Executive Summary

Informations
Name CVE-2010-0163 First vendor Publication 2010-03-22
Vendor Cve Last vendor Modification 2017-09-19

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0163

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10805
 
Oval ID: oval:org.mitre.oval:def:10805
Title: Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing.
Description: Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing.
Family: unix Class: vulnerability
Reference(s): CVE-2010-0163
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13236
 
Oval ID: oval:org.mitre.oval:def:13236
Title: USN-915-1 -- thunderbird vulnerabilities
Description: Several flaws were discovered in the JavaScript engine of Thunderbird. If a user had JavaScript enabled and were tricked into viewing malicious web content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. Josh Soref discovered that the BinHex decoder used in Thunderbird contained a flaw. If a user were tricked into viewing malicious content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that Thunderbird did not properly manage memory when using XUL tree elements. If a user were tricked into viewing malicious content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. Jesse Ruderman and Sid Stamm discovered that Thunderbird did not properly display filenames containing right-to-left override characters. If a user were tricked into opening a malicious file with a crafted filename, an attacker could exploit this to trick the user into opening a different file than the user expected. Takehiro Takahashi discovered flaws in the NTLM implementation in Thunderbird. If an NTLM authenticated user opened content containing links to a malicious website, a remote attacker could send requests to other applications, authenticated as the user. Ludovic Hirlimann discovered a flaw in the way Thunderbird indexed certain messages with attachments. A remote attacker could send specially crafted content and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program
Family: unix Class: patch
Reference(s): USN-915-1
CVE-2009-0689
CVE-2009-2463
CVE-2009-3075
CVE-2009-3072
CVE-2009-3077
CVE-2009-3376
CVE-2009-3983
CVE-2010-0163
 Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 8.10
Ubuntu 9.10
Ubuntu 9.04
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13262
 
Oval ID: oval:org.mitre.oval:def:13262
Title: DSA-2025-1 icedove -- several vulnerabilities
Description: Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2408 Dan Kaminsky and Moxie Marlinspike discovered that icedove does not properly handle a "\0" character in a domain name in the subject's Common Name field of an X.509 certificate. CVE-2009-2404 Moxie Marlinspike reported a heap overflow vulnerability in the code that handles regular expressions in certificate names. CVE-2009-2463 monarch2020 discovered an integer overflow n a base64 decoding function. CVE-2009-3072 Josh Soref discovered a crash in the BinHex decoder. CVE-2009-3075 Carsten Book reported a crash in the JavaScript engine. CVE-2010-0163 Ludovic Hirlimann reported a crash indexing some messages with attachments, which could lead to the execution of arbitrary code. For the stable distribution, these problems have been fixed in version 2.0.0.24-0lenny1. Due to a problem with the archive system it is not possible to release all architectures. The missing architectures will be installed into the archive once they become available. For the testing distribution squeeze and the unstable distribution, these problems will be fixed soon. We recommend that you upgrade your icedove packages.
Family: unix Class: patch
Reference(s): DSA-2025-1
CVE-2009-2408
CVE-2009-2404
CVE-2009-2463
CVE-2009-3072
CVE-2009-3075
CVE-2010-0163
 Version: 5
Platform(s): Debian GNU/Linux 5.0
 Product(s): icedove
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:14259
 
Oval ID: oval:org.mitre.oval:def:14259
Title: Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing.
Description: Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing.
Family: windows Class: vulnerability
Reference(s): CVE-2010-0163
 Version: 15
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
 Product(s): Mozilla Thunderbird
Mozilla Seamonkey
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6699
 
Oval ID: oval:org.mitre.oval:def:6699
Title: DSA-2025 icedove -- several vulnerabilities
Description: Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems: Dan Kaminsky and Moxie Marlinspike discovered that icedove does not properly handle a "\0" character in a domain name in the subject's Common Name field of an X.509 certificate. Moxie Marlinspike reported a heap overflow vulnerability in the code that handles regular expressions in certificate names. monarch2020 discovered an integer overflow in a base64 decoding function. Josh Soref discovered a crash in the BinHex decoder. Carsten Book reported a crash in the JavaScript engine. Ludovic Hirlimann reported a crash indexing some messages with attachments, which could lead to the execution of arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2025
CVE-2009-2408
CVE-2009-2404
CVE-2009-2463
CVE-2009-3072
CVE-2009-3075
CVE-2010-0163
 Version: 5
Platform(s): Debian GNU/Linux 5.0
 Product(s): icedove
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 40
Application 80

