Mozilla Thunderbird < 159.0

#%NASL_MIN_LEVEL 80900
## 
# (C) Tenable, Inc.
#                                  
# The descriptive text and package checks in this plugin were
# extracted from Mozilla Foundation Security Advisory mfsa2026-121.
# The text itself is copyright (C) Mozilla Foundation.
## 

include('compat.inc');

if (description)
{
  script_id(372625);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/27");

  script_cve_id(
    "CVE-2026-100801",
    "CVE-2026-117860",
    "CVE-2026-117861",
    "CVE-2026-117862",
    "CVE-2026-117863",
    "CVE-2026-117864",
    "CVE-2026-117865",
    "CVE-2026-117866",
    "CVE-2026-117867",
    "CVE-2026-117868",
    "CVE-2026-117869",
    "CVE-2026-117870",
    "CVE-2026-117871",
    "CVE-2026-117872",
    "CVE-2026-117873",
    "CVE-2026-117874",
    "CVE-2026-117875",
    "CVE-2026-117876",
    "CVE-2026-117877",
    "CVE-2026-117878",
    "CVE-2026-117879",
    "CVE-2026-117880",
    "CVE-2026-117881",
    "CVE-2026-117882",
    "CVE-2026-117883",
    "CVE-2026-117884",
    "CVE-2026-117885",
    "CVE-2026-117886",
    "CVE-2026-117887",
    "CVE-2026-117888",
    "CVE-2026-117889",
    "CVE-2026-117890",
    "CVE-2026-117891",
    "CVE-2026-117892",
    "CVE-2026-117893",
    "CVE-2026-117894",
    "CVE-2026-117895",
    "CVE-2026-117896",
    "CVE-2026-117897",
    "CVE-2026-117898",
    "CVE-2026-117899",
    "CVE-2026-117900",
    "CVE-2026-117901",
    "CVE-2026-117902",
    "CVE-2026-117903",
    "CVE-2026-117904",
    "CVE-2026-117905",
    "CVE-2026-117906",
    "CVE-2026-117907",
    "CVE-2026-117908",
    "CVE-2026-117909",
    "CVE-2026-117910",
    "CVE-2026-117911",
    "CVE-2026-117912",
    "CVE-2026-117913",
    "CVE-2026-117914",
    "CVE-2026-117915",
    "CVE-2026-117916",
    "CVE-2026-117917",
    "CVE-2026-117918",
    "CVE-2026-117919",
    "CVE-2026-117920",
    "CVE-2026-117921",
    "CVE-2026-117922",
    "CVE-2026-117923",
    "CVE-2026-117924",
    "CVE-2026-117925",
    "CVE-2026-117926",
    "CVE-2026-117927",
    "CVE-2026-117928",
    "CVE-2026-117929",
    "CVE-2026-117930",
    "CVE-2026-117931",
    "CVE-2026-117932",
    "CVE-2026-117933",
    "CVE-2026-117934",
    "CVE-2026-117935",
    "CVE-2026-117936",
    "CVE-2026-117937",
    "CVE-2026-117938",
    "CVE-2026-117939",
    "CVE-2026-117940",
    "CVE-2026-117941",
    "CVE-2026-117942",
    "CVE-2026-117943",
    "CVE-2026-117944",
    "CVE-2026-117945",
    "CVE-2026-117946",
    "CVE-2026-117947",
    "CVE-2026-117948",
    "CVE-2026-117949",
    "CVE-2026-117950",
    "CVE-2026-117951",
    "CVE-2026-117952",
    "CVE-2026-117953",
    "CVE-2026-117954",
    "CVE-2026-117955",
    "CVE-2026-117956",
    "CVE-2026-117957",
    "CVE-2026-117958",
    "CVE-2026-117959",
    "CVE-2026-117960",
    "CVE-2026-117961",
    "CVE-2026-117962",
    "CVE-2026-117963",
    "CVE-2026-117964",
    "CVE-2026-117965",
    "CVE-2026-117966",
    "CVE-2026-117967",
    "CVE-2026-117968",
    "CVE-2026-117969",
    "CVE-2026-117970",
    "CVE-2026-117971",
    "CVE-2026-117972",
    "CVE-2026-117973",
    "CVE-2026-117974",
    "CVE-2026-117975",
    "CVE-2026-117976",
    "CVE-2026-117977",
    "CVE-2026-117978",
    "CVE-2026-117979",
    "CVE-2026-117980",
    "CVE-2026-117981",
    "CVE-2026-117982",
    "CVE-2026-117983",
    "CVE-2026-117984",
    "CVE-2026-117985",
    "CVE-2026-117986",
    "CVE-2026-117987",
    "CVE-2026-117988",
    "CVE-2026-117989",
    "CVE-2026-117990",
    "CVE-2026-117991",
    "CVE-2026-117992",
    "CVE-2026-117993",
    "CVE-2026-117994",
    "CVE-2026-117995",
    "CVE-2026-117996",
    "CVE-2026-117997",
    "CVE-2026-117998",
    "CVE-2026-117999",
    "CVE-2026-118000",
    "CVE-2026-118002",
    "CVE-2026-118003",
    "CVE-2026-118004",
    "CVE-2026-118005",
    "CVE-2026-118006",
    "CVE-2026-118007",
    "CVE-2026-118008",
    "CVE-2026-118009",
    "CVE-2026-118010",
    "CVE-2026-118011",
    "CVE-2026-118012",
    "CVE-2026-118013",
    "CVE-2026-118014",
    "CVE-2026-118015",
    "CVE-2026-118016",
    "CVE-2026-118017",
    "CVE-2026-118019",
    "CVE-2026-118020",
    "CVE-2026-118021",
    "CVE-2026-118022",
    "CVE-2026-118023",
    "CVE-2026-118024",
    "CVE-2026-118025",
    "CVE-2026-118026",
    "CVE-2026-118174",
    "CVE-2026-118175",
    "CVE-2026-118176",
    "CVE-2026-118177",
    "CVE-2026-118178",
    "CVE-2026-118179",
    "CVE-2026-118180"
  );

  script_name(english:"Mozilla Thunderbird < 159.0");

  script_set_attribute(attribute:"synopsis", value:
"A mail client installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 159.0. It is, therefore, affected
by multiple vulnerabilities as referenced in the mfsa2026-121 advisory.

  - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159.
    (CVE-2026-118008)

  - When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the
    attachment's content to offer importing the key. A sender could mark the attachment as an external
    attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction,
    bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share
    could leak the user's NTLM credentials.  The NTLM credential leak only affects Thunderbird on Windows. On
    other operating systems, the issue allowed a remote request that bypassed remote content blocking.
    (CVE-2026-118174)

  - When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of
    a different message stored in the same folder into the message being composed, without showing a blocked
    content warning. If the user sent the message, the content of the other message was disclosed to the
    recipients. (CVE-2026-118175)

  - Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares
    could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause
    Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name
    and NTLM authentication data, which could be used for offline password cracking or relay attacks.  This
    bug only affects Thunderbird on Windows. Other operating systems are unaffected. (CVE-2026-118176)

  - When looking for calendars in a directory on a server, during account setup or when adding a new network
    calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network
    shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird
    subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-
    controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's
    share or overwrite a local file. (CVE-2026-118177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2026-121/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mozilla Thunderbird version 159.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-118008");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_thunderbird_installed.nasl");
  script_require_keys("installed_sw/Mozilla Thunderbird");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "macos"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Mozilla Thunderbird",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "159.0"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);