A number of security vulnerabilities have been discovered for Mozilla Thunderbird version 2.0.0.21 (CVE-2009-1302, CVE-2009-1303, CVE-2009-1304, CVE-2009-1305, CVE-2009-1306, CVE-2009-1307, CVE-2009-1308, CVE-2009-1309, CVE-2009-2210, CVE-2009-1392, CVE-2009-1832, CVE-2009-1833, CVE-2009-1838, CVE-2009-1836, CVE-2009-1840, CVE-2009-1841).

This update provides the latest Thunderbird to correct these issues.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0652     Moxie Marlinspike discovered that Unicode box drawing     characters inside of internationalised domain names     could be used for phishing attacks.

  - CVE-2009-1302     Olli Pettay, Martijn Wargers, Mats Palmgren, Oleg     Romashin, Jesse Ruderman and Gary Kwong reported crashes     in the layout engine, which might allow the execution of     arbitrary code.

  - CVE-2009-1303     Olli Pettay, Martijn Wargers, Mats Palmgren, Oleg     Romashin, Jesse Ruderman and Gary Kwong reported crashes     in the layout engine, which might allow the execution of     arbitrary code.

  - CVE-2009-1304     Igor Bukanov and Bob Clary discovered crashes in the     JavaScript engine, which might allow the execution of     arbitrary code.

  - CVE-2009-1305     Igor Bukanov and Bob Clary discovered crashes in the     JavaScript engine, which might allow the execution of     arbitrary code.

  - CVE-2009-1306     Daniel Veditz discovered that the Content-Disposition:
    header is ignored within the jar: URI scheme.

  - CVE-2009-1307     Gregory Fleischer discovered that the same-origin policy     for Flash files is inproperly enforced for files loaded     through the view-source scheme, which may result in     bypass of cross-domain policy restrictions.

  - CVE-2009-1308     Cefn Hoile discovered that sites, which allow the     embedding of third-party stylesheets are vulnerable to     cross-site scripting attacks through XBL bindings.

  - CVE-2009-1309     'moz_bug_r_a4' discovered bypasses of the same-origin     policy in the XMLHttpRequest JavaScript API and the     XPCNativeWrapper.

  - CVE-2009-1311     Paolo Amadini discovered that incorrect handling of POST     data when saving a website with an embedded frame may     lead to information disclosure.

  - CVE-2009-1312     It was discovered that Iceweasel allows Refresh: headers     to redirect to JavaScript URIs, resulting in cross-site     scripting.

http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2009:1126 advisory.

  - Firefox 2 and 3 Layout engine crash (CVE-2009-1303)

  - Firefox 2 and 3 JavaScript engine crash (CVE-2009-1305)

  - Firefox jar: scheme ignores the content-disposition: header on the inner URI (CVE-2009-1306)

  - Firefox Same-origin violations when Adobe Flash loaded via view-source: protocol (CVE-2009-1307)

  - Firefox XSS hazard using third-party stylesheets and XBL bindings (CVE-2009-1308)

  - Firefox Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString (CVE-2009-1309)

  - Firefox browser engine crashes (CVE-2009-1392)

  - Firefox JavaScript engine crashes (CVE-2009-1833)

  - Firefox SSL tampering via non-200 responses to proxy CONNECT requests (CVE-2009-1836)

  - Firefox arbitrary code execution flaw (CVE-2009-1838)

  - Thunderbird mail crash (CVE-2009-2210)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0436 advisory.

    firefox:

    [3.0.9-1.0.1.el5]
    - Update firstrun and homepage URLs
    - Added firefox-oracle-default-prefs.js/firefox-oracle-default-bookmarks.html       and removed the corresponding  Red Hat ones
    - Added patch oracle-firefox-branding.patch

    [3.0.9-1]
    - Update to Firefox 3.0.9
    - Gnome crash dialog disabled (#493455)

    xulrunner:

    [1.9.0.9-1.0.1.el5]
    - Added xulrunner-oracle-default-prefs.js and removed the corresponding       RedHat one

    [1.9.0.9-1]
    - Update to 1.9.0.9

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of SeaMonkey earlier than 1.1.17. Such versions are reportedly affected by multiple vulnerabilities : 

  - Multiple remote memory-corruption vulnerabilities.

  - Content injection vulnerabilities.

  - An information disclosure vulnerability.

  - A cross-site scripting vulnerability.

  - A privilege escalation vulnerability.

  - A security bypass vulnerability.

  - A URI spoofing vulnerability.

