Ubuntu 5.04 / 5.10 : mozilla-thunderbird vulnerabilities (USN-276-1)

critical Nessus Plugin ID 21321
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.


The remote Ubuntu host is missing one or more security-related patches.


Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables. Under some rare circumstances, a malicious mail with embedded JavaScript could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0292, CVE-2006-1742)

The function XULDocument.persist() did not sufficiently validate the names of attributes. An attacker could exploit this to inject arbitrary XML code into the file 'localstore.rdf', which is read and evaluated at startup. This could include JavaScript commands that would be run with the user's privileges. (CVE-2006-0296)

Due to a flaw in the HTML tag parser a specific sequence of HTML tags caused memory corruption. A malicious HTML email could exploit this to crash the browser or even execute arbitrary code with the user's privileges. (CVE-2006-0748)

An invalid ordering of table-related tags caused Thunderbird to use a negative array index. A malicious HTML email could exploit this to execute arbitrary code with the privileges of the user.

Georgi Guninski discovered that forwarding mail in-line while using the default HTML 'rich mail' editor executed JavaScript embedded in the email message. Forwarding mail in-line is not the default setting but it is easily accessed through the 'Forward As' menu item.

As a privacy measure to prevent senders (primarily spammers) from tracking when email is read Thunderbird does not load remote content referenced from an HTML mail message until a user tells it to do so.
This normally includes the content of frames and CSS files. It was discovered that it was possible to bypass this restriction by indirectly including remote content through an intermediate inline CSS script or frame. (CVE-2006-1045)

Georgi Guninski discovered that embedded XBL scripts could escalate their (normally reduced) privileges to get full privileges of the user if the email is viewed with 'Print Preview'. (CVE-2006-1727)

The crypto.generateCRMFRequest() function had a flaw which could be exploited to run arbitrary code with the user's privileges.

An integer overflow was detected in the handling of the CSS property 'letter-spacing'. A malicious HTML email could exploit this to run arbitrary code with the user's privileges. (CVE-2006-1730)

The methods valueOf.call() and .valueOf.apply() returned an object whose privileges were not properly confined to those of the caller, which made them vulnerable to cross-site scripting attacks. A malicious email with embedded JavaScript code could exploit this to modify the contents or steal confidential data (such as passwords) from other opened web pages. (CVE-2006-1731) The window.controllers array variable (CVE-2006-1732) and event handlers (CVE-2006-1741) were vulnerable to a similar attack.

The privileged built-in XBL bindings were not fully protected from web content and could be accessed by calling valueOf.call() and valueOf.apply() on a method of that binding. A malicious email could exploit this to run arbitrary JavaScript code with the user's privileges. (CVE-2006-1733)

It was possible to use the Object.watch() method to access an internal function object (the 'clone parent'). A malicious email containing JavaScript code could exploit this to execute arbitrary code with the user's privileges. (CVE-2006-1734)

By calling the XBL.method.eval() method in a special way it was possible to create JavaScript functions that would get compiled with the wrong privileges. A malicious email could exploit this to execute arbitrary JavaScript code with the user's privileges. (CVE-2006-1735)

Several crashes have been fixed which could be triggered by specially crafted HTML content and involve memory corruption. These could potentially be exploited to execute arbitrary code with the user's privileges. (CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)

The 'enigmail' plugin has been updated to work with the new Thunderbird and Mozilla versions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Update the affected packages.

Plugin Details

Severity: Critical

ID: 21321

File Name: ubuntu_USN-276-1.nasl

Version: 1.19

Type: local

Agent: unix

Published: 5/3/2006

Updated: 1/19/2021

Dependencies: ssh_get_info.nasl

Risk Information


Risk Factor: Medium

Score: 6.7


Risk Factor: Critical

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:mozilla-enigmail, p-cpe:/a:canonical:ubuntu_linux:mozilla-thunderbird, p-cpe:/a:canonical:ubuntu_linux:mozilla-thunderbird-dev, p-cpe:/a:canonical:ubuntu_linux:mozilla-thunderbird-enigmail, p-cpe:/a:canonical:ubuntu_linux:mozilla-thunderbird-inspector, p-cpe:/a:canonical:ubuntu_linux:mozilla-thunderbird-offline, p-cpe:/a:canonical:ubuntu_linux:mozilla-thunderbird-typeaheadfind, cpe:/o:canonical:ubuntu_linux:5.04, cpe:/o:canonical:ubuntu_linux:5.10

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Patch Publication Date: 5/3/2006

Vulnerability Publication Date: 2/1/2006

Reference Information

CVE: CVE-2006-0292, CVE-2006-0293, CVE-2006-0296, CVE-2006-0748, CVE-2006-0749, CVE-2006-0884, CVE-2006-1045, CVE-2006-1727, CVE-2006-1728, CVE-2006-1730, CVE-2006-1731, CVE-2006-1732, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1741, CVE-2006-1742, CVE-2006-1790

USN: 276-1

CWE: 20, 79, 119, 189, 264, 399