Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.DEBIAN_DSA-5158.NASL
HistoryJun 08, 2022 - 12:00 a.m.

Debian DSA-5158-1 : thunderbird - security update

2022-06-0800:00:00
This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
37
JSON

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5158 advisory.

  • Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
    (CVE-2022-31747)

  • An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. (CVE-2022-1529)

  • If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. (CVE-2022-1802)

  • When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker’s digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker’s email address was not visible. Because Thunderbird compared the invisible sender address with the signature’s email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10. (CVE-2022-1834)

  • A malicious website could have learned the size of a cross-origin resource that supported Range requests.
    This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (CVE-2022-31736)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dsa-5158. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(161961);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/03/21");

  script_cve_id(
    "CVE-2022-1529",
    "CVE-2022-1802",
    "CVE-2022-1834",
    "CVE-2022-31736",
    "CVE-2022-31737",
    "CVE-2022-31738",
    "CVE-2022-31740",
    "CVE-2022-31741",
    "CVE-2022-31742",
    "CVE-2022-31747"
  );
  script_xref(name:"IAVA", value:"2022-A-0217-S");
  script_xref(name:"IAVA", value:"2022-A-0226-S");

  script_name(english:"Debian DSA-5158-1 : thunderbird - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dsa-5158 advisory.

  - Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory
    safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory
    corruption and we presume that with enough effort some of these could have been exploited to run arbitrary
    code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
    (CVE-2022-31747)

  - An attacker could have sent a message to the parent process where the contents were used to double-index
    into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript
    executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox <
    100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. (CVE-2022-1529)

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,
    they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This
    vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and
    Thunderbird < 91.9.1. (CVE-2022-1802)

  - When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space
    character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an
    attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary
    sender email address chosen by the attacker. If the sender name started with a false email address,
    followed by many Braille space characters, the attacker's email address was not visible. Because
    Thunderbird compared the invisible sender address with the signature's email address, if the signing key
    or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This
    vulnerability affects Thunderbird < 91.10. (CVE-2022-1834)

  - A malicious website could have learned the size of a cross-origin resource that supported Range requests.
    This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (CVE-2022-31736)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/thunderbird");
  script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2022/dsa-5158");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-1529");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-1802");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-1834");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-31736");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-31737");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-31738");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-31740");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-31741");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-31742");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-31747");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/buster/thunderbird");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/thunderbird");
  script_set_attribute(attribute:"solution", value:
"Upgrade the thunderbird packages.

