new checker request: mozilla thunderbird

[terriko]

New checker request: mozilla thunderbird

Project link: https://www.thunderbird.net

CVEs: https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.html?vendor_id=452

Instructions: How to add a new checker to the CVE Binary Tool

We also have a checker creation helper script that can get you started in making the checker.

• Helper script documentation

New to cve-bin-tool or open source? Our New contributor documentation can help you set up tests, etc.

You don't need to have this assigned to you in order for you to work on it, but given the volume of hacktoberfest participants looking for things to work on, you may want to comment here to "claim" the issue and let others know that you're working on it. Issues that have comments but no pull requests after a week may wind up claimed by someone else.

[codamuse]

Running helper_script.py on the rpm here gives me a huge list of hits for VERSION_PATTERNS. I suppose they're all in there but it seems a bit like overkill? Do you have any recommendations in this type of situation? The debian package only had VENDOR_PRODUCT so I wanted to see if I could fill in more details for the checker. I'll try a few other package options and see how it goes.

[terriko]

For narrowing it down:

1. Try a few different versions and see if some of the patterns can be discarded as not applying to all versions
2. Try a few different packages from different linux distros and see if any of the patterns are happening because of how a specific distro is compiled
3. Choose the patterns that seem most "readable" to you -- this is pretty subjective but some of the patterns are really long or have a lot of wildcards or whatever and while they might be just fine you might as well go with what's easy for humans if there's multiple matches
4. Choose the patterns that seem the least likely to break with new releases -- again, this can be pretty subjective, but sometimes there's things like dates in there that are likely tochange

And finally, it's fine to put a few extras patterns in commented out in case someone might need to enable them in the future, so you don't have to choose exactly one if you're feeling better about a top 5 or something.