Mozilla Thunderbird 是独立的邮件和新闻组客户端。

发现 Thunderbird 在处理特定附加组件的方式中存在缺陷。
恶意的远程内容可能导致附加组件升级自身的权限，从而导致以运行 Thunderbird 的用户权限执行任意代码。(CVE-2011-3647)

在 Thunderbird 处理特定多字节字符集的方式中发现一个跨站脚本 (XSS) 缺陷。恶意的远程内容可导致 Thunderbird 以其他远程内容的权限运行 JavaScript 代码。(CVE-2011-3648)

在 Thunderbird 处理大型 JavaScript 脚本的方式中发现一个缺陷。恶意的远程内容可导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。(CVE-2011-3650)

所有 Thunderbird 用户都应升级此更新后的程序包，其中解决了这些问题。必须重新启动所有正在运行的 Thunderbird 实例，才能使更新生效。

远程主机受到 GLSA-201301-01 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat 和 XULRunner 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、绕过限制和保护机制、强制文件下载，进行 XML 注入攻击、进行 XSS 攻击、绕过同源策略、欺骗 URL 进行钓鱼攻击、触发垂直滚动、欺骗位置栏、欺骗 SSL 标识符、修改浏览器的字体、进行点击劫持攻击或者造成其他不明影响。
 本地攻击者可获得经提升的权限、获取敏感信息或替换任意已下载的文件。
 变通方案：

目前无任何已知的变通方案。

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox prior to 8.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

Versions of Mozilla Thunderbird prior to 8.0 are affected by the following security issues :

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

Versions of Firefox earlier than 3.6.24 are potentially affected by multiple vulnerabilities :

 - A flaw exists within the 'JSSubScriptLoader' that incorrectly unwraps 'XPCNativeWrappers'.  By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code. (CVE-2011-3647)
 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting (XSS) attacks. (CVE-2011-3648)
 - Profiling JavaScript files with many functions can cause the application to crash.  It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 7.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

ID	名稱	產品	系列	已發布	已更新	嚴重性
61174	Scientific Linux 安全更新：SL6.x i386/x86_64 中的 thunderbird	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
63402	GLSA-201301-01：Mozilla 产品：多种漏洞 (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2022/12/5	critical
6788	Mozilla Firefox < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/5/6	2019/3/6	high
6789	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2013/5/6	2019/3/6	high
9377	Mozilla Firefox < 3.6.24 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/6/24	2019/3/6	high
801281	Mozilla Thunderbird 7.0 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	2013/5/6		high
801321	Mozilla Firefox 7.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/5/6		high

偵測

搜尋 Plugin

high

critical

high

high

high

high

high