Ubuntu 11.04: USN-1185-1 Moderate: Thunderbird Memory Risks

ubuntu

August 26, 2011

Multiple vulnerabilities have been fixed in Thunderbird.

Summary

Multiple vulnerabilities have been fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Gary Kwong, Igor Bukanov, and Bob Clary discovered multiple memory

vulnerabilities in the Gecko rendering engine. An attacker could use

these to possibly execute arbitrary code with the privileges of the user

invoking Thunderbird. (CVE-2011-2982)

It was discovered that a vulnerability in event management code could

permit JavaScript to be run in the wrong context. This could potentially

allow a malicious website to run code as another website or with escalated

privileges in a chrome-privileged context. (CVE-2011-2981)

It was discovered that an SVG text manipulation routine contained a

dangling pointer vulnerability. An attacker could potentially use this to

crash Thunderbird or execute arbitrary code with the privileges of the user

invoking Thunderbird. (CVE-2011-0084)

It was discovered that web content cou...

Read the Full Advisory

Topics Covered

security advisory privilege escalation Ubuntu arbitrary code memory issue Thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  thunderbird                     3.1.12+build1+nobinonly-0ubuntu0.11.04.1

Ubuntu 10.10:
  thunderbird                     3.1.12+build1+nobinonly-0ubuntu0.10.10.1

Ubuntu 10.04 LTS:
  thunderbird                     3.1.12+build1+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.