Home / mailings

PDF

[USN-2119-1] Thunderbird vulnerabilities

Posted on 19 February 2014
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-2119-1
February 19, 2014

thunderbird vulnerabilities
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in Thunderbird.

Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Christian Holler, Terrence Cole, Jesse Ruderman, Gary Kwong, Eric
Rescorla, Jonathan Kew, Dan Gohman, Ryan VanderMeulen and Sotaro Ikeda
discovered multiple memory safety issues in Thunderbird. If a user were
tricked in to opening a specially crafted message with scripting enabled,=

an attacker could potentially exploit these to cause a denial of service
via application crash, or execute arbitrary code with the privileges of
the user invoking Thunderbird. (CVE-2014-1477)

Cody Crews discovered a method to bypass System Only Wrappers. If a user
had enabled scripting, an attacker could potentially exploit this to stea=
l
confidential data or execute code with the privileges of the user invokin=
g
Thunderbird. (CVE-2014-1479)

Fredrik L=F6nnqvist discovered a use-after-free in Thunderbird. If a user=

had enabled scripting, an attacker could potentially exploit this to caus=
e
a denial of service via application crash, or execute arbitrary code with=

the priviliges of the user invoking Thunderbird. (CVE-2014-1482)

Arthur Gerkis discovered a use-after-free in Thunderbird. If a user had
enabled scripting, an attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitrary code with
the priviliges of the user invoking Thunderbird. (CVE-2014-1486)

Masato Kinugawa discovered a cross-origin information leak in web worker
error messages. If a user had enabled scripting, an attacker could
potentially exploit this to steal confidential information.
(CVE-2014-1487)

Several issues were discovered with ticket handling in NSS. An attacker
could potentially exploit these to cause a denial of service or bypass
cryptographic protection mechanisms. (CVE-2014-1490, CVE-2014-1491)

Boris Zbarsky discovered that security restrictions on window objects
could be bypassed under certain circumstances. (CVE-2014-1481)

Fabi=E1n Cuchietti and Ateeq ur Rehman Khan discovered that it was possib=
le
to bypass Javascript execution restrictions when replying to or forwardin=
g
mail messages in certain circumstances. An attacker could potentially
exploit this to steal confidential information or modify message content.=

(CVE-2013-6674)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
thunderbird 1:24.3.0+build2-0ubuntu0.13.10.1

Ubuntu 12.10:
thunderbird 1:24.3.0+build2-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
thunderbird 1:24.3.0+build2-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2119-1
CVE-2013-6674, CVE-2014-1477, CVE-2014-1479, CVE-2014-1481,
CVE-2014-1482, CVE-2014-1486, CVE-2014-1487, CVE-2014-1490,
CVE-2014-1491, https://launchpad.net/bugs/1274894

Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:24.3.0+build2-0ubunt=
u0.13.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:24.3.0+build2-0ubunt=
u0.12.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:24.3.0+build2-0ubunt=
u0.12.04.1

 

TOP