Mozilla Thunderbird < 60.3

#%NASL_MIN_LEVEL 80900
## 
# (C) Tenable, Inc.
#                                  
# The descriptive text and package checks in this plugin were
# extracted from Mozilla Foundation Security Advisory mfsa2018-28.
# The text itself is copyright (C) Mozilla Foundation.
## 

include('compat.inc');

if (description)
{
  script_id(275627);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/18");

  script_cve_id(
    "CVE-2018-12389",
    "CVE-2018-12390",
    "CVE-2018-12391",
    "CVE-2018-12392",
    "CVE-2018-12393"
  );
  script_xref(name:"IAVA", value:"2018-A-0348-S");

  script_name(english:"Mozilla Thunderbird < 60.3");

  script_set_attribute(attribute:"synopsis", value:
"A mail client installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.3. It is, therefore, affected
by multiple vulnerabilities as referenced in the mfsa2018-28 advisory.

  - When manipulating user events in nested loops while opening a document through script, it is possible to
    trigger a potentially exploitable crash due to poor event handling. (CVE-2018-12392)

  - During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in
    violation of security policies. Because the problem is in the underlying Android service, this issue is
    addressed by treating all HLS streams as cross-origin and opaque to access.  Note: this issue only affects
    Firefox for Android. Desktop versions of Firefox are unaffected. (CVE-2018-12391)

  - A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of
    scripts to an internal UTF-16 representation could result in allocating a buffer too small for the
    conversion. This leads to a possible out-of-bounds write.  Note: 64-bit builds are not vulnerable to this
    issue. (CVE-2018-12393)

  - Mozilla developers and community members Daniel Veditz and Philipp reported memory safety bugs present in
    Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough
    effort that some of these could be exploited to run arbitrary code. (CVE-2018-12389)

  - Mozilla developers and community members Christian Holler, Bob Owen, Boris Zbarsky, Calixte Denizet, Jason
    Kratzer, Jed Davis, Taegeon Lee, Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond
    Forbes, and Bogdan Tara reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of
    these bugs showed evidence of memory corruption and we presume that with enough effort that some of these
    could be exploited to run arbitrary code. (CVE-2018-12390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2018-28/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mozilla Thunderbird version 60.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-12391");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2018-12392");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/10/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_thunderbird_installed.nasl");
  script_require_keys("installed_sw/Mozilla Thunderbird");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "macos"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Mozilla Thunderbird",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "60.3"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);