The installed version of Firefox is earlier than 3.0.9. Such versions are potentially affected by the following security issues :
 - Multiple remote memory corruption vulnerabilities exist that can be exploited to execute arbitrary code in the context of the user running the affected application. (MFSA 2009-14)
 - A flaw may exist where Unicode box drawing characters are allowed in Internationalized Domain Names where they could be visually confused with punctuation used in valid web addresses. An attacker can leverage this to launch a phishing-type scam against a victim. (MFSA 2009-15)
 - A vulnerability exists when the 'jar:' scheme is used to wrap a URI which serves the content with 'Content-Disposition: attachment'. An attacker can leverage this to subvert sites which use this mechanism to mitigate content injection attacks. (MFSA 2009-16)
 - When an Adobe Flash file is loaded via the 'view-source:' scheme, the Flash plugin misinterprets the origin of the content as localhost. An attacker can leverage this to launch cross-site request forgery attacks. It is also possible to exploit this to place cookie-like objects on victims' computers. (MFSA 2009-17)
 - A vulnerability exists that allows attackers to inject arbitrary scripts into sites via XBL bindings. This vulnerability requires the attacker to have the ability to embed third-party stylesheets into the site. (MFSA 2009-18)
 - Multiple remote code execution vulnerabilities exist caused by the creation of documents whose URI does not match the document's principle using XMLHttpRequest, as well as a flaw in the 'XPCNativeWrapper.ToString' '__proto__' coming from the wrong scope. (MFSA 2009-19)
 - A malicious MozSearch plugin could be created using a JavaScript: URI in the SearchForm value. An attacker can leverage this in order to inject code into arbitrary sites. (MFSA 2009-20)
 - An information disclosure vulnerability exists when saving the inner frame of a web page as a file when the outer page has POST data associated with it. (MFSA 2009-21)
 - A cross site scripting vulnerability exists when handling a Refresh header containing a JavaScript: URI. (MFSA 2009-22)" ); 

Versions of Mozilla Thunderbird prior to 2.0.0.22 are affected by the following security issues :

 - Multiple remote memory corruption vulnerabilities exist which can be exploited to execute arbitrary code in the context of the user running the affected application. (MFSA 2009-14)
 - A flaw may exist where Unicode box drawing characters are allowed in Internationalized Domain Names where they could be visually confused with punctuation used in valid web addresses. An attacker can leverage this to launch a phishing-type scam against a victim. (MFSA 2009-15)
 - A vulnerability exists when the 'jar:' scheme is used to wrap a URI which serves the content with 'Content-Disposition: attachment'. An attacker can leverage this to subvert sites which use this mechanism to mitigate content injection attacks. (MFSA 2009-16)
 - When an Adobe Flash file is loaded via the 'view-source:' scheme, the Flash plugin misinterprets the origin of the content as localhost. An attacker can leverage this to launch cross-site request forger attacks. It is also possible to exploit this to place cookie-like objects on victim's computers. (MFSA 2009-17)
 - A vulnerability exists which allows attackers to inject arbitrary scripts into sites via XBL bindings. This vulnerability requires the attacker to have the ability to embed third-party stylesheets into the site. (MFSA 2009-18)
 - Multiple remote code execution vulnerabilities exist caused by the creation of documents whose URI does not match the document's principle using XMLHttpRequest, as well as a flaw in the 'XPCNativeWrapper.ToString' '__proto__' coming from the wrong scope. (MFSA 2009-19)
 - A malicious MozSearch plugin could be created using a javascript: URI in the SearchForm value. An attacker can leverage this in order to inject code into arbitrary sites. (MFSA 2009-20)
 - An information disclosure vulnerability exists when saving the inner frame of a web page as a file when the outer page has POST data associated with it. (MFSA 2009-21)
 - A cross site scripting vulnerability exists when handling a Refresh header containing a javascript: URI. (MFSA 2009-22)" ); 

The installed version of Thunderbird is earlier than 2.0.0.22. Such versions are potentially affected by the following security issues :

  - Multiple remote memory corruption vulnerabilities exist which can be exploited to execute arbitrary code in the context of the user running the affected application. (MFSA 2009-14)

  - A flaw may exist where Unicode box drawing characters are allowed in Internationalized Domain Names where they could be visually confused with punctuation used in valid web addresses. An attacker can leverage this to launch a phishing-type scam against a victim. (MFSA 2009-15)

  - A vulnerability exists when the 'jar:' scheme is used to wrap a URI which serves the content with 'Content-Disposition: attachment'. An attacker can leverage this to subvert sites which use this mechanism to mitigate content injection attacks. (MFSA 2009-16)

  - When an Adobe Flash file is loaded via the 'view-source:' scheme, the Flash plugin misinterprets the origin of the content as localhost. An attacker can leverage this to launch cross-site request forger attacks. It is also possible to exploit this to place cookie-like objects on victim's computers. (MFSA 2009-17)

  - A vulnerability exists which allows attackers to inject arbitrary scripts into sites via XBL bindings. This vulnerability requires the attacker to have the ability to embed third-party stylesheets into the site. (MFSA 2009-18)

  - Multiple remote code execution vulnerabilities exist caused by the creation of documents whose URI does not match the document's principle using XMLHttpRequest, as well as a flaw in the 'XPCNativeWrapper.ToString' '__proto__' coming from the wrong scope. (MFSA 2009-19)

  - A malicious MozSearch plugin could be created using a javascript: URI in the SearchForm value. An attacker can leverage this in order to inject code into arbitrary sites. (MFSA 2009-20)

  - An information disclosure vulnerability exists when saving the inner frame of a web page as a file when the outer page has POST data associated with it. (MFSA 2009-21)

  - A cross site scripting vulnerability exists when handling a Refresh header containing a javascript: URI. (MFSA 2009-22)" );

The installed version of Firefox is earlier than 3.0.9. Such versions are potentially affected by the following security issues :

  - Multiple remote memory corruption vulnerabilities exist that can be exploited to execute arbitrary code in the context of the user running the affected application. (MFSA 2009-14)

  - A flaw may exist where Unicode box drawing characters are allowed in Internationalized Domain Names where they could be visually confused with punctuation used in valid web addresses. An attacker can leverage this to launch a phishing-type scam against a victim. (MFSA 2009-15)

  - A vulnerability exists when the 'jar:' scheme is used to wrap a URI which serves the content with 'Content-Disposition: attachment'. An attacker can leverage this to subvert sites which use this mechanism to mitigate content injection attacks. (MFSA 2009-16)

  - When an Adobe Flash file is loaded via the 'view-source:' scheme, the Flash plugin misinterprets the origin of the content as localhost. An attacker can leverage this to launch cross-site request forgery attacks. It is also possible to exploit this to place cookie-like objects on victims' computers. (MFSA 2009-17)

  - A vulnerability exists that allows attackers to inject arbitrary scripts into sites via XBL bindings. This vulnerability requires the attacker to have the ability to embed third-party stylesheets into the site. (MFSA 2009-18)

  - Multiple remote code execution vulnerabilities exist caused by the creation of documents whose URI does not match the document's principle using XMLHttpRequest, as well as a flaw in the 'XPCNativeWrapper.ToString' '__proto__' coming from the wrong scope. (MFSA 2009-19)

  - A malicious MozSearch plugin could be created using a JavaScript: URI in the SearchForm value. An attacker can leverage this in order to inject code into arbitrary sites. (MFSA 2009-20)

  - An information disclosure vulnerability exists when saving the inner frame of a web page as a file when the outer page has POST data associated with it. (MFSA 2009-21)

  - A cross site scripting vulnerability exists when handling a Refresh header containing a JavaScript: URI. (MFSA 2009-22)" );

The remote host is running a version of Mozilla SeaMonkey earlier than 1.1.17. Such versions are reportedly affected by multiple vulnerabilities : 

  - Multiple remote memory-corruption vulnerabilities.

  - Content injection vulnerabilities.

  - An information disclosure vulnerability.

  - A cross-site scripting vulnerability.

  - A privilege escalation vulnerability.

  - A security bypass vulnerability.

  - A URI spoofing vulnerability.

ID	Name	Product	Family	Published	Updated	Severity
39581	Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2009:141)	Nessus	Mandriva Local Security Checks	6/28/2009	1/6/2021	high
38724	Debian DSA-1797-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	5/11/2009	1/4/2021	medium
37309	Fedora 9 : Miro-2.0.3-3.fc9 / blam-1.8.5-8.fc9.1 / chmsee-1.0.1-11.fc9 / devhelp-0.19.1-11.fc9 / etc (2009-3875)	Nessus	Fedora Local Security Checks	4/23/2009	1/11/2021	medium
63881	RHEL 5 : thunderbird (RHSA-2009:1126)	Nessus	Red Hat Local Security Checks	1/24/2013	4/21/2024	medium
67847	Oracle Linux 5 : firefox (ELSA-2009-0436)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	medium
5084	SeaMonkey < 1.1.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/18/2004	3/6/2019	medium
4998	Mozilla Firefox < 3.0.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	4/22/2009	3/6/2019	medium
5001	Mozilla Thunderbird < 2.0.0.22 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	8/18/2004	3/6/2019	medium
801249	Mozilla Thunderbird < 2.0.0.21 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients			high
800746	Firefox < 3.0.9 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high
801255	Mozilla SeaMonkey < 1.1.17 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high

Detections

Analytics

Plugins Search

high

medium

medium

medium

medium

medium

medium

medium

high

high

high