Mozilla Thunderbird < 3.0.5 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 5582
Synopsis
The remote host has an email client installed that is vulnerable to multiple attack vectors.Description
Versions of Mozilla Thunderbird prior to 3.0.5 are affected by the following vulnerabilities :- A re-use of a freed object due to scope confusion. (MFSA 2010-25)
- Multiple crashes can result in arbitrary code execution. (MFSA 2010-26)
- A heap buffer overflow in 'nsGenericDOMDataNode::SetTextInternal'. (MFSA 2010-29)
- An integer overflow in XSLT node sorting. (MFSA 2010-30)
Solution
Upgrade to Thunderbird 3.0.5 or later.See Also
http://www.mozilla.org/security/announce/2010/mfsa2010-25.html
http://www.mozilla.org/security/known-vulnerabilities/thunderbird30.html#thunderbird3.0.5
http://www.mozilla.org/security/announce/2010/mfsa2010-26.html
http://www.mozilla.org/security/announce/2010/mfsa2010-29.html
http://www.mozilla.org/security/announce/2010/mfsa2010-30.html
Plugin Details
Severity: Medium
ID: 5582
Family: SMTP Clients
Published: 6/23/2010
Updated: 3/6/2019
Nessus ID: 47125
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Temporal Vector: CVSS2#E:F/RL:OF/RC:C
CVSS v3
Risk Factor: Medium
Base Score: 5.6
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Patch Publication Date: 6/22/2010
Vulnerability Publication Date: 6/22/2010
Reference Information
CVE: CVE-2010-1199, CVE-2010-1200, CVE-2010-1121, CVE-2010-1196, CVE-2010-1201, CVE-2010-1202, CVE-2010-1203