The installed version of Thunderbird 10.0.x is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.     (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.     (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.     (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

The installed version of SeaMonkey is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - '<select>' elements can be abused to cover arbitrary     portions of a newly loaded page and may also be utilized     for click-jacking attacks. (CVE-2012-3984,     CVE-2012-5354)

  - A violation in the HTML specification for     'document.domain' behavior can be abused, potentially     leading to cross-site scripting attacks. (CVE-2012-3985)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - A potentially exploitable crash can be caused when     making an invalid cast using the 'instanceof' operator     on certain types of JavaScript objects. (CVE-2012-3989)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.     (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.     (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.     (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

The Mozilla suite received following security updates (bnc#783533) :

Mozilla Firefox was updated to 16.0.1. Mozilla SeaMonkey was updated to 2.13.1. Mozilla Thunderbird was updated to 16.0.1. Mozilla XULRunner was updated to 16.0.1.

  - MFSA 2012-88/CVE-2012-4191 (bmo#798045) Miscellaneous     memory safety hazards

  - MFSA 2012-89/CVE-2012-4192/CVE-2012-4193 (bmo#799952,     bmo#720619) defaultValue security checks not applied

  - MFSA 2012-74/CVE-2012-3982/CVE-2012-3983 Miscellaneous     memory safety hazards

  - MFSA 2012-75/CVE-2012-3984 (bmo#575294) select element     persistance allows for attacks

  - MFSA 2012-76/CVE-2012-3985 (bmo#655649) Continued access     to initial origin after setting document.domain

  - MFSA 2012-77/CVE-2012-3986 (bmo#775868) Some     DOMWindowUtils methods bypass security checks

  - MFSA 2012-79/CVE-2012-3988 (bmo#725770) DOS and crash     with full screen and history navigation

  - MFSA 2012-80/CVE-2012-3989 (bmo#783867) Crash with     invalid cast when using instanceof operator

  - MFSA 2012-81/CVE-2012-3991 (bmo#783260) GetProperty     function can bypass security checks

  - MFSA 2012-82/CVE-2012-3994 (bmo#765527) top object and     location property accessible by plugins

  - MFSA 2012-83/CVE-2012-3993/CVE-2012-4184 (bmo#768101,     bmo#780370) Chrome Object Wrapper (COW) does not     disallow access to privileged functions or properties

  - MFSA 2012-84/CVE-2012-3992 (bmo#775009) Spoofing and     script injection through location.hash

  - MFSA 2012-85/CVE-2012-3995/CVE-2012-4179/CVE-2012-4180/     CVE-2012-4181/CVE-2012-4182/CVE-2012-4183     Use-after-free, buffer overflow, and out of bounds read     issues found using Address Sanitizer

  - MFSA 2012-86/CVE-2012-4185/CVE-2012-4186/CVE-2012-4187/     CVE-2012-4188 Heap memory corruption issues found using     Address Sanitizer

  - MFSA 2012-87/CVE-2012-3990 (bmo#787704)

ID	Name	Product	Family	Published	Updated	Severity
62581	Mozilla Thunderbird 10.0.x < 10.0.8 Multiple Vulnerabilities	Nessus	Windows	10/17/2012	12/4/2019	critical
62583	SeaMonkey < 2.13 Multiple Vulnerabilities	Nessus	Windows	10/17/2012	5/27/2026	critical
74779	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1345-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical