Linux Distros Unpatched Vulnerability : CVE-2026-113868
| Reporter | Title | Published | Views | Family All 64 |
|---|---|---|---|---|
| CVE-2026-113868 | 20 Oct 202619:30 | – | circl | |
| CVE-2026-113868 | 20 Oct 202619:14 | – | cve | |
| CVE-2026-113868 Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication | 20 Oct 202619:14 | – | cvelist | |
| CVE-2026-113868 | 20 Oct 202619:14 | – | debiancve | |
| EUVD-2026-105295 | 20 Oct 202619:14 | – | euvd | |
| KLA91360 Multiple vulnerabilities in Mozilla Thunderbird | 20 Oct 202600:00 | – | kaspersky | |
| KLA91364 Multiple vulnerabilities in Mozilla Thunderbird ESR | 20 Oct 202600:00 | – | kaspersky | |
| Mozilla Thunderbird < 153.5.1 | 21 Oct 202600:00 | – | nessus | |
| Mozilla Thunderbird < 158.0.1 | 21 Oct 202600:00 | – | nessus | |
| Mozilla Thunderbird < 153.5.1 | 21 Oct 202600:00 | – | nessus |
10
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
include('compat.inc');
if (description)
{
script_id(368985);
script_version("1.3");
script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");
script_cve_id("CVE-2026-113868");
script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-113868");
script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.
- When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's
challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include
uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge
consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected
accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only
affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
(CVE-2026-113868)
Note that Nessus relies on the presence of the package as reported by the vendor.");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2026-113868");
script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-113868");
script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/CVE-2026-113868");
script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
script_set_attribute(attribute:"agent", value:"unix");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-113868");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vendor_unpatched", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/20");
script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/21");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:8");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:10");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:9");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:thunderbird");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:thunderbird");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:thunderbird");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:thunderbird");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Misc.");
script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
script_require_ports("Host/OS/CentOS Linux-8", "Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14", "Host/OS/Red Hat Enterprise Linux-10", "Host/OS/Red Hat Enterprise Linux-8", "Host/OS/Red Hat Enterprise Linux-9", "Host/OS/Ubuntu Linux-22.04", "Host/OS/Ubuntu Linux-24.04", "Host/OS/Ubuntu Linux-26.04");
exit(0);
}
if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/CentOS/rpm-list")) && empty_or_null(get_one_kb_item("Host/Debian/dpkg-l")) && empty_or_null(get_one_kb_item("Host/RedHat/rpm-list"))) audit(AUDIT_PACKAGE_LIST_MISSING);
include('linux_unpatched.inc');
var distro_constraints_array = {
"Debian Linux-12": {
"package_manager": "dpkg-l",
"constraints": [
{
"release": "12",
"pkgs": [
{"reference": "thunderbird"},
{"reference": "thunderbird-l10n-af"},
{"reference": "thunderbird-l10n-all"},
{"reference": "thunderbird-l10n-ar"},
{"reference": "thunderbird-l10n-ast"},
{"reference": "thunderbird-l10n-be"},
{"reference": "thunderbird-l10n-bg"},
{"reference": "thunderbird-l10n-br"},
{"reference": "thunderbird-l10n-ca"},
