Mozilla Thunderbird < 158.0.1

#%NASL_MIN_LEVEL 80900
## 
# (C) Tenable, Inc.
#                                  
# The descriptive text and package checks in this plugin were
# extracted from Mozilla Foundation Security Advisory mfsa2026-114.
# The text itself is copyright (C) Mozilla Foundation.
## 

include('compat.inc');

if (description)
{
  script_id(369076);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/21");

  script_cve_id(
    "CVE-2026-113399",
    "CVE-2026-113400",
    "CVE-2026-113401",
    "CVE-2026-113470",
    "CVE-2026-113866",
    "CVE-2026-113867",
    "CVE-2026-113868",
    "CVE-2026-113869"
  );

  script_name(english:"Mozilla Thunderbird < 158.0.1");

  script_set_attribute(attribute:"synopsis", value:
"A mail client installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore,
affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was
    distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block
    list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by
    policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's
    AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the
    user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from
    incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request
    that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would
    then process as if sent by the user. This could be used to send messages or change contact and
    subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's
    chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's
    challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include
    uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge
    consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected
    accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only
    affected NTLM. (CVE-2026-113868)

  - When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary
    Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the
    prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a
    potentially exploitable crash. (CVE-2026-113869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2026-114/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mozilla Thunderbird version 158.0.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-113470");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_thunderbird_installed.nasl");
  script_require_keys("installed_sw/Mozilla Thunderbird");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "macos"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Mozilla Thunderbird",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "158.0.1"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);