USN-2330-1: Thunderbird vulnerabilities
11 September 2014
Several security issues were fixed in Thunderbird.
Releases
Packages
- thunderbird - Mozilla Open Source mail and newsgroup client
Details
Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong,
Jesse Ruderman and JW Wang discovered multiple memory safety issues in
Thunderbird. If a user were tricked in to opening a specially crafted
message with scripting enabled, an attacker could potentially exploit
these to cause a denial of service via application crash, or execute
arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2014-1553, CVE-2014-1562)
Abhishek Arya discovered a use-after-free during DOM interactions with
SVG. If a user were tricked in to opening a specially crafted message
with scripting enabled, an attacker could potentially exploit this to
cause a denial of service via application crash or execute arbitrary code
with the privileges of the user invoking Thunderbird. (CVE-2014-1563)
Michal Zalewski discovered that memory is not initialized properly during
GIF rendering in some circumstances. If a user were tricked in to opening
a specially crafted message, an attacker could potentially exploit this to
steal confidential information. (CVE-2014-1564)
Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a
user were tricked in to opening a specially crafted message with scripting
enabled, an attacker could potentially exploit this to cause a denial of
service via application crash or steal confidential information.
(CVE-2014-1565)
A use-after-free was discovered during text layout in some circumstances.
If a user were tricked in to opening a specially crafted message with
scripting enabled, an attacker could potentially exploit this to cause a
denial of service via application crash or execute arbitrary code with
the privileges of the user invoking Thunderbird. (CVE-2014-1567)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.04
Ubuntu 12.04
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
Related notices
- USN-2329-1: firefox-locale-csb, firefox-locale-nb, firefox-locale-fy, firefox-locale-is, firefox-locale-sr, firefox-mozsymbols, firefox-locale-hu, firefox-locale-he, firefox-locale-af, firefox-locale-gd, firefox-locale-cy, firefox-locale-ast, firefox-locale-ko, firefox-locale-da, firefox-locale-eu, firefox-locale-it, firefox-globalmenu, firefox-locale-bs, firefox-locale-pa, firefox-locale-fa, firefox-locale-km, firefox-locale-eo, firefox-locale-pt, firefox-locale-hsb, firefox-locale-zh-hans, firefox-locale-sk, firefox-locale-en, firefox-locale-ca, firefox-locale-mn, firefox-locale-as, firefox-locale-sq, firefox-locale-zh-hant, firefox, firefox-locale-nn, firefox-locale-ga, firefox-locale-bg, firefox-locale-hi, firefox-locale-kk, firefox-locale-lv, firefox-locale-ja, firefox-locale-mai, firefox-locale-el, firefox-locale-vi, firefox-locale-nso, firefox-locale-id, firefox-locale-be, firefox-locale-tr, firefox-locale-ka, firefox-locale-hr, firefox-locale-an, firefox-locale-lg, firefox-locale-or, firefox-locale-sl, firefox-testsuite, firefox-locale-hy, firefox-locale-pl, firefox-locale-nl, firefox-locale-sv, firefox-locale-ru, firefox-locale-uk, firefox-locale-mr, firefox-locale-fr, firefox-locale-es, firefox-locale-br, firefox-locale-ro, firefox-locale-ms, firefox-locale-gu, firefox-locale-zu, firefox-locale-te, firefox-dev, firefox-locale-ml, firefox-locale-xh, firefox-locale-et, firefox-locale-cs, firefox-locale-kn, firefox-locale-fi, firefox-locale-gl, firefox-locale-bn, firefox-locale-sw, firefox-locale-mk, firefox-locale-oc, firefox-locale-lt, firefox-locale-ar, firefox-locale-si, firefox-locale-ku, firefox-locale-th, firefox-locale-ta, firefox-locale-de