assignment operators in JavaScript switch     statements

  - CVE-2020-26976: Fixed an issue where HTTPS pages could     have been intercepted by a registered service worker     when they should not have been

  - CVE-2021-23960: Fixed a use-after-poison for incorrectly     redeclared JavaScript variables during GC

  - CVE-2021-23964: Fixed Memory safety bugs

  - CVE-2020-15685: Fixed an IMAP Response Injection when     using STARTTLS This update was imported from the     SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-202102-02 (Mozilla Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
      Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or an information leak.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:0297-1 advisory.

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0297 advisory.

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0298 advisory.

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0299 advisory.

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-0297 advisory.

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - Mozilla developers Alexis Beingessner, Christian Holler, Andrew McCreight, Tyson Smith, Jon Coppeard,     Andr Bargull, Jason Kratzer, Jesse Schwartzentruber, Steve Fink, Byron Campen reported memory safety bugs     present in Thunderbird 78.6. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code.  (CVE-2021-23964)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data.  (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected     and evaluated within the encrypted session.  (CVE-2020-15685)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 78.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-05 advisory.

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. (CVE-2021-23954)

  - During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected     and evaluated within the encrypted session. (CVE-2020-15685)

  - When a HTTPS page was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. (CVE-2020-26976)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. (CVE-2021-23960)

  - Mozilla developers Alexis Beingessner, Christian Holler, Andrew McCreight, Tyson Smith, Jon Coppeard,     Andr Bargull, Jason Kratzer, Jesse Schwartzentruber, Steve Fink, Byron Campen reported memory safety bugs     present in Thunderbird 78.6. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 78.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-05 advisory.

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. (CVE-2021-23954)

  - During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected     and evaluated within the encrypted session. (CVE-2020-15685)

  - When a HTTPS page was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. (CVE-2020-26976)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. (CVE-2021-23960)

  - Mozilla developers Alexis Beingessner, Christian Holler, Andrew McCreight, Tyson Smith, Jon Coppeard,     Andr Bargull, Jason Kratzer, Jesse Schwartzentruber, Steve Fink, Byron Campen reported memory safety bugs     present in Thunderbird 78.6. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
154553	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0094)	Nessus	NewStart CGSL Local Security Checks	high
154475	NewStart CGSL MAIN 6.02 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0119)	Nessus	NewStart CGSL Local Security Checks	high
154471	NewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0177)	Nessus	NewStart CGSL Local Security Checks	high
146634	Amazon Linux 2 : thunderbird (ALAS-2021-1603)	Nessus	Amazon Linux Local Security Checks	high
146565	Oracle Linux 8 : thunderbird (ELSA-2021-0298)	Nessus	Oracle Linux Local Security Checks	high
146538	Ubuntu 20.10 : Thunderbird vulnerabilities (USN-4736-1)	Nessus	Ubuntu Local Security Checks	high
146155	Debian DLA-2541-1 : thunderbird security update	Nessus	Debian Local Security Checks	high
146095	RHEL 8 : thunderbird (RHSA-2021:0397)	Nessus	Red Hat Local Security Checks	high
145791	CentOS 8 : thunderbird (CESA-2021:0298)	Nessus	CentOS Local Security Checks	high
145768	openSUSE Security Update : MozillaThunderbird (openSUSE-2021-208)	Nessus	SuSE Local Security Checks	high
145758	GLSA-202102-02 : Mozilla Thunderbird: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
145746	openSUSE Security Update : MozillaThunderbird (openSUSE-2021-209)	Nessus	SuSE Local Security Checks	high
145728	Debian DSA-4842-1 : thunderbird - security update	Nessus	Debian Local Security Checks	high
145697	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2021:0297)	Nessus	Scientific Linux Local Security Checks	high
145545	RHEL 7 : thunderbird (RHSA-2021:0297)	Nessus	Red Hat Local Security Checks	high
145543	RHEL 8 : thunderbird (RHSA-2021:0298)	Nessus	Red Hat Local Security Checks	high
145541	RHEL 8 : thunderbird (RHSA-2021:0299)	Nessus	Red Hat Local Security Checks	high
145540	Oracle Linux 7 : thunderbird (ELSA-2021-0297)	Nessus	Oracle Linux Local Security Checks	high
145468	Mozilla Thunderbird < 78.7	Nessus	Windows	high
145467	Mozilla Thunderbird < 78.7	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2020-15685

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high