Summary
This host is installed with Mozilla Thunderbird ESR and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow attackers to execute arbitrary code, obtain potentially sensitive information, gain escalated privileges, bypass security restrictions, and perform unauthorized actions. Other attacks may also be possible.
Impact Level: Application
Solution
Upgrade to Thunderbird ESR 17.0.7 or later,
http://www.mozilla.org/en-US/thunderbird
Insight
Multiple flaws due to,
- PreserveWrapper does not handle lack of wrapper.
- Error in processing of SVG format images with filters to read pixel values.
- Does not prevent inclusion of body data in XMLHttpRequest HEAD request.
- Multiple unspecified vulnerabilities in the browser engine.
- Does not properly handle onreadystatechange events in conjunction with page reloading.
- System Only Wrapper (SOW) and Chrome Object Wrapper (COW), does not restrict XBL user-defined functions.
- Use-after-free vulnerability in 'nsIDocument::GetRootElement' and 'mozilla::dom::HTMLMediaElement::LookupMediaElementURITable' functions.
- XrayWrapper does not properly restrict use of DefaultValue for method calls.
Affected
Thunderbird ESR version 17.x before 17.0.7 on Mac OS X
References
Severity
Classification
-
CVE CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690, CVE-2013-1692, CVE-2013-1693, CVE-2013-1694, CVE-2013-1697 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Adobe AIR Multiple Vulnerabilities-01 Jun14 (Windows)
- Adobe Flash Player 'SWF' File Multiple Code Execution Vulnerability - Mac OS X
- Adobe Air Multiple Vulnerabilities -01 May 13 (Mac OS X)
- Adobe AIR Multiple Vulnerabilities-01 Dec13 (Windows)
- Aastra IP Telephone Hardcoded Telnet Password Security Bypass Vulnerability