Arch Linux Security Advisory ASA-201604-12
=========================================
Severity: Medium
Date    : 2016-04-23
CVE-ID  : CVE-2016-1955 CVE-2016-1956
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package thunderbird before version 45.0-1 is vulnerable to multiple
issues including denial of service and same-origin policy bypass.

Resolution
=========
Upgrade to 45.0-1.

# pacman -Syu "thunderbird>=45.0-1"

The problems have been fixed upstream in version 45.0.

Workaround
=========
None.

Description
==========
- CVE-2016-1955 (same-origin policy bypass)

A vulnerability allows remote attackers to bypass the Same Origin Policy
and obtain sensitive information by reading a Content Security Policy
(CSP) violation report that contains path information associated with an
IFRAME element.

- CVE-2016-1956 (denial of service)

Security researcher Ucha Gobejishvili reported a denial of service (DOS)
attack when doing certain WebGL operations in a canvas requiring an
unusually large amount buffer to be allocated from video memory. This
resulted memory resource exhaustion with some Intel video cards,
requiring the computer to be rebooted to return functionality. This was
resolved by putting in additional checks on the amount of memory to be
allocated during graphics processing.

Impact
=====
A remote attacker is able to bypass the same-origin policy restriction
or perform a denial of service attack via memory consumption.

References
=========
https://www.mozilla.org/en-US/security/advisories/mfsa2016-19/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-18/
https://access.redhat.com/security/cve/CVE-2016-1955
https://access.redhat.com/security/cve/CVE-2016-1956