Detections
Analytics

Mozilla Thunderbird < 157.0

medium Nessus Plugin ID 353287

Language:

Synopsis

A mail client installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.

Description

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-101 advisory.

 - Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. (CVE-2026-100831)

 - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

 - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. (CVE-2026-103500)

 - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

 - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Mozilla Thunderbird version 157.0 or later.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2026-101/

Plugin Details

Severity: Medium

ID: 353287

File Name: macos_thunderbird_157_0.nasl

Version: 1.4

Type: Local

Agent: macosx

Published: 9/30/2026

Updated: 10/19/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.16

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-100831

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-103500

Vulnerability Information

CPE: cpe:/a:mozilla:thunderbird

Required KB Items: installed_sw/Mozilla Thunderbird

Exploit Ease: No known exploits are available

Patch Publication Date: 9/30/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-100756, CVE-2026-100757, CVE-2026-100758, CVE-2026-100759, CVE-2026-100760, CVE-2026-100761, CVE-2026-100762, CVE-2026-100763, CVE-2026-100764, CVE-2026-100765, CVE-2026-100766, CVE-2026-100767, CVE-2026-100768, CVE-2026-100769, CVE-2026-100770, CVE-2026-100771, CVE-2026-100772, CVE-2026-100773, CVE-2026-100774, CVE-2026-100775, CVE-2026-100776, CVE-2026-100777, CVE-2026-100778, CVE-2026-100779, CVE-2026-100780, CVE-2026-100781, CVE-2026-100782, CVE-2026-100783, CVE-2026-100784, CVE-2026-100785, CVE-2026-100786, CVE-2026-100787, CVE-2026-100788, CVE-2026-100789, CVE-2026-100790, CVE-2026-100791, CVE-2026-100792, CVE-2026-100793, CVE-2026-100794, CVE-2026-100795, CVE-2026-100796, CVE-2026-100797, CVE-2026-100798, CVE-2026-100799, CVE-2026-100800, CVE-2026-100801, CVE-2026-100802, CVE-2026-100803, CVE-2026-100804, CVE-2026-100805, CVE-2026-100806, CVE-2026-100807, CVE-2026-100808, CVE-2026-100809, CVE-2026-100810, CVE-2026-100811, CVE-2026-100812, CVE-2026-100813, CVE-2026-100814, CVE-2026-100815, CVE-2026-100816, CVE-2026-100817, CVE-2026-100818, CVE-2026-100819, CVE-2026-100820, CVE-2026-100821, CVE-2026-100822, CVE-2026-100824, CVE-2026-100825, CVE-2026-100826, CVE-2026-100828, CVE-2026-100829, CVE-2026-100830, CVE-2026-100831, CVE-2026-103500, CVE-2026-96869

IAVA: 2026-A-1069