For the stable distribution (bullseye), these problems have been fixed in version 1");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-31747");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/05/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/06/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/06/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:calendar-google-provider");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:lightning");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-af");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-all");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ar");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ast");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-be");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-bg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-br");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ca");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-cak");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-cs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-cy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-da");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-de");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-dsb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-el");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-en-ca");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-en-gb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-es-ar");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-es-es");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-et");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-eu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-fi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-fr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-fy-nl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ga-ie");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-gl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-he");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-hr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-hsb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-hu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-hy-am");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-id");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-is");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-it");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ja");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ka");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-kab");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-kk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ko");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-lt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-lv");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ms");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-nb-no");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-nl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-nn-no");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-pa-in");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-pl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-pt-br");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-pt-pt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-rm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ro");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ru");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-si");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sq");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sv-se");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-th");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-tr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-uk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-uz");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-vi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-zh-cn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-zh-tw");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var release = get_kb_item('Host/Debian/release');
if ( isnull(release) ) audit(AUDIT_OS_NOT, 'Debian');
var release = chomp(release);
if (! preg(pattern:"^(10)\.[0-9]+|^(11)\.[0-9]+", string:release)) audit(AUDIT_OS_NOT, 'Debian 10.0 / 11.0', 'Debian ' + release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '10.0', 'prefix': 'calendar-google-provider', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'lightning', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-af', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-all', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ar', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ast', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-be', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-bg', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-br', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ca', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-cak', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-cs', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-cy', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-da', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-de', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-dsb', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-el', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-en-ca', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-en-gb', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-es-ar', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-es-es', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-et', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-eu', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-fi', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-fr', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-fy-nl', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ga-ie', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-gd', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-gl', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-he', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-hr', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-hsb', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-hu', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-hy-am', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-id', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-is', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-it', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ja', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ka', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-kab', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-kk', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ko', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-lt', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-lv', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ms', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-nb-no', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-nl', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-nn-no', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-pa-in', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-pl', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-pt-br', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-pt-pt', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-rm', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ro', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-ru', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-si', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-sk', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-sl', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-sq', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-sr', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-sv-se', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-th', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-tr', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-uk', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-uz', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-vi', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-zh-cn', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '10.0', 'prefix': 'thunderbird-l10n-zh-tw', 'reference': '1:91.10.0-1~deb10u1'},
    {'release': '11.0', 'prefix': 'calendar-google-provider', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'lightning', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-af', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-all', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ar', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ast', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-be', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-bg', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-br', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ca', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-cak', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-cs', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-cy', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-da', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-de', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-dsb', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-el', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-en-ca', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-en-gb', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-es-ar', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-es-es', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-et', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-eu', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-fi', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-fr', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-fy-nl', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ga-ie', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-gd', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-gl', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-he', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-hr', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-hsb', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-hu', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-hy-am', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-id', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-is', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-it', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ja', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ka', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-kab', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-kk', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ko', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-lt', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-lv', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ms', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-nb-no', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-nl', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-nn-no', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-pa-in', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-pl', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-pt-br', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-pt-pt', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-rm', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ro', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ru', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-si', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sk', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sl', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sq', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sr', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sv-se', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-th', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-tr', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-uk', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-uz', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-vi', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-zh-cn', 'reference': '1:91.10.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-zh-tw', 'reference': '1:91.10.0-1~deb11u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (release && prefix && reference) {
    if (deb_check(release:release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'calendar-google-provider / lightning / thunderbird / etc');
}
VendorProductVersionCPE
debiandebian_linuxcalendar-google-providerp-cpe:/a:debian:debian_linux:calendar-google-provider
debiandebian_linuxlightningp-cpe:/a:debian:debian_linux:lightning
debiandebian_linuxthunderbirdp-cpe:/a:debian:debian_linux:thunderbird
debiandebian_linuxthunderbird-l10n-afp-cpe:/a:debian:debian_linux:thunderbird-l10n-af
debiandebian_linuxthunderbird-l10n-allp-cpe:/a:debian:debian_linux:thunderbird-l10n-all
debiandebian_linuxthunderbird-l10n-arp-cpe:/a:debian:debian_linux:thunderbird-l10n-ar
debiandebian_linuxthunderbird-l10n-astp-cpe:/a:debian:debian_linux:thunderbird-l10n-ast
debiandebian_linuxthunderbird-l10n-bep-cpe:/a:debian:debian_linux:thunderbird-l10n-be
debiandebian_linuxthunderbird-l10n-bgp-cpe:/a:debian:debian_linux:thunderbird-l10n-bg
debiandebian_linuxthunderbird-l10n-brp-cpe:/a:debian:debian_linux:thunderbird-l10n-br
Rows per page:
1-10 of 711

