Debian Linux Distribution

Find the information you need for your favorite open source distribution .

Arch Linux Security Advisory ASA-201711-43
=========================================
Severity: Critical
Date    : 2017-11-30
CVE-ID  : CVE-2017-7826 CVE-2017-7828 CVE-2017-7830
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-530

Summary
======
The package thunderbird before version 52.5.0-1 is vulnerable to
multiple issues including arbitrary code execution and same-origin
policy bypass.

Resolution
=========
Upgrade to 52.5.0-1.

# pacman -Syu "thunderbird>=52.5.0-1"

The problems have been fixed upstream in version 52.5.0.

Workaround
=========
None.

Description
==========
- CVE-2017-7826 (arbitrary code execution)

Several reported memory safety bugs have been found in Firefox before
57.0 and Thunderbird before 52.5. Some of these bugs showed evidence of
memory corruption and with enough effort some of these could probably
be exploited to run arbitrary code.

- CVE-2017-7828 (arbitrary code execution)

A use-after-free vulnerability can occur in Firefox before 57.0 and
Thunderbird before 52.5 when flushing and resizing layout because the
PressShell object has been freed while still in use. This results in a
potentially exploitable crash during these operations.

- CVE-2017-7830 (same-origin policy bypass)

The Resource Timing API in Firefox before 57.0 and Thunderbird before
52.5 incorrectly revealed navigations in cross-origin iframes. This is
a same-origin policy violation and could allow for data theft of URLs
loaded by users.

Impact
=====
A remote attacker is able to bypass same-origin policy restrictions or
execute arbitrary code on the affected host.

References
=========
https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7826
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1394530%2C1369561%2C1411458%2C1400003%2C1395138%2C1408412%2C1393840%2C1400763%2C1339259%2C1394265%2C1407740%2C1407751%2C1408005%2C1406398%2C1387799%2C1261175%2C1400554%2C1375146%2C1397811%2C1404636%2C1401804
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7828
https://bugzilla.mozilla.org/show_bug.cgi?id=1406750
https://bugzilla.mozilla.org/show_bug.cgi?id=1412252
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7830
https://bugzilla.mozilla.org/show_bug.cgi?id=1408990
https://security.archlinux.org/CVE-2017-7826
https://security.archlinux.org/CVE-2017-7828
https://security.archlinux.org/CVE-2017-7830

ArchLinux: 201711-43: thunderbird: multiple issues

December 1, 2017

Summary

- CVE-2017-7826 (arbitrary code execution) Several reported memory safety bugs have been found in Firefox before 57.0 and Thunderbird before 52.5. Some of these bugs showed evidence of memory corruption and with enough effort some of these could probably be exploited to run arbitrary code.
- CVE-2017-7828 (arbitrary code execution)
A use-after-free vulnerability can occur in Firefox before 57.0 and Thunderbird before 52.5 when flushing and resizing layout because the PressShell object has been freed while still in use. This results in a potentially exploitable crash during these operations.
- CVE-2017-7830 (same-origin policy bypass)
The Resource Timing API in Firefox before 57.0 and Thunderbird before 52.5 incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users.

Resolution

Upgrade to 52.5.0-1. # pacman -Syu "thunderbird>=52.5.0-1"
The problems have been fixed upstream in version 52.5.0.

References

https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7826 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1394530%2C1369561%2C1411458%2C1400003%2C1395138%2C1408412%2C1393840%2C1400763%2C1339259%2C1394265%2C1407740%2C1407751%2C1408005%2C1406398%2C1387799%2C1261175%2C1400554%2C1375146%2C1397811%2C1404636%2C1401804 https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7828 https://bugzilla.mozilla.org/show_bug.cgi?id=1406750 https://bugzilla.mozilla.org/show_bug.cgi?id=1412252 https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7830 https://bugzilla.mozilla.org/show_bug.cgi?id=1408990 https://security.archlinux.org/CVE-2017-7826 https://security.archlinux.org/CVE-2017-7828 https://security.archlinux.org/CVE-2017-7830

Severity
Package : thunderbird
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-530

Workaround

None.

Related News