Several flaws were discovered in the browser engine. If a user had JavaScript enabled, these problems could allow an attacker to crash Thunderbird and possibly execute arbitrary code with user privileges.
(CVE-2008-5500)

Boris Zbarsky discovered that the same-origin check in Thunderbird could be bypassed by utilizing XBL-bindings. If a user had JavaScript enabled, an attacker could exploit this to read data from other domains. (CVE-2008-5503)

Marius Schilder discovered that Thunderbird did not properly handle redirects to an outside domain when an XMLHttpRequest was made to a same-origin resource. When JavaScript is enabled, it's possible that sensitive information could be revealed in the XMLHttpRequest response. (CVE-2008-5506)

Chris Evans discovered that Thunderbird did not properly protect a user's data when accessing a same-domain JavaScript URL that is redirected to an unparsable JavaScript off-site resource. If a user were tricked into opening a malicious website and had JavaScript enabled, an attacker may be able to steal a limited amount of private data. (CVE-2008-5507)

Chip Salzenberg, Justin Schuh, Tom Cross, and Peter William discovered Thunderbird did not properly parse URLs when processing certain control characters. (CVE-2008-5508)

Several flaws were discovered in the JavaScript engine. If a user were tricked into opening a malicious website and had JavaScript enabled, an attacker could exploit this to execute arbitrary JavaScript code within the context of another website or with chrome privileges.
(CVE-2008-5511, CVE-2008-5512).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2008:1036 :

An updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-5500, CVE-2008-5501, CVE-2008-5502, CVE-2008-5511, CVE-2008-5512, CVE-2008-5513)

Several flaws were found in the way malformed content was processed. A website containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-5506, CVE-2008-5507)

A flaw was found in the way Firefox stored attributes in XML User Interface Language (XUL) elements. A website could use this flaw to track users across browser sessions, even if users did not allow the site to store cookies in the victim's browser. (CVE-2008-5505)

A flaw was found in the way malformed URLs were processed by Firefox.
This flaw could prevent various URL sanitization mechanisms from properly parsing a malicious URL. (CVE-2008-5508)

A flaw was found in Firefox's CSS parser. A malicious web page could inject NULL characters into a CSS input string, possibly bypassing an application's script sanitization routines. (CVE-2008-5510)

For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.5. You can find a link to the Mozilla advisories in the References section.

Note: after the errata packages are installed, Firefox must be restarted for the update to take effect.

All firefox users should upgrade to these updated packages, which contain backported patches that correct these issues.

From Red Hat Security Advisory 2009:0002 :

Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-5500, CVE-2008-5501, CVE-2008-5502, CVE-2008-5511, CVE-2008-5512, CVE-2008-5513)

Several flaws were found in the way malformed content was processed.
An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-5503, CVE-2008-5506, CVE-2008-5507)

Note: JavaScript support is disabled by default in Thunderbird; the above issues are not exploitable unless JavaScript is enabled.

A flaw was found in the way malformed URLs were processed by Thunderbird. This flaw could prevent various URL sanitization mechanisms from properly parsing a malicious URL. (CVE-2008-5508)

All Thunderbird users should upgrade to these updated packages, which resolve these issues. All running instances of Thunderbird must be restarted for the update to take effect.

Versions of Mozilla Thunderbird prior to 2.0.0.19 are affected by the following vulnerabilities :

 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-60)
 - XBL bindings can be used to read data from other domains. (MFSA 2008-61)
 - Sensitive data may be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)
 - A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL that redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)
 - Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)
 - An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)
 - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)

Versions of Firefox 3.x prior to 3.0.5 are affected by the following security issues : 

 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-60)
 - XBL bindings can be used to read data from other domains. (MFSA 2008-61)
 - The feed preview still allows for JavaScript privilege escalation. (MFSA 2008-62)
 - Sensitive data may be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)
 - A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL which redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)
 - Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)
 - An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)
 - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)
 - XSS vulnerabilities in SessionStore may allow for violating the browser's same-origin policy and performing an XSS attack or running arbitrary JavaScript with chrome privileges. (MFSA 2008-69)
 - A denial of service issue when the application handles a maliciously crafted webpage containing a 'HTMLSelectElement' object with a large length attribute.

The installed version of Firefox is earlier than 2.0.0.19.  Such versions are potentially affected by the following security issues : 

 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-60)
 - XBL bindings can be used to read data from other domains. (MFSA 2008-61)
 - The feed preview still allows for JavaScript privilege escalation. (MFSA 2008-62)
 - Sensitive data may be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)
 - A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL which redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)
 - Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)
 - An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)
 - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)
 - XSS vulnerabilities in SessionStore may allow for violating the browser's same-origin policy and performing an XSS attack or running arbitrary JavaScript with chrome privileges. (MFSA 2008-69) Note that Mozilla is not planning further security / stability updates for Firefox 2.x.
  - A denial of service issue when the application handles a maliciously crafted webpage containing a 'HTMLSelectElement' object with a large length attribute.

The installed version of SeaMonkey is earlier than 1.1.14.  Such versions are potentially affected by the following security issues : 

  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-60)

  - XBL bindings can be used to read data from other domains. (MFSA 2008-61)

  - The feed preview still allows for JavaScript privilege escalation. (MFSA 2008-62)

  - Sensitive data may be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)

  - A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL which redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)

  - Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)

  - An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)

  - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)

  - XSS vulnerabilities in SessionStore may allow for violating the browser's same-origin policy and performing an XSS attack or running arbitrary JavaScript with chrome privileges. (MFSA 2008-69)

The installed version of Thunderbird is earlier than 2.0.0.19.  Such versions are potentially affected by the following security issues : 

  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-60)

  - XBL bindings can be used to read data from other domains. (MFSA 2008-61)

  - Sensitive data may be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)

  - A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL that redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)

  - Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)

  - An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)

  - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)

The installed version of Firefox 3.0 is earlier than 3.0.5.  Such versions are potentially affected by the following security issues : 

  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-60)

  - XBL bindings can be used to read data from other domains. (MFSA 2008-61)

  - The feed preview still allows for JavaScript privilege escalation. (MFSA 2008-62)

  - Sensitive data may be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)

  - A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL which redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)

  - Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)

  - An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)

  - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)

  - XSS vulnerabilities in SessionStore may allow for violating the browser's same-origin policy and performing an XSS attack or running arbitrary JavaScript with chrome privileges. (MFSA 2008-69)

  - A denial of service issue when the application handles a maliciously crafted webpage containing a 'HTMLSelectElement' object with a large length attribute.

The installed version of Firefox is earlier than 2.0.0.19.  Such versions are potentially affected by the following security issues : 

  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-60)

  - XBL bindings can be used to read data from other domains. (MFSA 2008-61)

  - The feed preview still allows for JavaScript privilege escalation. (MFSA 2008-62)

  - Sensitive data may be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)

  - A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL which redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)

  - Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)

  - An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)

  - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)

  - XSS vulnerabilities in SessionStore may allow for violating the browser's same-origin policy and performing an XSS attack or running arbitrary JavaScript with chrome privileges. (MFSA 2008-69)

Note that Mozilla is not planning further security / stability updates for Firefox 2.x.

  - A denial of service issue when the application handles a maliciously crafted webpage containing a 'HTMLSelectElement' object with a large length attribute.

ID	Name	Product	Family	Published	Updated	Severity
65112	Ubuntu 6.06 LTS : mozilla-thunderbird vulnerabilities (USN-701-2)	Nessus	Ubuntu Local Security Checks	3/9/2013	1/19/2021	critical
67777	Oracle Linux 4 / 5 : firefox (ELSA-2008-1036)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	critical
67781	Oracle Linux 4 : thunderbird (ELSA-2009-0002)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	critical
4806	Mozilla Thunderbird < 2.0.0.19 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	1/6/2009	3/6/2019	medium
4793	Mozilla Firefox 3.x < 3.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	12/17/2008	3/6/2019	medium
4792	Mozilla Firefox < 2.0.0.19 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	12/17/2008	3/6/2019	medium
4794	SeaMonkey < 1.1.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	12/17/2008	3/6/2019	medium
801218	Mozilla Thunderbird < 2.0.0.19 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients			high
800776	Firefox < 3.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high
800754	Firefox < 2.0.0.19 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high
800883	SeaMonkey < 1.1.14 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high

Detections

Analytics

Plugins Search

critical

critical

critical

medium

medium

medium

medium

high

high

high

high