{"reference": "thunderbird-l10n-cak"},
{"reference": "thunderbird-l10n-cs"},
{"reference": "thunderbird-l10n-cy"},
{"reference": "thunderbird-l10n-da"},
{"reference": "thunderbird-l10n-de"},
{"reference": "thunderbird-l10n-dsb"},
{"reference": "thunderbird-l10n-el"},
{"reference": "thunderbird-l10n-en-ca"},
{"reference": "thunderbird-l10n-en-gb"},
{"reference": "thunderbird-l10n-es-ar"},
{"reference": "thunderbird-l10n-es-es"},
{"reference": "thunderbird-l10n-es-mx"},
{"reference": "thunderbird-l10n-et"},
{"reference": "thunderbird-l10n-eu"},
{"reference": "thunderbird-l10n-fi"},
{"reference": "thunderbird-l10n-fr"},
{"reference": "thunderbird-l10n-fy-nl"},
{"reference": "thunderbird-l10n-ga-ie"},
{"reference": "thunderbird-l10n-gd"},
{"reference": "thunderbird-l10n-gl"},
{"reference": "thunderbird-l10n-he"},
{"reference": "thunderbird-l10n-hr"},
{"reference": "thunderbird-l10n-hsb"},
{"reference": "thunderbird-l10n-hu"},
{"reference": "thunderbird-l10n-hy-am"},
{"reference": "thunderbird-l10n-id"},
{"reference": "thunderbird-l10n-is"},
{"reference": "thunderbird-l10n-it"},
{"reference": "thunderbird-l10n-ja"},
{"reference": "thunderbird-l10n-ka"},
{"reference": "thunderbird-l10n-kab"},
{"reference": "thunderbird-l10n-kk"},
{"reference": "thunderbird-l10n-ko"},
{"reference": "thunderbird-l10n-lt"},
{"reference": "thunderbird-l10n-lv"},
{"reference": "thunderbird-l10n-ms"}
]
}
]
},
"Debian Linux-13": {
"package_manager": "dpkg-l",
"constraints": [
{
"release": "13",
"pkgs": [
{"reference": "thunderbird"},
{"reference": "thunderbird-l10n-af"},
{"reference": "thunderbird-l10n-all"},
{"reference": "thunderbird-l10n-ar"},
{"reference": "thunderbird-l10n-ast"},
{"reference": "thunderbird-l10n-be"},
{"reference": "thunderbird-l10n-bg"},
{"reference": "thunderbird-l10n-br"},
{"reference": "thunderbird-l10n-ca"},
{"reference": "thunderbird-l10n-cak"},
{"reference": "thunderbird-l10n-cs"},
{"reference": "thunderbird-l10n-cy"},
{"reference": "thunderbird-l10n-da"},
{"reference": "thunderbird-l10n-de"},
{"reference": "thunderbird-l10n-dsb"},
{"reference": "thunderbird-l10n-el"},
{"reference": "thunderbird-l10n-en-ca"},
{"reference": "thunderbird-l10n-en-gb"},
{"reference": "thunderbird-l10n-es-ar"},
{"reference": "thunderbird-l10n-es-es"},
{"reference": "thunderbird-l10n-es-mx"},
{"reference": "thunderbird-l10n-et"},
{"reference": "thunderbird-l10n-eu"},
{"reference": "thunderbird-l10n-fi"},
{"reference": "thunderbird-l10n-fr"},
{"reference": "thunderbird-l10n-fy-nl"},
{"reference": "thunderbird-l10n-ga-ie"},
{"reference": "thunderbird-l10n-gd"},
{"reference": "thunderbird-l10n-gl"},
{"reference": "thunderbird-l10n-he"},
{"reference": "thunderbird-l10n-hr"},
{"reference": "thunderbird-l10n-hsb"},
{"reference": "thunderbird-l10n-hu"},
{"reference": "thunderbird-l10n-hy-am"},
{"reference": "thunderbird-l10n-id"},
{"reference": "thunderbird-l10n-is"},
{"reference": "thunderbird-l10n-it"},
{"reference": "thunderbird-l10n-ja"},
{"reference": "thunderbird-l10n-ka"},
{"reference": "thunderbird-l10n-kab"},
{"reference": "thunderbird-l10n-kk"},
{"reference": "thunderbird-l10n-ko"},
{"reference": "thunderbird-l10n-lt"},
{"reference": "thunderbird-l10n-lv"},
{"reference": "thunderbird-l10n-ms"}
]
}
]
},
"Debian Linux-14": {
"package_manager": "dpkg-l",
"constraints": [
{
"release": "14",
"pkgs": [
{"reference": "thunderbird"},
{"reference": "thunderbird-l10n-af"},
{"reference": "thunderbird-l10n-all"},
{"reference": "thunderbird-l10n-ar"},
{"reference": "thunderbird-l10n-ast"},
{"reference": "thunderbird-l10n-be"},
{"reference": "thunderbird-l10n-bg"},
{"reference": "thunderbird-l10n-br"},
{"reference": "thunderbird-l10n-ca"},
{"reference": "thunderbird-l10n-cak"},
{"reference": "thunderbird-l10n-cs"},
{"reference": "thunderbird-l10n-cy"},
{"reference": "thunderbird-l10n-da"},
{"reference": "thunderbird-l10n-de"},
{"reference": "thunderbird-l10n-dsb"},
