Ubuntu 11.04: 1213-1 Moderate: Thunderbird Memory Issues Resolved

ubuntu

September 28, 2011

Multiple vulnerabilities were fixed in Thunderbird.

Summary

Multiple vulnerabilities were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Benjamin Smedberg, Bob Clary, Jesse Ruderman, and Josh Aas discovered

multiple memory vulnerabilities in the Gecko rendering engine. An

attacker could use these to possibly execute arbitrary code with the

privileges of the user invoking Thunderbird. (CVE-2011-2995, CVE-2011-2996)

Boris Zbarsky discovered that a frame named "location" could shadow the

window.location object unless a script in a page grabbed a reference to the

true object before the frame was created. This is in violation of the Same

Origin Policy. A malicious E-Mail could possibly use this to access the

local file system. (CVE-2011-2999)

Mark Kaplan discovered an integer underflow in the SpiderMonkey JavaScript

engine. An attacker could potentially use this to crash Thunderbird.

Ian Graham discovered that when multiple Location headers were presen...

Read the Full Advisory

Topics Covered

security advisory software update Ubuntu memory issue email security Thunderbird CRLF injection

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  thunderbird                     3.1.15+build1+nobinonly-0ubuntu0.11.04.1

Ubuntu 10.10:
  thunderbird                     3.1.15+build1+nobinonly-0ubuntu0.10.10.1

Ubuntu 10.04 LTS:
  thunderbird                     3.1.15+build1+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.