Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.DEBIAN_DSA-5582.NASL
HistoryDec 21, 2023 - 12:00 a.m.

Debian DSA-5582-1 : thunderbird - security update

2023-12-2100:00:00
This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
16
debian 11/12
s/mime
pgp/mime
thunderbird < 115.6
webgl
heap buffer overflow
`readlink`
use-after-free
sandbox escape
`videobridge`
`nswindow::pickeropen(void)`
`nsdnsservice::init`
memory safety bugs

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9

Confidence

High

EPSS

0.005

Percentile

77.7%

JSON

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5582 advisory.

  • The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be used to give recipients the impression that a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6. (CVE-2023-50761)

  • When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header section. A digitally signed text from a different context, such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6. (CVE-2023-50762)

  • The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
    (CVE-2023-6856)

  • When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS).
    Windows is unaffected.     This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6857)

  • Firefox was susceptible to a heap buffer overflow in nsTextFragment due to insufficient OOM handling.
    This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6858)

  • A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6859)

  • The VideoBridge allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6860)

  • The nsWindow::PickerOpen(void) method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
    (CVE-2023-6861)

  • A use-after-free was identified in the nsDNSService::Init. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6. (CVE-2023-6862)

  • Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6864)

  • Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 121. (CVE-2023-6873)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dsa-5582. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(187195);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/01/26");

  script_cve_id(
    "CVE-2023-6856",
    "CVE-2023-6857",
    "CVE-2023-6858",
    "CVE-2023-6859",
    "CVE-2023-6860",
    "CVE-2023-6861",
    "CVE-2023-6862",
    "CVE-2023-6864",
    "CVE-2023-6873",
    "CVE-2023-50761",
    "CVE-2023-50762"
  );
  script_xref(name:"IAVA", value:"2023-A-0702-S");

  script_name(english:"Debian DSA-5582-1 : thunderbird - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dsa-5582 advisory.

  - The signature of a digitally signed S/MIME email message may optionally specify the signature creation
    date and time. If present, Thunderbird did not compare the signature creation date with the message date
    and time, and displayed a valid signature despite a date or time mismatch. This could be used to give
    recipients the impression that a message was sent at a different date or time. This vulnerability affects
    Thunderbird < 115.6. (CVE-2023-50761)

  - When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text
    was never shown to the user. This is because the text was interpreted as a MIME message and the first
    paragraph was always treated as an email header section. A digitally signed text from a different context,
    such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects
    Thunderbird < 115.6. (CVE-2023-50762)

  - The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems
    with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox
    escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
    (CVE-2023-6856)

  - When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller
    than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS).
    Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox <
    121. (CVE-2023-6857)

  - Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling.
    This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6858)

  - A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability
    affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6859)

  - The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be
    abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and
    Firefox < 121. (CVE-2023-6860)

  - The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless
    mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
    (CVE-2023-6861)

  - A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during
    start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6. (CVE-2023-6862)

  - Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs
    showed evidence of memory corruption and we presume that with enough effort some of these could have been
    exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and
    Firefox < 121. (CVE-2023-6864)

  - Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we
    presume that with enough effort some of these could have been exploited to run arbitrary code. This
    vulnerability affects Firefox < 121. (CVE-2023-6873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/thunderbird");
  script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2023/dsa-5582");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-50761");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-50762");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6856");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6857");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6858");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6859");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6860");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6861");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6862");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6864");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-6873");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/thunderbird");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/thunderbird");
  script_set_attribute(attribute:"solution", value:
"Upgrade the thunderbird packages.

