The version of Thunderbird installed on the remote Mac OS X host is prior to 31.7. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exist within the     browser engine. A remote attacker can exploit these to     corrupt memory and execute arbitrary code.
    (CVE-2015-2708)

  - A buffer overflow condition exists in SVGTextFrame.cpp     when rendering SVG graphics that are combined with     certain CSS properties due to improper validation of     user-supplied input. A remote attacker can exploit this     to cause a heap-based buffer overflow, resulting in the     execution of arbitrary code. (CVE-2015-2710)

  - A use-after-free error exists due to improper processing     of text when vertical text is enabled. A remote attacker     can exploit this to dereference already freed memory.
    (CVE-2015-2713)

  - A buffer overflow condition exists in the     XML_GetBuffer() function in xmlparse.c due to improper     validation of user-supplied input when handling     compressed XML content. An attacker can exploit this to     cause a buffer overflow, resulting in the execution of     arbitrary code. (CVE-2015-2716)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-1012 advisory.

    [31.7.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [31.7.0-1]
    - Update to 31.7.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2603-1 advisory.

    Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink discovered multiple memory safety issues in     Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an     attacker could potentially exploit these to cause a denial of service via application crash, or execute     arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-2708)

    Atte Kettunen discovered a buffer overflow during the rendering of SVG content with certain CSS properties     in some circumstances. If a user were tricked in to opening a specially crafted message with scripting     enabled, an attacker could potentially exploit this to cause a denial of service via application crash, or     execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-2710)

    Scott Bell discovered a use-afer-free during the processing of text when vertical text is enabled. If a     user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Thunderbird. (CVE-2015-2713)

    Ucha Gobejishvili discovered a buffer overflow when parsing compressed XML content. If a user were tricked     in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit     this to cause a denial of service via application crash, or execute arbitrary code with the privileges of     the user invoking Thunderbird. (CVE-2015-2716)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to Firefox 31.7.0 ESR (bsc#930622) fixes the following issues :

  - MFSA 2015-46/CVE-2015-2708/CVE-2015-2709 (bmo#1120655,     bmo#1143299, bmo#1151139, bmo#1152177, bmo#1111251,     bmo#1117977, bmo#1128064, bmo#1135066, bmo#1143194,     bmo#1146101, bmo#1149526, bmo#1153688, bmo#1155474)     Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)

  - MFSA 2015-47/CVE-2015-0797 (bmo#1080995) Buffer overflow     parsing H.264 video with Linux Gstreamer

  - MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow     with SVG content and CSS

  - MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free     during text processing with vertical text enabled

  - MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow     when parsing compressed XML

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
(CVE-2015-2716)

An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-2708, CVE-2015-2710, CVE-2015-2713)

A heap-based buffer overflow flaw was found in the way Thunderbird processed compressed XML data. An attacker could create specially crafted compressed XML content that, when processed by Thunderbird, could cause it to crash or execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-2716)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Jesse Ruderman, Mats Palmgren, Byron Campen, Steve Fink, Atte Kettunen, Scott Bell, and Ucha Gobejishvili as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.7. You can find a link to the Mozilla advisories in the References section of this erratum.

All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.7, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.

The Mozilla Thunderbird email, news, and chat client was updated to version 31.7.0 to fix several security issues.

The following vulnerabilities were fixed (bnc#930622) :

  - MFSA 2015-46/CVE-2015-2708 Miscellaneous memory safety     hazards

  - MFSA 2015-47/CVE-2015-0797 (bmo#1080995) Buffer overflow     parsing H.264 video with Linux Gstreamer

  - MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow     with SVG content and CSS

  - MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free     during text processing with vertical text enabled

  - MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow     when parsing compressed XML

  - MFSA 2015-57/CVE-2011-3079 (bmo#1087565) Privilege     escalation through IPC channel messages

ID	Name	Product	Family	Published	Updated	Severity
83463	Mozilla Thunderbird < 31.7 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	5/14/2015	11/22/2019	high
83535	Oracle Linux 5 / 6 / 7 : thunderbird (ELSA-2015-1012)	Nessus	Oracle Linux Local Security Checks	5/19/2015	4/29/2025	critical
83544	Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2603-1)	Nessus	Ubuntu Local Security Checks	5/19/2015	8/27/2024	critical
83870	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0960-1)	Nessus	SuSE Local Security Checks	5/28/2015	1/6/2021	high
97446	F5 Networks BIG-IP : Expat XML library vulnerability (K50459349)	Nessus	F5 Networks Local Security Checks	3/1/2017	12/31/2025	high
83530	CentOS 5 / 6 / 7 : thunderbird (CESA-2015:1012)	Nessus	CentOS Local Security Checks	5/19/2015	1/4/2021	critical
83800	openSUSE Security Update : MozillaThunderbird (openSUSE-2015-374)	Nessus	SuSE Local Security Checks	5/26/2015	1/19/2021	critical

Detections

Analytics

Plugins Search

high

critical

critical

high

high

critical

critical