SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2021:4150-1)

critical Nessus Plugin ID 156292

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4150-1 advisory.

- Update to version 91.4 MFSA 2021-54 (bsc#1193485)
- CVE-2021-43536: URL leakage when navigating while executing asynchronous function
- CVE-2021-43537: Heap buffer overflow when using structured clone
- CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both
- CVE-2021-43539: GC rooting failure when calling wasm instance methods
- CVE-2021-43541: External protocol handler parameters were unescaped
- CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler
- CVE-2021-43543: Bypass of CSP sandbox directive when embedding
- CVE-2021-43545: Denial of Service when using the Location API in a loop
- CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed
- CVE-2021-43528: JavaScript unexpectedly enabled for the composition area

- Update to version 91.3.2
- CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244)

- Update to version 91.3 MFSA 2021-50 (bsc#1192250)
- CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets
- CVE-2021-38504: Fixed use-after-free in file picker dialog
- CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data
- CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning
- CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports
- CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing
- CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain
- CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS
- Fixed plain text reformatting regression (bsc#1182863)

- Update to version 91.2 MFSA 2021-47 (bsc#1191332)
- CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT
- CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion
- CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux
- CVE-2021-32810: Data race in crossbeam-deque
- CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1
- CVE-2021-38496: Use-after-free in MessageTask
- CVE-2021-38497: Validation message could have been overlaid on another origin
- CVE-2021-38498: Use-after-free of nsLanguageAtomService object
- CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2
- CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2
- CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections

- Update to version 91.1.0 MFSA 2021-41 (bsc#1190269)
- CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer
- CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1

- Update to version 91.0.1 MFSA 2021-37 (bsc#1189547)
- CVE-2021-29991: Header Splitting possible with HTTP/3 Responses

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected MozillaThunderbird, MozillaThunderbird-translations-common and / or MozillaThunderbird-translations- other packages.

Plugin Details

Severity: Critical

ID: 156292

File Name: suse_SU-2021-4150-1.nasl

Version: 1.12

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 12/25/2021

Updated: 6/26/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.11

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-38503

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:mozillathunderbird, p-cpe:/a:novell:suse_linux:mozillathunderbird-translations-common, p-cpe:/a:novell:suse_linux:mozillathunderbird-translations-other

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/22/2021

Vulnerability Publication Date: 8/2/2021

Reference Information

CVE: CVE-2021-29981, CVE-2021-29982, CVE-2021-29987, CVE-2021-29991, CVE-2021-32810, CVE-2021-38492, CVE-2021-38493, CVE-2021-38495, CVE-2021-38496, CVE-2021-38497, CVE-2021-38498, CVE-2021-38500, CVE-2021-38501, CVE-2021-38502, CVE-2021-38503, CVE-2021-38504, CVE-2021-38505, CVE-2021-38506, CVE-2021-38507, CVE-2021-38508, CVE-2021-38509, CVE-2021-38510, CVE-2021-40529, CVE-2021-43528, CVE-2021-43536, CVE-2021-43537, CVE-2021-43538, CVE-2021-43539, CVE-2021-43541, CVE-2021-43542, CVE-2021-43543, CVE-2021-43545, CVE-2021-43546

IAVA: 2021-A-0366-S, 2021-A-0386-S, 2021-A-0405-S, 2021-A-0450-S, 2021-A-0461-S, 2021-A-0527-S, 2021-A-0569-S

SuSE: SUSE-SU-2021:4150-1

Detections

Analytics