CVE-2022-3155

CVE-2022-3155 affects Mozilla Thunderbird and is described as: when saving or opening a mail attachment on macOS, Thunderbird failed to set the com.apple.quarantine attribute on the received file. If the file was an application, opening it could launch the application immediately without user con...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2022:3800-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3800-1 advisory. - Mozilla Thunderbird 102.4.0 bsc1204421 changed: Thunderbird will automatically detect and repa...

Security fix for the ALT Linux 10 package thunderbird version 102.3.0-alt1

Oct. 9, 2022 Pavel Vasenkov 102.3.0-alt1 - New version. - Security fixes: + CVE-2022-3266 Out of bounds read when decoding H264 + CVE-2022-40959 Bypassing FeaturePolicy restrictions on transient pages + CVE-2022-40960 Data-race when parsing non-UTF-8 URLs in threads + CVE-2022-40958 Bypassing...

Mozilla Thunderbird < 102.3

The version of Thunderbird installed on the remote Windows host is prior to 102.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-42 advisory. - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team...

USN-5292-4 snapd regression

USN-5292-1 fixed a vulnerability in snapd. Unfortunately that update introduced a regression that could break the fish shell. This update fixes the problem. We apologize for the inconvenience. Original advisory details: James Troup discovered that snap did not properly manage the permissions for...

USN-5292-4: snapd regression

USN-5292-1 fixed a vulnerability in snapd. Unfortunately that update introduced a regression that could break the fish shell. This update fixes the problem. We apologize for the inconvenience. Original advisory details: James Troup discovered that snap did not properly manage the permissions for...

Ubuntu: Security Advisory (USN-5292-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-5292-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 ESM : snapd vulnerabilities (USN-5292-3)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5292-3 advisory. USN-5292-1 fixed several vulnerabilities in snapd. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has...

Ubuntu 20.04 LTS : snapd vulnerabilities (USN-5292-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5292-2 advisory. USN-5292-1 fixed vulnerabilities in snapd. This update provides the corresponding update for the riscv64 architecture. Tenable has extracted the precedin...

DEBIAN-CVE-2021-3155

snapd 2.54.2 and earlier created /snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1...

CVE-2021-3155 snapd created ~/snap with too-wide permissions

snapd 2.54.2 and earlier created /snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1...

CVE-2021-3155

snapd 2.54.2 and earlier created /snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1...

CVE-2021-3155

CVE-2021-3155 affects snapd up to 2.54.2, where ~/snap directories in users’ home were created with insufficient owner-only permissions, potentially allowing a local attacker to read private data. Fixes are in snapd 2.54.3+18.04, 2.54.3+20.04, and 2.54.3+21.10.1. No exploitation details are provi...

USN-5292-1: snapd vulnerabilities

James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly use this issue to expose sensitive information. CVE-2021-3155 Ian Johnson discovered that snapd did not properly validate content interfaces and layout paths. A local...

Oracle Linux 8 : thunderbird (ELSA-2021-3155)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-3155 advisory. 78.13.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 78.13.0-1 - Update to 78.13.0 build1 Tenable has...

RHEL 8 : thunderbird (RHSA-2021:3155)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3155 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.13.0. Security Fixes: Mozilla:...

CentOS 8 : thunderbird (CESA-2021:3155)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:3155 advisory. - Mozilla: Uninitialized memory in a canvas object could have led to memory corruption CVE-2021-29980 - Mozilla: Incorrect instruction reordering durin...

SUSE: Security Advisory (SUSE-SU-2017:3155-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-3155

CVE-2020-3155 is a Cisco Intelligent Proximity SSL certificate validation vulnerability. The issue stems from a lack of validation of the SSL server certificate when establishing connections to Cisco Webex video devices or Cisco collaboration endpoints. An unauthenticated, remote attacker could p...