From Red Hat Security Advisory 2008:0209 :

Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237)

Several flaws were found in the display of malformed web content. An HTML mail message containing specially crafted content could, potentially, trick a user into surrendering sensitive information.
(CVE-2008-1234, CVE-2008-1238, CVE-2008-1241)

Note: JavaScript support is disabled by default in Thunderbird; the above issues are not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which contain backported patches to resolve these issues.

The installed version of Thunderbird is affected by various security issues :

  - A series of vulnerabilities exist that allow for     JavaScript privilege escalation and arbitrary code     execution.

  - Several stability bugs exist leading to crashes which,     in some cases, show traces of memory corruption.

# This shares a lot of text with dsa-1532.wml, dsa-1534.wml, dsa-1535.wml

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1233     'moz_bug_r_a4' discovered that variants of CVE-2007-3738     and CVE-2007-5338 allow the execution of arbitrary code     through XPCNativeWrapper.

  - CVE-2008-1234     'moz_bug_r_a4' discovered that insecure handling of     event handlers could lead to cross-site scripting.

  - CVE-2008-1235     Boris Zbarsky, Johnny Stenback and 'moz_bug_r_a4'     discovered that incorrect principal handling could lead     to cross-site scripting and the execution of arbitrary     code.

  - CVE-2008-1236     Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett     and Mats Palmgren discovered crashes in the layout     engine, which might allow the execution of arbitrary     code.

  - CVE-2008-1237     'georgi', 'tgirmann' and Igor Bukanov discovered crashes     in the JavaScript engine, which might allow the     execution of arbitrary code.

Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237)

Several flaws were found in the display of malformed web content. An HTML mail message containing specially crafted content could, potentially, trick a user into surrendering sensitive information.
(CVE-2008-1234, CVE-2008-1238, CVE-2008-1241)

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several flaws were found in the processing of some malformed web content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237)

Several flaws were found in the display of malformed web content. A web page containing specially crafted content could, potentially, trick a Firefox user into surrendering sensitive information.
(CVE-2008-1234, CVE-2008-1238, CVE-2008-1241)

All Firefox users should upgrade to these updated packages, which contain backported patches that correct these issues.

Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu discovered flaws in Firefox's character encoding handling. If a user were tricked into opening a malicious web page, an attacker could perform cross-site scripting attacks. (CVE-2008-0416)

Various flaws were discovered in the JavaScript engine. By tricking a user into opening a malicious web page, an attacker could escalate privileges within the browser, perform cross-site scripting attacks and/or execute arbitrary code with the user's privileges.
(CVE-2008-1233, CVE-2008-1234, CVE-2008-1235)

Several problems were discovered in Firefox which could lead to crashes and memory corruption. If a user were tricked into opening a malicious web page, an attacker may be able to execute arbitrary code with the user's privileges. (CVE-2008-1236, CVE-2008-1237)

Gregory Fleischer discovered Firefox did not properly process HTTP Referrer headers when they were sent with with requests to URLs containing Basic Authentication credentials with empty usernames. An attacker could exploit this vulnerability to perform cross-site request forgery attacks. (CVE-2008-1238)

Peter Brodersen and Alexander Klink reported that default the setting in Firefox for SSL Client Authentication allowed for users to be tracked via their client certificate. The default has been changed to prompt the user each time a website requests a client certificate.
(CVE-2007-4879)

Gregory Fleischer discovered that web content fetched via the jar protocol could use Java LiveConnect to connect to arbitrary ports on the user's machine due to improper parsing in the Java plugin. If a user were tricked into opening malicious web content, an attacker may be able to access services running on the user's machine.
(CVE-2008-1195, CVE-2008-1240)

Chris Thomas discovered that Firefox would allow an XUL popup from an unselected tab to display in front of the selected tab. An attacker could exploit this behavior to spoof a login prompt and steal the user's credentials. (CVE-2008-1241).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings Mozilla Firefox to security update version 2.0.0.13

Following security problems were fixed :

  - XUL popup spoofing variant (cross-tab popups). (MFSA     2008-19 / CVE-2008-1241)

  - Java socket connection to any local port via     LiveConnect. (MFSA 2008-18 / CVE-2008-1195 /     CVE-2008-1240)

  - Privacy issue with SSL Client Authentication. (MFSA     2008-17 / CVE-2007-4879)

  - HTTP Referrer spoofing with malformed URLs. (MFSA     2008-16 / CVE-2008-1238)

  - Crashes with evidence of memory corruption     (rv:1.8.1.13). (MFSA 2008-15 / CVE-2008-1236 /     CVE-2008-1237)

  - JavaScript privilege escalation and arbitrary code     execution. (MFSA 2008-14 / CVE-2008-1233 / CVE-2008-1234     / CVE-2008-1235)

# This shares a lot of text with dsa-1532.wml, dsa-1534.wml, dsa-1574.wml

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-4879     Peter Brodersen and Alexander Klink discovered that the     autoselection of SSL client certificates could lead to     users being tracked, resulting in a loss of privacy.

