Debian DSA-4790-1 : thunderbird - security update

high Nessus Plugin ID 142951


The remote Debian host is missing a security-related update.


A use-after-free was found in Thunderbird, which could potentially result in the execution of arbitrary code.


Upgrade the thunderbird packages.

For the stable distribution (buster), this problem has been fixed in version 1:78.4.2-1~deb10u1.

See Also

Plugin Details

Severity: High

ID: 142951

File Name: debian_DSA-4790.nasl

Version: 1.4

Type: local

Agent: unix

Published: 11/17/2020

Updated: 3/2/2022

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Nessus Agent

Risk Information


Risk Factor: High

Score: 7.4


Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:F/RL:OF/RC:C

CVSS Score Source: CVE-2020-26950


Risk Factor: High

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:thunderbird, cpe:/o:debian:debian_linux:10.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/12/2020

Vulnerability Publication Date: 12/9/2020

Exploitable With

Metasploit (Firefox MCallGetProperty Write Side Effects Use After Free Exploit)

Reference Information

CVE: CVE-2020-26950

DSA: 4790