Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Mozilla Thunderbird < 15.0 Multiple Vulnerabilities



The remote host has an email client installed that is vulnerable to multiple attack vectors.


Versions of Mozilla Thunderbird prior to 15.0 are affected by the following security issues :

- An error exists related to 'Object.defineProperty' and the location object that could allow cross-site scripting attacks. (CVE-2012-1956) - Unspecified memory safety issues exist. (CVE-2012-1970, CVE-2012-1971) - Multiple use-after-free errors exist. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964) - An error exists related to bitmap (BMP) and icon (ICO) file decoding that can lead to memory corruption, causing application crashes and potentially arbitrary code execution. (CVE-2012-3966) - A use-after-free error exists related to WebGL shaders. (CVE-2012-3968) - A buffer overflow exists related to SVG filters. (CVE-2012-3969) - A use-after-free error exists related to elements having 'requiredFeatures' attributes. (CVE-2012-3970) - A 'Graphite 2' library memory corruption error exists. (CVE-2012-3971) - An XSLT out-of-bounds read error exists related to 'format-number'. (CVE-2012-3972) - The installer can be tricked into running unauthorized executables. (CVE-2012-3974) - The DOM parser can unintentionally load linked resources in extensions. (CVE-2012-3975) - Security checks related to location objects can be bypassed if crafted calls are made to the browser chrome code. (CVE-2012-3978) - Calling 'eval' in the web console can allow injected code to be executed with browser chrome privileges. (CVE-2012-3980)


Upgrade to Thunderbird 15.0 or later.