Multiple security issues have been found in Thunderbird which could result in the setup of a non-encrypted IMAP connection, denial of service or potentially the execution of arbitrary code.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2613 advisory.

  - If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response,     then Thunderbird will continue with an unencrypted connection, causing email data to be sent without     protection. This vulnerability affects Thunderbird < 68.9.0. (CVE-2020-12398)

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox     ESR < 68.9. (CVE-2020-12405)

  - Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12406)

  - Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and     Firefox ESR < 68.9. (CVE-2020-12410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 68.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1468 advisory.

    The Mozilla Foundation Security Advisory describes this flaw as:

    If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response,     then Thunderbird will continue with an unencrypted connection, causing email data to be sent without     protection. (CVE-2020-12398)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Mozilla developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2020-12406)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. (CVE-2020-12410)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier,     resulting in memory corruption and a potentially exploitable crash. (CVE-2020-12417)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process     memory to malicious JavaScript. (CVE-2020-12418)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When processing callbacks that occurred during window flushing in the parent process, the associated     window may die; causing a use-after-free condition. This could have led to memory corruption and a     potentially exploitable crash. (CVE-2020-12419)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer,     leading to memory corruption and a potentially exploitable crash. (CVE-2020-12420)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even     if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date     silently without notification to the user. (CVE-2020-12421)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-22 advisory.

  - Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 68.8. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2020-12410)

  - NSS has shown timing differences when performing DSA signatures, which was exploitable and could     eventually leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2020-12406)

  - If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response,     then Thunderbird will continue with an unencrypted connection, causing email data to be sent without     protection. (CVE-2020-12398)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
137375	Debian DSA-4702-1 : thunderbird - security update	Nessus	Debian Local Security Checks	6/12/2020	3/7/2024	high
137729	CentOS 6 : thunderbird (RHSA-2020:2613)	Nessus	CentOS Local Security Checks	6/23/2020	10/9/2024	high
138857	Amazon Linux 2 : thunderbird (ALAS-2020-1468)	Nessus	Amazon Linux Local Security Checks	7/23/2020	4/11/2025	high
137086	Mozilla Thunderbird < 68.9.0	Nessus	MacOS X Local Security Checks	6/4/2020	11/18/2025	high
147312	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0002)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	4/25/2023	critical

Detections

Analytics

Plugins Search

high

high

high

high

critical