The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.

The version of firefox installed on the remote host is prior to 91.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-011 advisory.

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.
    (CVE-2022-29913)

  - A malicious website could have learned the size of a cross-origin resource that supported Range requests.
    This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (CVE-2022-31736)

  - A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox     ESR < 91.10. (CVE-2022-31737)

  - When exiting fullscreen mode, an iframe could have confused the browser about the current state of     fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects     Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (CVE-2022-31738)

  - On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation     problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox <     101, and Firefox ESR < 91.10. (CVE-2022-31740)

  - A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and     potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and     Firefox ESR < 91.10. (CVE-2022-31741)

  - An attacker could have exploited a timing attack by sending a large number of allowCredential entries and     detecting the difference between invalid key handles and cross-origin key handles. This could have led to     cross-origin account linking in violation of WebAuthn goals. This vulnerability affects Thunderbird <     91.10, Firefox < 101, and Firefox ESR < 91.10. (CVE-2022-31742)

  - Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory     safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run arbitrary     code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
    (CVE-2022-31747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:4589 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4589 advisory.

  - Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

  - Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

  - Mozilla: iframe Sandbox bypass (CVE-2022-29911)

  - Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

  - Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

  - Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

  - Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

  - Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-14 (Mozilla Thunderbird: Multiple Vulnerabilities)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-29967, CVE-2021-29969,     CVE-2021-29970, CVE-2021-29976, CVE-2021-29980, CVE-2021-29984, CVE-2021-29985, CVE-2021-29986,     CVE-2021-29988, CVE-2021-29989, CVE-2021-30547, CVE-2021-38492, CVE-2021-38493, CVE-2021-38495,     CVE-2021-38503, CVE-2021-38504, CVE-2021-38506, CVE-2021-38507, CVE-2021-38508, CVE-2021-38509,     CVE-2021-40529, CVE-2021-4129, CVE-2021-4140, CVE-2021-43528, CVE-2021-43529, CVE-2021-43536,     CVE-2021-43537, CVE-2021-43538, CVE-2021-43539, CVE-2021-43541, CVE-2021-43542, CVE-2021-43543,     CVE-2021-43545, CVE-2021-43546, CVE-2022-0566, CVE-2022-1196, CVE-2022-1197, CVE-2022-1520, CVE-2022-1529,     CVE-2022-1802, CVE-2022-1834, CVE-2022-2200, CVE-2022-2226, CVE-2022-22737, CVE-2022-22738,     CVE-2022-22739, CVE-2022-22740, CVE-2022-22741, CVE-2022-22742, CVE-2022-22743, CVE-2022-22745,     CVE-2022-22747, CVE-2022-22748, CVE-2022-22751, CVE-2022-22754, CVE-2022-22756, CVE-2022-22759,     CVE-2022-22760, CVE-2022-22761, CVE-2022-22763, CVE-2022-22764, CVE-2022-24713, CVE-2022-26381,     CVE-2022-26383, CVE-2022-26384, CVE-2022-26386, CVE-2022-26387, CVE-2022-26485, CVE-2022-26486,     CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289, CVE-2022-29909,     CVE-2022-29911, CVE-2022-29912, CVE-2022-29913, CVE-2022-29914, CVE-2022-29916, CVE-2022-29917,     CVE-2022-31736, CVE-2022-31737, CVE-2022-31738, CVE-2022-31740, CVE-2022-31741, CVE-2022-31742,     CVE-2022-31747, CVE-2022-34468, CVE-2022-34470, CVE-2022-34472, CVE-2022-34478, CVE-2022-34479,     CVE-2022-34481, CVE-2022-34484, CVE-2022-36318, CVE-2022-36319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4589 advisory.

  - An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-     activation</code> could lead to script execution without <code>allow-scripts</code> being present.
    (CVE-2022-29911)

  - Documents in deeply-nested cross-origin browsing contexts could obtain permissions granted to the top-     level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which     could enable browser spoofing attacks.  (CVE-2022-29914)

  - Thunderbird would behave slightly differently for already known resources, when loading CSS resources     through resolving CSS variables. This could be used to probe the browser history.  (CVE-2022-29916)

  - Mozilla developers Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs     present in Thunderbird 91.8. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code.  (CVE-2022-29917)

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B.  (CVE-2022-1520)

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process.  (CVE-2022-29913)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3020 advisory.

  - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported     memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
    (CVE-2022-29917)

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. This vulnerability affects Thunderbird < 91.9. (CVE-2022-1520)

  - Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the     top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29909)

  - An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-     activation</code> could lead to script execution without <code>allow-scripts</code> being present. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29912)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 21.10 / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5435-1 advisory.

  - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported     memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
    (CVE-2022-29917)

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. This vulnerability affects Thunderbird < 91.9. (CVE-2022-1520)

  - An attacker could have sent a message to the parent process where the contents were used to double-index     into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript     executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox <     100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. (CVE-2022-1529)

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,     they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This     vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and     Thunderbird < 91.9.1. (CVE-2022-1802)

  - Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the     top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29909)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5141 advisory.

  - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported     memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
    (CVE-2022-29917)

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. This vulnerability affects Thunderbird < 91.9. (CVE-2022-1520)

  - Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the     top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29909)

  - An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-     activation</code> could lead to script execution without <code>allow-scripts</code> being present. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29912)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1719-1 advisory.

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. This vulnerability affects Thunderbird < 91.9. (CVE-2022-1520)

  - Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the     top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29909)

  - An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-     activation</code> could lead to script execution without <code>allow-scripts</code> being present. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29912)

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.
    (CVE-2022-29913)

  - When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI,     which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird < 91.9, Firefox     ESR < 91.9, and Firefox < 100. (CVE-2022-29914)

  - Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS     variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird     < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29916)

  - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported     memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
    (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:1730 advisory.

  - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported     memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
    (CVE-2022-29917)

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. This vulnerability affects Thunderbird < 91.9. (CVE-2022-1520)

  - Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the     top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29909)

  - An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-     activation</code> could lead to script execution without <code>allow-scripts</code> being present. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This     vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. (CVE-2022-29912)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:1725 advisory.

  - Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

  - Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

  - Mozilla: iframe Sandbox bypass (CVE-2022-29911)

  - Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

  - Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

  - Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

  - Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

  - Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1730 advisory.

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.
    (CVE-2022-29913)

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. This vulnerability affects Thunderbird < 91.9. (CVE-2022-1520)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:1725-1 advisory.

  - Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

  - Mozilla: iframe Sandbox bypass (CVE-2022-29911)

  - Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

  - Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

  - Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

  - Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

  - Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

  - Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1730 advisory.

  - Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

  - Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

  - Mozilla: iframe Sandbox bypass (CVE-2022-29911)

  - Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

  - Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

  - Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

  - Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

  - Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1727 advisory.

  - Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

  - Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

  - Mozilla: iframe Sandbox bypass (CVE-2022-29911)

  - Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

  - Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

  - Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

  - Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

  - Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1724 advisory.

  - Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

  - Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

  - Mozilla: iframe Sandbox bypass (CVE-2022-29911)

  - Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

  - Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

  - Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

  - Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

  - Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-1730 advisory.

  - Thunderbird did not properly protect against top-level navigations for iframe sandbox with a policy     relaxed through a keyword like <code>allow-top-navigation-by-user-activation</code>.  (CVE-2022-29911)

  - Documents in deeply-nested cross-origin browsing contexts could obtain permissions granted to the top-     level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which     could enable browser spoofing attacks.  (CVE-2022-29914)

  - Thunderbird would behave slightly differently for already known resources, when loading CSS resources     through resolving CSS variables. This could be used to probe the browser history.  (CVE-2022-29916)

  - Mozilla developers Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs     present in Thunderbird 91.8. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code.  (CVE-2022-29917)

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B.  (CVE-2022-1520)

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process.  (CVE-2022-29913)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-1725 advisory.

  - Thunderbird did not properly protect against top-level navigations for iframe sandbox with a policy     relaxed through a keyword like <code>allow-top-navigation-by-user-activation</code>.  (CVE-2022-29911)

  - Documents in deeply-nested cross-origin browsing contexts could obtain permissions granted to the top-     level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which     could enable browser spoofing attacks.  (CVE-2022-29914)

  - Mozilla developers Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs     present in Thunderbird 91.8. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code.  (CVE-2022-29917)

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process.  (CVE-2022-29913)

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B.  (CVE-2022-1520)

  - Thunderbird would behave slightly differently for already known resources, when loading CSS resources     through resolving CSS variables. This could be used to probe the browser history.  (CVE-2022-29916)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1725 advisory.

  - Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

  - Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

  - Mozilla: iframe Sandbox bypass (CVE-2022-29911)

  - Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

  - Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

  - Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

  - Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

  - Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1726 advisory.

