The installed version of Thunderbird is earlier than 2.0.0.18.  Such versions are potentially affected by the following security issues :

  - The canvas element can be used in conjunction with an     HTTP redirect to bypass same-origin restrictions and     gain access to the content in arbitrary images from     other domains. (MFSA 2008-48)

  - By tampering with the window.__proto__.__proto__ object,     one can cause the browser to place a lock on a non-     native object, leading to a crash and possible code     execution. (MFSA 2008-50)

  - There are several stability bugs in the browser engine     that could lead to crashes with evidence of memory     corruption. (MFSA 2008-52)

  - Crashes and remote code execution in nsFrameManager are     possible by modifying certain properties of a file     input element before it has finished initializing.
    (MFSA 2008-55)

  - The same-origin check in     'nsXMLHttpRequest::NotifyEventListeners()' can be     bypassed. (MFSA 2008-56)

  - There is an error in the method used to parse the     default namespace in an E4X document caused by quote     characters in the namespace not being properly escaped.
    (MFSA 2008-58)

  - Scripts in a malicous mail message can access the     .document URI and .textContext DOM properties.
    (MFSA 2008-59)

The installed version of SeaMonkey is earlier than 1.1.13.  Such versions are potentially affected by the following security issues :

  - Locally saved '.url' shortcut files can be used to read     information stored in the local cache. (MFSA 2008-47)

  - The canvas element can be used in conjunction with an     HTTP redirect to bypass same-origin restrictions and     gain access to the content in arbitrary images from     other domains. (MFSA 2008-48)

  - Arbitrary code execution is possible via Flash Player     dynamic module unloading. (MFSA 2008-49)

  - By tampering with the window.__proto__.__proto__ object,     one can cause the browser to place a lock on a non-     native object, leading to a crash and possible code     execution. (MFSA 2008-50)

  - There are several stability bugs in the browser engine     that may lead to crashes with evidence of memory     corruption. (MFSA 2008-52)

  - There is a buffer overflow that can be triggered by     sending a specially crafted 200 header line in the HTTP     index response. (MFSA 2008-54)

  - Crashes and remote code execution in nsFrameManager are     possible by modifying certain properties of a file     input element before it has finished initializing.
    (MFSA 2008-55)

  - The same-origin check in     'nsXMLHttpRequest::NotifyEventListeners()' can be     bypassed. (MFSA 2008-56)

  - The '-moz-binding' CSS property can be used to bypass     security checks which validate codebase principals.
    (MFSA 2008-57)

  - There is an error in the method used to parse the     default namespace in an E4X document caused by quote     characters in the namespace not being properly escaped.
    (MFSA 2008-58)

  - Scripts in a malicous mail message can access the     .document URI and .textContext. DOM properties.
    (MFSA 2008-59)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

遠端主機受到 GLSA-201301-01 中所述的弱點影響 (Mozilla 產品：多個弱點)

在 Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat 與 XULRunner 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者或許能夠執行攔截式攻擊、取得敏感資訊、繞過限制及保護機制、強制檔案下載、發動 XML 插入攻擊、發動 XSS 攻擊、繞過同源原則、偽造 URL 以發動網路釣魚攻擊、觸發垂直捲動、偽造位置列、偽造 SSL 指示器、修改瀏覽器的字型、發動點擊劫持攻擊，或造成其他不明的影響。
 本機攻擊者可取得提升的權限、取得敏感資訊，或取代任意下載檔案。
 因應措施：

目前尚無已知的因應措施。

リモートホストは、GLSA-201301-01 で説明されている脆弱性の影響を受けます（Mozilla 製品：複数の脆弱性）

Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat、および XULRunner に、複数の脆弱性が発見されました。詳細については、以下で参照されている CVE 識別子をレビューしてください。
 影響：

リモートの攻撃者が、ユーザーを誘導し、特別に細工された Web ページやメールを表示させることができた場合、任意のコードを実行したり、サービス拒否状態を発生させたりする可能性があります。さらに、リモートの攻撃者が中間者攻撃の実行、機密情報の取得、制限および保護メカニズムのバイパス、ファイルダウンロードの強制、XML インジェクション攻撃の実行、XSS 攻撃の実行、同一生成元ポリシーのバイパス、フィッシング攻撃のための URL の偽装、縦スクロールの誘発、ロケーションバーの偽装、SSL インジケーターの偽装、ブラウザのフォントの変更、クリックジャッキング攻撃の実行を引き起こしたり、またはその他の詳細不明な影響を与えたりする可能性があります。
 ローカルの攻撃者が、昇格された権限を取得したり、機密情報を取得したり、またはダウンロードされた任意のファイルを置き換えたりする可能性があります。
 回避策：

現時点で、既知の回避策はありません。

远程主机受到 GLSA-201301-01 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat 和 XULRunner 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、绕过限制和保护机制、强制文件下载，进行 XML 注入攻击、进行 XSS 攻击、绕过同源策略、欺骗 URL 进行钓鱼攻击、触发垂直滚动、欺骗位置栏、欺骗 SSL 标识符、修改浏览器的字体、进行点击劫持攻击或者造成其他不明影响。
 本地攻击者可获得经提升的权限、获取敏感信息或替换任意已下载的文件。
 变通方案：

目前无任何已知的变通方案。

Versions of Mozilla Thunderbird prior to 2.0.0.18 are affected by the following vulnerabilities :

 - The canvas element can be used in conjunction with an HTTP redirect to bypass same-origin restrictions and gain access to the content in arbitrary images from other domains. (MFSA 2008-48)
 - By tampering with the 'window.__proto__' object, one can cause the browser to place a lock on a non-native object, leading to a crash and possible code execution. (MFSA 2008-50)
 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-52)
 - Crashes and remote code execution in nsFrameManager are possible by modifying certain properties of a file input element before it has finished initializing. (MFSA 2008-55)
 - The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)
 - There is an error in the method used to parse the default namespace in an E4X document caused by quote characters in the namespace not being properly escaped. (MFSA 2008-58)
 - Scripts in a malicious mail message can access the .document URI and .textContext DOM properties. (MFSA 2008-59)

ID	名稱	產品	系列	已發布	已更新	嚴重性
34819	Mozilla Thunderbird < 2.0.0.18 Multiple Vulnerabilities	Nessus	Windows	2008/11/20	2018/7/16	high
34768	SeaMonkey < 1.1.13 Multiple Vulnerabilities	Nessus	Windows	2008/11/13	2018/9/17	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2025/10/6	critical
63402	GLSA-201301-01：Mozilla 產品：多個弱點 (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2025/10/6	critical
63402	GLSA-201301-01：Mozilla 製品：複数の脆弱性（BEAST）	Nessus	Gentoo Local Security Checks	2013/1/8	2025/10/6	critical
63402	GLSA-201301-01：Mozilla 产品：多种漏洞 (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2025/10/6	critical
4762	Mozilla Thunderbird < 2.0.0.18 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2008/11/20	2019/3/6	medium

偵測

搜尋 Plugin

high

high

critical

critical

critical

critical

medium