ArchLinux: 201502-15: thunderbird: multiple issues
Summary
- CVE-2015-0822 (information leak):
Security researcher Armin Razmdjou reported that a user readable file in
a known local path could be uploaded to a malicious site. This was done
by manipulating the autocomplete feature in a form and user interaction
with it. While the local file is not visibly uploaded through the form,
its contents are made available through the Document Object Model (DOM)
to script content on the attacking page, leading to information disclosure.
- CVE-2015-0827 (out-of-bounds read and write, possibly leading to
remote code execution)
Security researcher Abhishek Arya (Inferno) of the Google Chrome
Security Team used the Address Sanitizer tool to report an out-of-bounds
read and an out-of-bounds write when rendering an improperly formatted
SVG graphic. This could potentially allow the attacker to read
uninitialized memory.
- CVE-2015-0831 (use-after-free, possibily leading to remote code execution)
Security researcher Paul Bandha used the used the Address Sanitizer tool
to discover a use-after-free vulnerability when running specific web
content with IndexedDB to create an index. This leads to a potentially
exploitable crash.
- CVE-2015-0835, CVE-2015-0836 (remote code execution):
Mozilla developers and community identified and fixed several memory
safety bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these bugs showed evidence of memory
corruption under certain circumstances, and we presume that with enough
effort at least some of these could be exploited to run arbitrary code.
Resolution
Upgrade to 31.5.0-1.
# pacman -Syu "thunderbird>=31.5.0-1"
The problem has been fixed upstream in version 31.5.0.
References
https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0822 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0827 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0831 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0835 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0836
Workaround
In general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts.