For the stable distribution (bookworm), these problems have been fixed in version 1");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-6873");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/12/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/12/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-af");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-all");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ar");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ast");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-be");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-bg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-br");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ca");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-cak");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-cs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-cy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-da");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-de");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-dsb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-el");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-en-ca");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-en-gb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-es-ar");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-es-es");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-es-mx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-et");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-eu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-fi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-fr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-fy-nl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ga-ie");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-gd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-gl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-he");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-hr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-hsb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-hu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-hy-am");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-id");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-is");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-it");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ja");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ka");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-kab");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-kk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ko");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-lt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-lv");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ms");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-nb-no");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-nl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-nn-no");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-pa-in");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-pl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-pt-br");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-pt-pt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-rm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ro");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-ru");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sq");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-sv-se");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-th");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-tr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-uk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-uz");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-vi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-zh-cn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird-l10n-zh-tw");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+|^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0 / 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'thunderbird', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-af', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-all', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ar', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ast', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-be', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-bg', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-br', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ca', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-cak', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-cs', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-cy', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-da', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-de', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-dsb', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-el', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-en-ca', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-en-gb', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-es-ar', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-es-es', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-es-mx', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-et', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-eu', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-fi', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-fr', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-fy-nl', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ga-ie', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-gd', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-gl', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-he', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-hr', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-hsb', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-hu', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-hy-am', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-id', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-is', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-it', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ja', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ka', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-kab', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-kk', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ko', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-lt', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-lv', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ms', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-nb-no', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-nl', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-nn-no', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-pa-in', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-pl', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-pt-br', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-pt-pt', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-rm', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ro', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-ru', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sk', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sl', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sq', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sr', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-sv-se', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-th', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-tr', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-uk', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-uz', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-vi', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-zh-cn', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '11.0', 'prefix': 'thunderbird-l10n-zh-tw', 'reference': '1:115.6.0-1~deb11u1'},
    {'release': '12.0', 'prefix': 'thunderbird', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-af', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-all', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ar', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ast', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-be', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-bg', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-br', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ca', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-cak', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-cs', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-cy', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-da', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-de', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-dsb', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-el', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-en-ca', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-en-gb', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-es-ar', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-es-es', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-es-mx', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-et', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-eu', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-fi', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-fr', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-fy-nl', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ga-ie', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-gd', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-gl', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-he', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-hr', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-hsb', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-hu', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-hy-am', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-id', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-is', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-it', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ja', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ka', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-kab', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-kk', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ko', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-lt', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-lv', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ms', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-nb-no', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-nl', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-nn-no', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-pa-in', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-pl', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-pt-br', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-pt-pt', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-rm', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ro', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-ru', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-sk', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-sl', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-sq', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-sr', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-sv-se', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-th', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-tr', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-uk', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-uz', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-vi', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-zh-cn', 'reference': '1:115.6.0-1~deb12u1'},
    {'release': '12.0', 'prefix': 'thunderbird-l10n-zh-tw', 'reference': '1:115.6.0-1~deb12u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'thunderbird / thunderbird-l10n-af / thunderbird-l10n-all / etc');
}