{"reference": "thunderbird-l10n-el"},
{"reference": "thunderbird-l10n-en-ca"},
{"reference": "thunderbird-l10n-en-gb"},
{"reference": "thunderbird-l10n-es-ar"},
{"reference": "thunderbird-l10n-es-es"},
{"reference": "thunderbird-l10n-es-mx"},
{"reference": "thunderbird-l10n-et"},
{"reference": "thunderbird-l10n-eu"},
{"reference": "thunderbird-l10n-fi"},
{"reference": "thunderbird-l10n-fr"},
{"reference": "thunderbird-l10n-fy-nl"},
{"reference": "thunderbird-l10n-ga-ie"},
{"reference": "thunderbird-l10n-gd"},
{"reference": "thunderbird-l10n-gl"},
{"reference": "thunderbird-l10n-he"},
{"reference": "thunderbird-l10n-hr"},
{"reference": "thunderbird-l10n-hsb"},
{"reference": "thunderbird-l10n-hu"},
{"reference": "thunderbird-l10n-hy-am"},
{"reference": "thunderbird-l10n-id"},
{"reference": "thunderbird-l10n-is"},
{"reference": "thunderbird-l10n-it"},
{"reference": "thunderbird-l10n-ja"},
{"reference": "thunderbird-l10n-ka"},
{"reference": "thunderbird-l10n-kab"},
{"reference": "thunderbird-l10n-kk"},
{"reference": "thunderbird-l10n-ko"},
{"reference": "thunderbird-l10n-lt"},
{"reference": "thunderbird-l10n-lv"},
{"reference": "thunderbird-l10n-ms"}
]
}
]
},
"Ubuntu Linux-22.04": {
"package_manager": "dpkg-l",
"constraints": [
{
"release": "22.04",
"pkgs": [
{"reference": "thunderbird"},
{"reference": "thunderbird-dbg"},
{"reference": "thunderbird-dev"},
{"reference": "thunderbird-gnome-support"},
{"reference": "thunderbird-gnome-support-dbg"},
{"reference": "thunderbird-locale-af"},
{"reference": "thunderbird-locale-ar"},
{"reference": "thunderbird-locale-ast"},
{"reference": "thunderbird-locale-be"},
{"reference": "thunderbird-locale-bg"},
{"reference": "thunderbird-locale-bn"},
{"reference": "thunderbird-locale-bn-bd"},
{"reference": "thunderbird-locale-br"},
{"reference": "thunderbird-locale-ca"},
{"reference": "thunderbird-locale-cak"},
{"reference": "thunderbird-locale-cs"},
{"reference": "thunderbird-locale-cy"},
{"reference": "thunderbird-locale-da"},
{"reference": "thunderbird-locale-de"},
{"reference": "thunderbird-locale-dsb"},
{"reference": "thunderbird-locale-el"},
{"reference": "thunderbird-locale-en-gb"},
{"reference": "thunderbird-locale-en-us"},
{"reference": "thunderbird-locale-es-ar"},
{"reference": "thunderbird-locale-es-es"},
{"reference": "thunderbird-locale-fy-nl"},
{"reference": "thunderbird-locale-ga-ie"},
{"reference": "thunderbird-locale-nb-no"},
{"reference": "thunderbird-locale-nn-no"},
{"reference": "thunderbird-locale-pa-in"},
{"reference": "thunderbird-locale-pt-br"},
{"reference": "thunderbird-locale-pt-pt"},
{"reference": "thunderbird-locale-sv-se"},
{"reference": "thunderbird-locale-ta-lk"},
{"reference": "thunderbird-locale-zh-cn"},
{"reference": "thunderbird-locale-zh-tw"},
{"reference": "thunderbird-mozsymbols"},
{"reference": "xul-ext-calendar-timezones"},
{"reference": "xul-ext-gdata-provider"},
{"reference": "xul-ext-lightning"}
]
}
]
},
"Ubuntu Linux-24.04": {
"package_manager": "dpkg-l",
"constraints": [
{
"release": "24.04",
"pkgs": [
{"reference": "thunderbird"},
{"reference": "thunderbird-locale-af"},
{"reference": "thunderbird-locale-ar"},
{"reference": "thunderbird-locale-ast"},
{"reference": "thunderbird-locale-be"},
{"reference": "thunderbird-locale-bg"},
{"reference": "thunderbird-locale-bn"},
{"reference": "thunderbird-locale-bn-bd"},
{"reference": "thunderbird-locale-br"},
{"reference": "thunderbird-locale-ca"},
{"reference": "thunderbird-locale-cak"},
{"reference": "thunderbird-locale-cs"},
{"reference": "thunderbird-locale-cy"},
{"reference": "thunderbird-locale-da"},
{"reference": "thunderbird-locale-de"},
{"reference": "thunderbird-locale-dsb"},
{"reference": "thunderbird-locale-el"},
{"reference": "thunderbird-locale-en"},
{"reference": "thunderbird-locale-en-gb"},
{"reference": "thunderbird-locale-en-us"},
{"reference": "thunderbird-locale-es"},
