The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2189-1 advisory.

    Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd and     Christian Holler discovered multiple memory safety issues in Thunderbird. If a user were tricked in to     opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Thunderbird. (CVE-2014-1518)

    Abhishek Arya discovered an out of bounds read when decoding JPG images. An attacker could potentially     exploit this to cause a denial of service via application crash. (CVE-2014-1523)

    Abhishek Arya discovered a buffer overflow when a script uses a non-XBL object as an XBL object. If a user     had enabled scripting, an attacker could potentially exploit this to execute arbitrary code with the     privileges of the user invoking Thunderbird. (CVE-2014-1524)

    Mariusz Mlynski discovered that sites with notification permissions can run script in a privileged context     in some circumstances. If a user had enabled scripting, an attacker could exploit this to execute     arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1529)

    It was discovered that browser history navigations could be used to load a site with the addressbar     displaying the wrong address. If a user had enabled scripting, an attacker could potentially exploit this     to conduct cross-site scripting or phishing attacks. (CVE-2014-1530)

    A use-after-free was discovered when resizing images in some circumstances. If a user had enabled     scripting, an attacker could potentially exploit this to cause a denial of service via application crash     or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1531)

    Tyson Smith and Jesse Schwartzentruber discovered a use-after-free during host resolution in some     circumstances. An attacker could potentially exploit this to cause a denial of service via application     crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1532)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2189-1)

critical Nessus Plugin ID 73803

Version 1.23