User: Password:
|
|
Subscribe / Log in / New account

Ubuntu alert USN-2010-1 (thunderbird)

From:  Chris Coulson <chris.coulson@canonical.com>
To:  ubuntu-security-announce@lists.ubuntu.com
Subject:  [USN-2010-1] Thunderbird vulnerabilities
Date:  Thu, 31 Oct 2013 12:52:08 +0000
Message-ID:  <52725278.7000600@canonical.com>
Archive-link:  Article, Thread

========================================================================== Ubuntu Security Notice USN-2010-1 October 31, 2013 thunderbird vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Thunderbird. Software Description: - thunderbird: Mozilla Open Source mail and newsgroup client Details: Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1739, CVE-2013-5590, CVE-2013-5591) Jordi Chancel discovered that HTML select elements could display arbitrary content. If a user had scripting enabled, an attacker could potentially exploit this to conduct URL spoofing or clickjacking attacks. (CVE-2013-5593) Abhishek Arya discovered a crash when processing XSLT data in some circumstances. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-5604) Dan Gohman discovered a flaw in the Javascript engine. If a user had enabled scripting, when combined with other vulnerabilities an attacker could possibly exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-5595) Ezra Pool discovered a crash on extremely large pages. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-5596) Byoungyoung Lee discovered a use-after-free when updating the offline cache. If a user had scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-5597) Multiple use-after-free flaws were discovered in Thunderbird. If a user had scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-5599, CVE-2013-5600, CVE-2013-5601) A memory corruption flaw was discovered in the Javascript engine when using workers with direct proxies. If a user had scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-5602) Abhishek Arya discovered a use-after-free when interacting with HTML document templates. If a user had scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-5603) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: thunderbird 1:24.1.0+build1-0ubuntu0.13.10.1 Ubuntu 13.04: thunderbird 1:24.1.0+build1-0ubuntu0.13.04.1 Ubuntu 12.10: thunderbird 1:24.1.0+build1-0ubuntu0.12.10.1 Ubuntu 12.04 LTS: thunderbird 1:24.1.0+build1-0ubuntu0.12.04.1 After a standard system update you need to restart Thunderbird to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2010-1 CVE-2013-1739, CVE-2013-5590, CVE-2013-5591, CVE-2013-5593, CVE-2013-5595, CVE-2013-5596, CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602, CVE-2013-5603, CVE-2013-5604, https://launchpad.net/bugs/1245422 Package Information: https://launchpad.net/ubuntu/+source/thunderbird/1:24.1.0... https://launchpad.net/ubuntu/+source/thunderbird/1:24.1.0... https://launchpad.net/ubuntu/+source/thunderbird/1:24.1.0... https://launchpad.net/ubuntu/+source/thunderbird/1:24.1.0... -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds