New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 8.9
SynopsisThe remote Mac OS X host contains a mail client that is potentially affected by several vulnerabilities.
DescriptionThe installed version of Thunderbird is earlier than 17.0.2 and thus, is potentially affected by the following security issues :
- Two intermediate certificates were improperly issued by TURKTRUST certificate authority. (CVE-2013-0743)
- A use-after-free error exists related to displaying HTML tables with many columns and column groups.
- An error exists related to the 'AutoWrapperChanger' class that does not properly manage objects during garbage collection. (CVE-2012-0745)
- An error exists related to 'jsval', 'quickstubs', and compartmental mismatches that could lead to potentially exploitable crashes. (CVE-2013-0746)
- Errors exist related to events in the plugin handler that could allow same-origin policy bypass.
- An error related to the 'toString' method of XBL objects could lead to address information leakage.
- Unspecified memory corruption issues exist.
- An error exists related to multiple XML bindings with SVG content, contained in XBL files. (CVE-2013-0752)
- A use-after-free error exists related to 'XMLSerializer' and 'serializeToStream'.
- A use-after-free error exists related to garbage collection and 'ListenManager'. (CVE-2013-0754)
- A use-after-free error exists related to the 'Vibrate' library and 'domDoc'. (CVE-2013-0755)
- 'Chrome Object Wrappers' (COW) can be bypassed by changing object prototypes, which could allow arbitrary code execution. (CVE-2013-0757)
- An error related to SVG elements and plugins could allow privilege escalation. (CVE-2013-0758)
- An error exists related to the address bar that could allow URL spoofing attacks. (CVE-2013-0759)
- Multiple, unspecified use-after-free, out-of-bounds read and buffer overflow errors exist. (CVE-2013-0761, CVE-2013-0762, CVE-2013-0763, CVE-2013-0766, CVE-2013-0767, CVE-2013-0771)
- An error exists related to SSL and threading that could result in potentially exploitable crashes.
- An error exists related to 'Canvas' and bad height or width values passed to it from HTML. (CVE-2013-0768)
SolutionUpgrade to Thunderbird 17.0.2 / 17.0.2 ESR or later.