{"reference": "thunderbird-locale-es-ar"},
{"reference": "thunderbird-locale-es-es"},
{"reference": "thunderbird-locale-et"},
{"reference": "thunderbird-locale-eu"},
{"reference": "thunderbird-locale-fa"},
{"reference": "thunderbird-locale-fi"},
{"reference": "thunderbird-locale-fr"},
{"reference": "thunderbird-locale-fy"},
{"reference": "thunderbird-locale-fy-nl"},
{"reference": "thunderbird-locale-ga"},
{"reference": "thunderbird-locale-ga-ie"},
{"reference": "thunderbird-locale-gd"},
{"reference": "thunderbird-locale-gl"},
{"reference": "thunderbird-locale-he"},
{"reference": "thunderbird-locale-hr"},
{"reference": "thunderbird-locale-hsb"},
{"reference": "thunderbird-locale-hu"},
{"reference": "thunderbird-locale-hy"},
{"reference": "thunderbird-locale-id"},
{"reference": "thunderbird-locale-is"},
{"reference": "thunderbird-locale-it"}
]
}
]
},
"Ubuntu Linux-26.04": {
"package_manager": "dpkg-l",
"constraints": [
{
"release": "26.04",
"pkgs": [
{"reference": "thunderbird"},
{"reference": "thunderbird-locale-af"},
{"reference": "thunderbird-locale-ar"},
{"reference": "thunderbird-locale-ast"},
{"reference": "thunderbird-locale-be"},
{"reference": "thunderbird-locale-bg"},
{"reference": "thunderbird-locale-bn"},
{"reference": "thunderbird-locale-bn-bd"},
{"reference": "thunderbird-locale-br"},
{"reference": "thunderbird-locale-ca"},
{"reference": "thunderbird-locale-cak"},
{"reference": "thunderbird-locale-cs"},
{"reference": "thunderbird-locale-cy"},
{"reference": "thunderbird-locale-da"},
{"reference": "thunderbird-locale-de"},
{"reference": "thunderbird-locale-dsb"},
{"reference": "thunderbird-locale-el"},
{"reference": "thunderbird-locale-en"},
{"reference": "thunderbird-locale-en-gb"},
{"reference": "thunderbird-locale-en-us"},
{"reference": "thunderbird-locale-es"},
{"reference": "thunderbird-locale-es-ar"},
{"reference": "thunderbird-locale-es-es"},
{"reference": "thunderbird-locale-et"},
{"reference": "thunderbird-locale-eu"},
{"reference": "thunderbird-locale-fa"},
{"reference": "thunderbird-locale-fi"},
{"reference": "thunderbird-locale-fr"},
{"reference": "thunderbird-locale-fy"},
{"reference": "thunderbird-locale-fy-nl"},
{"reference": "thunderbird-locale-ga"},
{"reference": "thunderbird-locale-ga-ie"},
{"reference": "thunderbird-locale-gd"},
{"reference": "thunderbird-locale-gl"},
{"reference": "thunderbird-locale-he"},
{"reference": "thunderbird-locale-hr"},
{"reference": "thunderbird-locale-hsb"},
{"reference": "thunderbird-locale-hu"},
{"reference": "thunderbird-locale-hy"},
{"reference": "thunderbird-locale-id"},
{"reference": "thunderbird-locale-is"},
{"reference": "thunderbird-locale-it"}
]
}
]
},
"CentOS Linux-8": {
"package_manager": "rpm-list",
"constraints": [
{
"release": "8",
"pkgs": [
{"reference": "thunderbird"}
]
}
]
},
"Red Hat Enterprise Linux-10": {
"package_manager": "rpm-list",
"constraints": [
{
"release": "10",
"pkgs": [
{"reference": "thunderbird"}
]
}
]
},
"Red Hat Enterprise Linux-8": {
"package_manager": "rpm-list",
"constraints": [
{
"release": "8",
"pkgs": [
{"reference": "thunderbird"}
]
}
]
},
"Red Hat Enterprise Linux-9": {
"package_manager": "rpm-list",
"constraints": [
{
"release": "9",
"pkgs": [
{"reference": "thunderbird"}
]
}
]
}
};
var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');
var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
var third_party_vendors = distro_constraints_values['third_party'];
if (!empty_or_null(third_party_vendors)) {
var vendor;
foreach vendor (third_party_vendors) {
if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
}
}
}
var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);
if (!empty_or_null(report))
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : report
);
exit(0);
}
else
{
audit(AUDIT_HOST_NOT, 'affected');
}
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 Oct 2026 00:00Current
6.1Medium risk
Vulners AI Score6.1
EPSS0.00425