References

Related

debian 4
openvas 25
osv 15
nessus 56
redhat 18
rocky 2
almalinux 4
mozilla 3
centos 2
oraclelinux 6
amazon 1
slackware 2
kaspersky 3
ubuntu 3
mageia 2
redos 1
ubuntucve 6
alpinelinux 6
cvelist 6
nvd 5
debiancve 5
prion 6
redhatcve 4
veracode 7
cve 7
debian
debian
[SECURITY] [DSA 5582-1] thunderbird security update
2023-12-21 19:33:01
[SECURITY] [DLA 3698-1] thunderbird security update
2023-12-29 10:11:37
[SECURITY] [DSA 5581-1] firefox-esr security update
2023-12-20 19:23:51
openvas
openvas
Debian: Security Advisory (DLA-3698-1)
2024-01-01 00:00:00
Debian: Security Advisory (DSA-5582-1)
2023-12-22 00:00:00
Ubuntu: Security Advisory (USN-6563-1)
2024-01-03 00:00:00
osv
osv
thunderbird - security update
2023-12-21 00:00:00
thunderbird - security update
2023-12-29 00:00:00
Important: thunderbird security update
2024-01-09 04:07:41
nessus
nessus
Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2023-353-03)
2023-12-19 00:00:00
Fedora 38 : thunderbird (2023-608dd04117)
2023-12-21 00:00:00
Mozilla Thunderbird < 115.6
2023-12-19 00:00:00
redhat
redhat
(RHSA-2024:0005) Important: thunderbird security update
2024-01-02 06:50:38
(RHSA-2024:0030) Important: thunderbird security update
2024-01-02 07:58:27
(RHSA-2024:0003) Important: thunderbird security update
2024-01-02 06:50:30
rocky
rocky
thunderbird security update
2024-01-09 04:07:41
firefox security update
2024-01-09 04:07:41
almalinux
almalinux
Important: thunderbird security update
2024-01-02 00:00:00
Important: thunderbird security update
2024-01-02 00:00:00
Important: firefox security update
2024-01-02 00:00:00
mozilla
mozilla
Security Vulnerabilities fixed in Thunderbird 115.6 — Mozilla
2023-12-19 00:00:00
Security Vulnerabilities fixed in Firefox ESR 115.6 — Mozilla
2023-12-19 00:00:00
Security Vulnerabilities fixed in Firefox 121 — Mozilla
2023-12-19 00:00:00
centos
centos
thunderbird security update
2024-01-12 18:58:02
firefox security update
2024-01-12 18:57:27
oraclelinux
oraclelinux
thunderbird security update
2024-01-03 00:00:00
thunderbird security update
2024-01-03 00:00:00
thunderbird security update
2024-01-02 00:00:00
amazon
amazon
Important: thunderbird
2024-01-03 21:04:00
slackware
slackware
[slackware-security] mozilla-thunderbird
2023-12-19 21:32:36
[slackware-security] mozilla-firefox
2023-12-19 21:32:19
kaspersky
kaspersky
KLA62519 Multiple vulnerabilities in Mozilla Thunderbird
2023-12-19 00:00:00
KLA62518 Multiple vulnerabilities in Mozilla Firefox ESR
2023-12-19 00:00:00
KLA62517 Multiple vulnerabilities in Mozilla Firefox
2023-12-19 00:00:00
ubuntu
ubuntu
Thunderbird vulnerabilities
2024-01-02 00:00:00
Firefox vulnerabilities
2024-01-02 00:00:00
Firefox regressions
2024-01-11 00:00:00
mageia
mageia
Updated thunderbird thunderbird-l10n packages fix security vulnerabilities
2024-01-12 15:36:35
Updated nss and firefox packages fix security vulnerabilities
2024-01-15 13:07:27
redos
redos
ROS-20240927-06
2024-09-27 00:00:00
ubuntucve
ubuntucve
CVE-2023-6873
2023-12-20 00:00:00
CVE-2023-50762
2023-12-20 00:00:00
CVE-2023-50761
2023-12-20 00:00:00
alpinelinux
alpinelinux
CVE-2023-6873
2023-12-19 14:15:08
CVE-2023-50761
2023-12-19 14:15:07
CVE-2023-50762
2023-12-19 14:15:07
cvelist
cvelist
CVE-2023-6873
2023-12-19 13:38:56
CVE-2023-50762
2023-12-19 13:38:34
CVE-2023-50761
2023-12-19 13:38:35
nvd
nvd
CVE-2023-50762
2023-12-19 14:15:07
CVE-2023-50761
2023-12-19 14:15:07
CVE-2023-6873
2023-12-19 14:15:08
debiancve
debiancve
CVE-2023-50761
2023-12-19 14:15:07
CVE-2023-50762
2023-12-19 14:15:07
CVE-2023-6873
2023-12-19 14:15:08
prion
prion
Design/Logic Flaw
2023-12-19 14:15:00
Memory corruption
2023-12-19 14:15:00
Design/Logic Flaw
2023-12-19 14:15:00
redhatcve
redhatcve
CVE-2023-50761
2023-12-20 13:33:22
CVE-2023-50762
2023-12-20 13:33:31
CVE-2023-6859
2023-12-20 11:34:16
veracode
veracode
Email Spoofing
2023-12-23 22:40:51
Information Mismatch
2023-12-23 22:40:35
Out-of-bounds Write
2023-12-25 02:54:27
cve
cve
CVE-2023-50762
2023-12-19 14:15:07
CVE-2023-50761
2023-12-19 14:15:07
CVE-2023-6873
2023-12-19 14:15:08

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9

Confidence

High

EPSS

0.005

Percentile

77.7%

JSON
Related for DEBIAN_DSA-5582.NASL
debian4openvas25osv15nessus56redhat18rocky2almalinux4mozilla3centos2oraclelinux6amazon1slackware2kaspersky3ubuntu3mageia2redos1ubuntucve6alpinelinux6cvelist6nvd5debiancve5prion6redhatcve4veracode7cve7