OpenVAS Exploits

Date Description
2010-08-20 Name : CentOS Update for seamonkey CESA-2010:0499 centos3 i386
File : nvt/gb_CESA-2010_0499_seamonkey_centos3_i386.nasl
2010-06-28 Name : RedHat Update for seamonkey RHSA-2010:0499-01
File : nvt/gb_RHSA-2010_0499-01_seamonkey.nasl
2010-04-29 Name : Fedora Update for seamonkey FEDORA-2010-7100
File : nvt/gb_fedora_2010_7100_seamonkey_fc11.nasl
2010-04-16 Name : Mandriva Update for krb5 MDVSA-2010:071 (krb5)
File : nvt/gb_mandriva_MDVSA_2010_071.nasl
2010-04-06 Name : Debian Security Advisory DSA 2025-1 (icedove)
File : nvt/deb_2025_1.nasl
2010-03-30 Name : FreeBSD Ports: seamonkey, linux-seamonkey
File : nvt/freebsd_seamonkey.nasl
2010-03-30 Name : Mozilla Products Denial Of Service Vulnerability (Linux)
File : nvt/secpod_mozilla_prdts_dos_vuln_lin_mar10.nasl
2010-03-30 Name : Mozilla Products Denial Of Service Vulnerability (Win)
File : nvt/secpod_mozilla_prdts_dos_vuln_win_mar10.nasl
2010-03-22 Name : Ubuntu Update for thunderbird vulnerabilities USN-915-1
File : nvt/gb_ubuntu_USN_915_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
63263 Mozilla Multiple Products Email Attachment Parser Message Indexing DoS

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0499.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2010-0154.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2010-0153.nasl - Type : ACT_GATHER_INFO
2013-01-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100622_seamonkey_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2010-07-22 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0499.nasl - Type : ACT_GATHER_INFO
2010-07-01 Name : The remote Fedora host is missing a security update.
File : fedora_2010-7100.nasl - Type : ACT_GATHER_INFO
2010-06-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0499.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_seamonkey-100430.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12616.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_seamonkey-100430.nasl - Type : ACT_GATHER_INFO
2010-05-11 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2010-0154.nasl - Type : ACT_GATHER_INFO
2010-04-14 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-071.nasl - Type : ACT_GATHER_INFO
2010-04-01 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2025.nasl - Type : ACT_GATHER_INFO
2010-03-30 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_MozillaThunderbird-100324.nasl - Type : ACT_GATHER_INFO
2010-03-30 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_MozillaThunderbird-100324.nasl - Type : ACT_GATHER_INFO
2010-03-29 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2010-0153.nasl - Type : ACT_GATHER_INFO
2010-03-22 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_56cfe192329f11dfabb2000f20797ede.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-915-1.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : A web browser on the remote host is affected by multiple vulnerabilities.
File : seamonkey_1119.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_20024.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2010-0154.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/38831
CONFIRM http://www.mozilla.org/security/announce/2010/mfsa2010-07.html
https://bugzilla.mozilla.org/show_bug.cgi?id=505221
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT http://www.redhat.com/support/errata/RHSA-2010-0499.html
SECUNIA http://secunia.com/advisories/38977
http://secunia.com/advisories/39001
SUSE http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
UBUNTU http://www.ubuntu.com/usn/USN-915-1
VUPEN http://www.vupen.com/english/advisories/2010/0648
http://www.vupen.com/english/advisories/2010/1556
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/56993

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
Date Informations
2024-02-02 01:12:28
  • Multiple Updates
2024-02-01 12:03:27
  • Multiple Updates
2023-09-05 12:11:43
  • Multiple Updates
2023-09-05 01:03:18
  • Multiple Updates
2023-09-02 12:11:46
  • Multiple Updates
2023-09-02 01:03:20
  • Multiple Updates
2023-08-12 12:13:55
  • Multiple Updates
2023-08-12 01:03:20
  • Multiple Updates
2023-08-11 12:11:49
  • Multiple Updates
2023-08-11 01:03:28
  • Multiple Updates
2023-08-06 12:11:21
  • Multiple Updates
2023-08-06 01:03:22
  • Multiple Updates
2023-08-04 12:11:27
  • Multiple Updates
2023-08-04 01:03:23
  • Multiple Updates
2023-07-14 12:11:23
  • Multiple Updates
2023-07-14 01:03:21
  • Multiple Updates
2023-03-29 01:13:04
  • Multiple Updates
2023-03-28 12:03:27
  • Multiple Updates
2022-10-11 12:10:09
  • Multiple Updates
2022-10-11 01:03:09
  • Multiple Updates
2021-05-04 12:10:57
  • Multiple Updates
2021-04-22 01:11:32
  • Multiple Updates
2020-05-23 01:41:32
  • Multiple Updates
2020-05-23 00:25:06
  • Multiple Updates
2019-06-25 12:02:54
  • Multiple Updates
2019-01-30 12:03:09
  • Multiple Updates
2018-07-13 01:03:19
  • Multiple Updates
2017-11-21 12:02:27
  • Multiple Updates
2017-09-19 09:23:35
  • Multiple Updates
2017-08-17 09:22:53
  • Multiple Updates
2016-06-28 17:59:58
  • Multiple Updates
2016-04-26 19:30:50
  • Multiple Updates
2014-02-17 10:53:19
  • Multiple Updates
2013-05-10 23:16:28
  • Multiple Updates