  - CVE-2008-1233     'moz_bug_r_a4' discovered that variants of CVE-2007-3738     and CVE-2007-5338 allow the execution of arbitrary code     through XPCNativeWrapper.

  - CVE-2008-1234     'moz_bug_r_a4' discovered that insecure handling of     event handlers could lead to cross-site scripting.

  - CVE-2008-1235     Boris Zbarsky, Johnny Stenback and 'moz_bug_r_a4'     discovered that incorrect principal handling could lead     to cross-site scripting and the execution of arbitrary     code.

  - CVE-2008-1236     Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett     and Mats Palmgren discovered crashes in the layout     engine, which might allow the execution of arbitrary     code.

  - CVE-2008-1237     'georgi', 'tgirmann' and Igor Bukanov discovered crashes     in the JavaScript engine, which might allow the     execution of arbitrary code.

  - CVE-2008-1238     Gregory Fleischer discovered that HTTP Referrer headers     were handled incorrectly in combination with URLs     containing Basic Authentication credentials with empty     usernames, resulting in potential Cross-Site Request     Forgery attacks.

  - CVE-2008-1240     Gregory Fleischer discovered that web content fetched     through the jar: protocol can use Java to connect to     arbitrary ports. This is only an issue in combination     with the non-free Java plugin.

  - CVE-2008-1241     Chris Thomas discovered that background tabs could     generate XUL popups overlaying the current tab,     resulting in potential spoofing attacks.

The Mozilla products from the old stable distribution (sarge) are no longer supported.

Versions of Mozilla Thunderbird prior to 2.0.0.14 are affected by various security issues :

 - A series of vulnerabilities that allow for JavaScript privilege escalation and arbitrary code execution.
 - Several stability bugs leading to crashes that, in some cases, show traces of memory corruption.

The installed version of SeaMonkey is affected by various security issues :
 - A series of vulnerabilities that allow for JavaScript privilege escalation and arbitrary code execution.
 - Several stability bugs leading to crashes that, in some cases, show traces of memory corruption.
 - An HTTP Referer spoofing issue with malformed URLs.
 - A privacy issue with SSL client authentication.
 - Web content fetched via the 'jar:' protocol can use Java via LiveConnect to open socket connections to arbitrary ports on the localhost.
 - It is possible to have a background tab create a borderless XUL pop-up in front of the active tab in the user's browser.

The installed version of Thunderbird is missing a critical patch.  The vendor has released a patch that addresses a number of remote vulnerabilities. 

The installed version of Firefox is affected by various security issues :

 - A series of vulnerabilities that allow for JavaScript privilege escalation and arbitrary code execution.
 - Several stability bugs leading to crashes that, in some cases, show traces of memory corruption.
 - An HTTP Referer spoofing issue with malformed URLs.
 - A privacy issue with SSL client authentication.
 - Web content fetched via the 'jar:' protocol can use Java via LiveConnect to open socket connections to arbitrary ports on the localhost.
 - It is possible to have a background tab create a borderless XUL pop-up in front of the active tab in the user's browser.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
67677	Oracle Linux 4 : thunderbird (ELSA-2008-0209)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
32134	Mozilla Thunderbird < 2.0.0.14 Multiple Vulnerabilities	Nessus	Windows	2008/5/6	2018/8/10	high
32308	Debian DSA-1574-1 : icedove - several vulnerabilities	Nessus	Debian Local Security Checks	2008/5/13	2021/1/4	high
60380	Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
31694	RHEL 4 / 5 : firefox (RHSA-2008:0207)	Nessus	Red Hat Local Security Checks	2008/3/28	2021/1/14	high
31700	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : firefox vulnerabilities (USN-592-1)	Nessus	Ubuntu Local Security Checks	2008/3/28	2021/1/19	high
31722	SuSE 10 Security Update : Security update for (ZYPP Patch Number 5134)	Nessus	SuSE Local Security Checks	2008/4/1	2021/1/14	high
31806	Debian DSA-1535-1 : iceweasel - several vulnerabilities	Nessus	Debian Local Security Checks	2008/4/11	2021/1/4	high
4497	Mozilla Thunderbird < 2.0.0.14 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2008/5/6	2019/3/6	high
4448	SeaMonkey < 1.1.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2008/3/26	2019/3/6	medium
4446	Mozilla Thunderbird < 2.0.0.13 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2008/3/26	2019/3/6	high
4447	Mozilla Firefox < 2.0.0.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2008/3/26	2019/3/6	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

medium

high

high