USN-741-1: Thunderbird vulnerabilities

Releases

• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 6.06

Packages

• mozilla-thunderbird -
• thunderbird -

Details

Several flaws were discovered in the browser engine. If Javascript were
enabled, an attacker could exploit these flaws to crash Thunderbird and
possibly execute arbitrary code with user privileges. (CVE-2009-0352)

Jesse Ruderman and Gary Kwong discovered flaws in the browser engine. If a
user had Javascript enabled, these problems could allow a remote attacker to
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2009-0772, CVE-2009-0774)

Georgi Guninski discovered a flaw when Thunderbird performed a cross-domain
redirect. If a user had Javascript enabled, an attacker could bypass the
same-origin policy in Thunderbird by utilizing nsIRDFService and steal
private data from users authenticated to the redirected website.
(CVE-2009-0776)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.10

• thunderbird - 2.0.0.21+nobinonly-0ubuntu0.8.10.1

Ubuntu 8.04

• thunderbird - 2.0.0.21+nobinonly-0ubuntu0.8.04.1

Ubuntu 7.10

• thunderbird - 2.0.0.21+nobinonly-0ubuntu0.7.10.1

Ubuntu 6.06

• mozilla-thunderbird - 1.5.0.13+1.5.0.15~prepatch080614k-0ubuntu0.6.06.1

After a standard system upgrade you need to restart Thunderbird to effect
the necessary changes.

References

• CVE-2009-0352
• CVE-2009-0772
• CVE-2009-0774
• CVE-2009-0776

Related notices

• USN-717-1: xulrunner-1.9, abrowser, firefox-3.0
• USN-728-2: firefox
• USN-728-1: xulrunner-1.9, abrowser, firefox-3.0
• USN-728-3: firefox