  - Mozilla: Incorrect security status shown after viewing an attached email (CVE-2022-1520)

  - Mozilla: Bypassing permission prompt in nested browsing contexts (CVE-2022-29909)

  - Mozilla: iframe Sandbox bypass (CVE-2022-29911)

  - Mozilla: Reader mode bypassed SameSite cookies (CVE-2022-29912)

  - Mozilla: Speech Synthesis feature not properly disabled (CVE-2022-29913)

  - Mozilla: Fullscreen notification bypass using popups (CVE-2022-29914)

  - Mozilla: Leaking browser history with CSS variables (CVE-2022-29916)

  - Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 91.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-18 advisory.

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. (CVE-2022-1520)

  - When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which     could enable browser spoofing attacks. (CVE-2022-29914)

  - Documents in deeply-nested cross-origin browsing contexts could obtain permissions granted to the top-     level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - Thunderbird would behave slightly differently for already known resources, when loading CSS resources     through resolving CSS variables. This could be used to probe the browser history. (CVE-2022-29916)

  - Thunderbird did not properly protect against top-level navigations for iframe sandbox with a policy     relaxed through a keyword like <code>allow-top-navigation-by-user-activation</code>. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process. (CVE-2022-29913)

  - Mozilla developers Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs     present in Thunderbird 91.8. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-18 advisory.

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. (CVE-2022-1520)

  - When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which     could enable browser spoofing attacks. (CVE-2022-29914)

  - Documents in deeply-nested cross-origin browsing contexts could obtain permissions granted to the top-     level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - Thunderbird would behave slightly differently for already known resources, when loading CSS resources     through resolving CSS variables. This could be used to probe the browser history. (CVE-2022-29916)

  - Thunderbird did not properly protect against top-level navigations for iframe sandbox with a policy     relaxed through a keyword like <code>allow-top-navigation-by-user-activation</code>. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process. (CVE-2022-29913)

  - Mozilla developers Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs     present in Thunderbird 91.8. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
182000	Amazon Linux 2 : firefox (ALASFIREFOX-2023-011)	Nessus	Amazon Linux Local Security Checks	critical
167711	AlmaLinux 9 : thunderbird (ALSA-2022:4589)	Nessus	Alma Linux Local Security Checks	critical
164847	RHEL 9 : thunderbird (RHSA-2022:4589)	Nessus	Red Hat Local Security Checks	critical
163986	GLSA-202208-14 : Mozilla Thunderbird: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
162781	Oracle Linux 9 : thunderbird (ELSA-2022-4589)	Nessus	Oracle Linux Local Security Checks	critical
161472	Debian DLA-3020-1 : thunderbird - LTS security update	Nessus	Debian Local Security Checks	critical
161448	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Thunderbird vulnerabilities (USN-5435-1)	Nessus	Ubuntu Local Security Checks	critical
161401	Debian DSA-5141-1 : thunderbird - security update	Nessus	Debian Local Security Checks	critical
161255	SUSE SLED15 / SLES15 Security Update : MozillaThunderbird (SUSE-SU-2022:1719-1)	Nessus	SuSE Local Security Checks	critical
161109	AlmaLinux 8 : thunderbird (ALSA-2022:1730)	Nessus	Alma Linux Local Security Checks	critical
160682	CentOS 7 : thunderbird (CESA-2022:1725)	Nessus	CentOS Local Security Checks	critical
160669	Rocky Linux 8 : thunderbird (RLSA-2022:1730)	Nessus	Rocky Linux Local Security Checks	critical
160643	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:1725)	Nessus	Scientific Linux Local Security Checks	critical
160637	RHEL 8 : thunderbird (RHSA-2022:1730)	Nessus	Red Hat Local Security Checks	critical
160635	RHEL 8 : thunderbird (RHSA-2022:1727)	Nessus	Red Hat Local Security Checks	critical
160634	RHEL 8 : thunderbird (RHSA-2022:1724)	Nessus	Red Hat Local Security Checks	critical
160633	Oracle Linux 8 : thunderbird (ELSA-2022-1730)	Nessus	Oracle Linux Local Security Checks	critical
160632	Oracle Linux 7 : thunderbird (ELSA-2022-1725)	Nessus	Oracle Linux Local Security Checks	critical
160624	RHEL 7 : thunderbird (RHSA-2022:1725)	Nessus	Red Hat Local Security Checks	critical
160621	RHEL 8 : thunderbird (RHSA-2022:1726)	Nessus	Red Hat Local Security Checks	critical
160527	Mozilla Thunderbird < 91.9	Nessus	Windows	critical
160526	Mozilla Thunderbird < 91.9	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2022-29913

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical