Debian DSA-4959-1:thunderbird - 安全性更新

high Nessus Plugin ID 152568

概要

遠端 Debian 主機上缺少一個或多個安全性更新。

說明

遠端 Debian 11 主機上安裝的套件受 dsa-4959 公告中提及的多個弱點影響。

- Mozilla 開發人員報告,Firefox 90 和 Firefox ESR 78.12 中存在記憶體安全性錯誤。某些錯誤顯示記憶體會遭到損毀,我們推測若有心人士有意操控,可能惡意利用其中部分錯誤執行任意程式碼。此弱點會影響 Thunderbird < 78.13、Firefox ESR < 78.13 和 Firefox < 91。(CVE-2021-29989)

- 指令重新排序會產生一系列指令,造成程式在記憶體回收期間錯誤考量物件。此問題可導致記憶體損毀,並造成可能遭利用的當機。
此弱點會影響 Thunderbird < 78.13、Thunderbird < 91、Firefox ESR < 78.13 和 Firefox < 91。
(CVE-2021-29984)

- 媒體通道中存在釋放後使用弱點,可導致記憶體損毀,並造成可能遭利用的當機。此弱點會影響 Thunderbird < 78.13、Thunderbird < 91、Firefox ESR < 78.13 和 Firefox < 91。(CVE-2021-29985)

- 呼叫 getaddrinfo 時疑似會發生爭用情形,這可導致記憶體損毀,並且可能造成可遭惡意利用的當機。*請注意:此問題僅影響 Linux 作業系統。其他作業系統不受影響。* 此弱點會影響 Thunderbird < 78.13、Thunderbird < 91、Firefox ESR < 78.13 和 Firefox < 91。
(CVE-2021-29986)

- Firefox 會將內嵌 list-item 元素錯誤視為區塊元素,導致超出邊界讀取或記憶體損毀,並且可能造成可遭惡意利用的當機。此弱點會影響 Thunderbird < 78.13、Thunderbird < 91、Firefox ESR < 78.13 和 Firefox < 91。(CVE-2021-29988)

請注意,Nessus 並未測試此問題,而是僅依據應用程式自我報告的版本號碼。

解決方案

升級 thunderbird 套件。

針對穩定的發行版本 (bullseye),這些問題已在版本 1 中修正

另請參閱

https://security-tracker.debian.org/tracker/source-package/thunderbird

https://www.debian.org/security/2021/dsa-4959

https://security-tracker.debian.org/tracker/CVE-2021-29980

https://security-tracker.debian.org/tracker/CVE-2021-29984

https://security-tracker.debian.org/tracker/CVE-2021-29985

https://security-tracker.debian.org/tracker/CVE-2021-29986

https://security-tracker.debian.org/tracker/CVE-2021-29988

https://security-tracker.debian.org/tracker/CVE-2021-29989

https://packages.debian.org/source/bullseye/thunderbird

Plugin 詳細資訊

嚴重性: High

ID: 152568

檔案名稱: debian_DSA-4959.nasl

版本: 1.6

類型: local

代理程式: unix

已發布: 2021/8/15

已更新: 2023/12/4

支援的感應器: Agentless Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

風險資訊

VPR

風險因素: Medium

分數: 6.7

CVSS v2

風險因素: Medium

基本分數: 6.8

時間分數: 5.3

媒介: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS 評分資料來源: CVE-2021-29989

CVSS v3

風險因素: High

基本分數: 8.8

時間分數: 7.9

媒介: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

時間媒介: CVSS:3.0/E:P/RL:O/RC:C

弱點資訊

CPE: p-cpe:/a:debian:debian_linux:lightning, p-cpe:/a:debian:debian_linux:thunderbird, p-cpe:/a:debian:debian_linux:thunderbird-l10n-all, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ar, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ast, p-cpe:/a:debian:debian_linux:thunderbird-l10n-be, p-cpe:/a:debian:debian_linux:thunderbird-l10n-bg, p-cpe:/a:debian:debian_linux:thunderbird-l10n-br, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ca, p-cpe:/a:debian:debian_linux:thunderbird-l10n-cak, p-cpe:/a:debian:debian_linux:thunderbird-l10n-cs, p-cpe:/a:debian:debian_linux:thunderbird-l10n-cy, p-cpe:/a:debian:debian_linux:thunderbird-l10n-da, p-cpe:/a:debian:debian_linux:thunderbird-l10n-de, p-cpe:/a:debian:debian_linux:thunderbird-l10n-dsb, p-cpe:/a:debian:debian_linux:thunderbird-l10n-el, p-cpe:/a:debian:debian_linux:thunderbird-l10n-en-gb, p-cpe:/a:debian:debian_linux:thunderbird-l10n-es-ar, p-cpe:/a:debian:debian_linux:thunderbird-l10n-es-es, p-cpe:/a:debian:debian_linux:thunderbird-l10n-et, p-cpe:/a:debian:debian_linux:thunderbird-l10n-eu, p-cpe:/a:debian:debian_linux:thunderbird-l10n-fi, p-cpe:/a:debian:debian_linux:thunderbird-l10n-fr, p-cpe:/a:debian:debian_linux:thunderbird-l10n-fy-nl, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ga-ie, p-cpe:/a:debian:debian_linux:thunderbird-l10n-gd, p-cpe:/a:debian:debian_linux:thunderbird-l10n-gl, p-cpe:/a:debian:debian_linux:thunderbird-l10n-he, p-cpe:/a:debian:debian_linux:thunderbird-l10n-hr, p-cpe:/a:debian:debian_linux:thunderbird-l10n-hsb, p-cpe:/a:debian:debian_linux:thunderbird-l10n-hu, p-cpe:/a:debian:debian_linux:thunderbird-l10n-hy-am, p-cpe:/a:debian:debian_linux:thunderbird-l10n-id, p-cpe:/a:debian:debian_linux:thunderbird-l10n-is, p-cpe:/a:debian:debian_linux:thunderbird-l10n-it, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ja, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ka, p-cpe:/a:debian:debian_linux:thunderbird-l10n-kab, p-cpe:/a:debian:debian_linux:thunderbird-l10n-kk, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ko, p-cpe:/a:debian:debian_linux:thunderbird-l10n-lt, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ms, p-cpe:/a:debian:debian_linux:thunderbird-l10n-nb-no, p-cpe:/a:debian:debian_linux:thunderbird-l10n-nl, p-cpe:/a:debian:debian_linux:thunderbird-l10n-nn-no, p-cpe:/a:debian:debian_linux:thunderbird-l10n-pl, p-cpe:/a:debian:debian_linux:thunderbird-l10n-pt-br, p-cpe:/a:debian:debian_linux:thunderbird-l10n-pt-pt, p-cpe:/a:debian:debian_linux:thunderbird-l10n-rm, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ro, p-cpe:/a:debian:debian_linux:thunderbird-l10n-ru, p-cpe:/a:debian:debian_linux:thunderbird-l10n-si, p-cpe:/a:debian:debian_linux:thunderbird-l10n-sk, p-cpe:/a:debian:debian_linux:thunderbird-l10n-sl, p-cpe:/a:debian:debian_linux:thunderbird-l10n-sq, p-cpe:/a:debian:debian_linux:thunderbird-l10n-sr, p-cpe:/a:debian:debian_linux:thunderbird-l10n-sv-se, p-cpe:/a:debian:debian_linux:thunderbird-l10n-tr, p-cpe:/a:debian:debian_linux:thunderbird-l10n-uk, p-cpe:/a:debian:debian_linux:thunderbird-l10n-uz, p-cpe:/a:debian:debian_linux:thunderbird-l10n-vi, p-cpe:/a:debian:debian_linux:thunderbird-l10n-zh-cn, p-cpe:/a:debian:debian_linux:thunderbird-l10n-zh-tw, cpe:/o:debian:debian_linux:11.0

必要的 KB 項目: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

可被惡意程式利用: true

可輕鬆利用: Exploits are available

修補程式發佈日期: 2021/8/15

弱點發布日期: 2021/8/10

參考資訊

CVE: CVE-2021-29980, CVE-2021-29984, CVE-2021-29985, CVE-2021-29986, CVE-2021-29988, CVE-2021-29989

IAVA: 2021-A-0366-S