References

Related

nessus 76
openvas 37
centos 2
mageia 2
osv 11
oraclelinux 11
redhat 21
rocky 4
debian 6
amazon 3
suse 3
altlinux 3
mozilla 3
slackware 3
kaspersky 6
ubuntu 3
redos 2
thn 1
almalinux 1
malwarebytes 1
nessus
nessus
Oracle Linux 9 : thunderbird (ELSA-2022-4892)
2022-07-07 00:00:00
Oracle Linux 8 : firefox (ELSA-2022-4872)
2022-06-02 00:00:00
RHEL 8 : firefox (RHSA-2022:4871)
2022-06-02 00:00:00
openvas
openvas
CentOS: Security Advisory for thunderbird (CESA-2022:4891)
2022-08-03 00:00:00
Debian: Security Advisory (DLA-3041-1)
2022-06-04 00:00:00
Debian: Security Advisory (DSA-5158-1)
2022-06-09 00:00:00
centos
centos
thunderbird security update
2022-08-02 19:48:11
firefox security update
2022-08-02 19:45:49
mageia
mageia
Updated thunderbird packages fix security vulnerability
2022-06-04 23:25:39
Updated firefox/nss/nspr packages fix security vulnerability
2022-06-04 23:25:39
osv
osv
thunderbird - security update
2022-06-04 00:00:00
thunderbird - security update
2022-06-03 00:00:00
Important: thunderbird security update
2022-06-02 07:48:48
oraclelinux
oraclelinux
firefox security update
2022-06-02 00:00:00
firefox security update
2022-06-02 00:00:00
thunderbird security update
2022-06-03 00:00:00
redhat
redhat
(RHSA-2022:4870) Important: firefox security update
2022-06-01 14:59:58
(RHSA-2022:4890) Important: thunderbird security update
2022-06-02 16:04:29
(RHSA-2022:4889) Important: thunderbird security update
2022-06-02 16:04:21
rocky
rocky
thunderbird security update
2022-06-02 07:48:48
firefox security update
2022-06-01 20:09:36
thunderbird security update
2022-05-27 18:24:54
debian
debian
[SECURITY] [DSA 5158-1] thunderbird security update
2022-06-04 17:52:32
[SECURITY] [DLA 3041-1] thunderbird security update
2022-06-03 16:45:59
[SECURITY] [DLA 3040-1] firefox-esr security update
2022-06-03 16:36:45
amazon
amazon
Important: thunderbird
2022-07-19 01:23:00
Important: thunderbird
2022-07-19 01:23:00
Critical: thunderbird
2022-05-31 23:50:00
suse
suse
Security update for MozillaThunderbird (important)
2022-06-13 00:00:00
Security update for MozillaFirefox (important)
2022-06-02 00:00:00
Security update for MozillaFirefox (important)
2022-05-24 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package firefox-esr version 91.10.0-alt1
2022-06-03 00:00:00
Security fix for the ALT Linux 10 package thunderbird version 91.10.0-alt1
2022-06-03 00:00:00
Security fix for the ALT Linux 10 package thunderbird version 91.9.1-alt1
2022-05-27 00:00:00
mozilla
mozilla
Security Vulnerabilities fixed in Firefox ESR 91.10 — Mozilla
2022-05-31 00:00:00
Security Vulnerabilities fixed in Thunderbird 91.10 — Mozilla
2022-05-31 00:00:00
Security Vulnerabilities fixed in Firefox 101 — Mozilla
2022-05-31 00:00:00
slackware
slackware
[slackware-security] mozilla-thunderbird
2022-06-02 19:43:23
[slackware-security] mozilla-firefox
2022-06-01 00:53:57
[slackware-security] mozilla-firefox
2022-05-21 01:42:04
kaspersky
kaspersky
KLA12547 Multiple vulnerabilities in Mozilla Thunderbird
2022-05-31 00:00:00
KLA12546 Multiple vulnerabilities in Mozilla Firefox ESR
2022-05-31 00:00:00
KLA12545 Multiple vulnerabilities in Mozilla Firefox
2022-05-31 00:00:00
ubuntu
ubuntu
Firefox vulnerabilities
2022-06-13 00:00:00
Thunderbird vulnerabilities
2022-07-14 00:00:00
Firefox vulnerabilities
2022-05-23 00:00:00
redos
redos
ROS-20220530-03
2022-05-30 00:00:00
ROS-20220530-04
2022-05-30 00:00:00
thn
thn
Tails OS Users Advised Not to Use Tor Browser Until Critical Firefox Bugs are Patched
2022-05-26 09:08:00
almalinux
almalinux
Critical: thunderbird security update
2022-05-27 18:24:54
malwarebytes
malwarebytes
Firefox, Thunderbird, receive patches for critical security issues
2022-05-27 11:06:49
JSON
Related for DEBIAN_DSA-5158.NASL
nessus76openvas37centos2mageia2osv11oraclelinux11redhat21rocky4debian6amazon3suse3altlinux3mozilla3slackware3kaspersky6ubuntu3redos2thn1almalinux1malwarebytes1