Mozilla Thunderbird < 160.0

critical Nessus Plugin ID 378427

Synopsis

A mail client installed on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of Thunderbird installed on the remote Windows host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-128 advisory.

- Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

- Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

- When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it pointed to when the message was saved or sent. This could disclose local files, or content from the user's network, to the message recipients or to the mail provider. This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
(CVE-2026-126132)

- When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS. (CVE-2026-126133)

- Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Mozilla Thunderbird version 160.0 or later.

Plugin Details

Severity: Critical

ID: 378427

File Name: mozilla_thunderbird_160_0.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows

Published: 11/10/2026

Updated: 11/10/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 92.8

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-124948

CVSS v3

Risk Factor: Critical

Base Score: 9.6

Temporal Score: 8.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-124917

Vulnerability Information

CPE: cpe:/a:mozilla:thunderbird

Required KB Items: installed_sw/Mozilla Thunderbird

Exploit Ease: No known exploits are available

Patch Publication Date: 11/10/2026

Vulnerability Publication Date: 11/3/2026

Reference Information

CVE: CVE-2026-120572, CVE-2026-124852, CVE-2026-124853, CVE-2026-124854, CVE-2026-124855, CVE-2026-124856, CVE-2026-124857, CVE-2026-124858, CVE-2026-124859, CVE-2026-124860, CVE-2026-124861, CVE-2026-124862, CVE-2026-124863, CVE-2026-124864, CVE-2026-124865, CVE-2026-124866, CVE-2026-124867, CVE-2026-124868, CVE-2026-124869, CVE-2026-124870, CVE-2026-124871, CVE-2026-124872, CVE-2026-124873, CVE-2026-124874, CVE-2026-124875, CVE-2026-124876, CVE-2026-124877, CVE-2026-124878, CVE-2026-124879, CVE-2026-124880, CVE-2026-124881, CVE-2026-124882, CVE-2026-124883, CVE-2026-124884, CVE-2026-124885, CVE-2026-124886, CVE-2026-124887, CVE-2026-124888, CVE-2026-124889, CVE-2026-124890, CVE-2026-124891, CVE-2026-124892, CVE-2026-124893, CVE-2026-124894, CVE-2026-124895, CVE-2026-124896, CVE-2026-124897, CVE-2026-124898, CVE-2026-124899, CVE-2026-124900, CVE-2026-124901, CVE-2026-124902, CVE-2026-124903, CVE-2026-124904, CVE-2026-124905, CVE-2026-124906, CVE-2026-124907, CVE-2026-124908, CVE-2026-124909, CVE-2026-124910, CVE-2026-124912, CVE-2026-124913, CVE-2026-124914, CVE-2026-124915, CVE-2026-124917, CVE-2026-124918, CVE-2026-124919, CVE-2026-124920, CVE-2026-124921, CVE-2026-124922, CVE-2026-124923, CVE-2026-124924, CVE-2026-124925, CVE-2026-124926, CVE-2026-124927, CVE-2026-124928, CVE-2026-124929, CVE-2026-124930, CVE-2026-124931, CVE-2026-124932, CVE-2026-124933, CVE-2026-124934, CVE-2026-124935, CVE-2026-124936, CVE-2026-124938, CVE-2026-124939, CVE-2026-124940, CVE-2026-124941, CVE-2026-124942, CVE-2026-124943, CVE-2026-124944, CVE-2026-124945, CVE-2026-124946, CVE-2026-124947, CVE-2026-124948, CVE-2026-124949, CVE-2026-124950, CVE-2026-124951, CVE-2026-126132, CVE-2026-126133, CVE-2026-126134, CVE-2026-126135, CVE-2026-126136

Detections

Analytics