Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

Ubuntu 11.04 USN-1350-1 Critical: Thunderbird Memory Issues

ubuntu
Calendar Grey February 8, 2012
Scroller Ubuntu
Mozilla Thunderbird security issues addressed in Ubuntu Security Notice USN-1350-2, impacting various versions.
Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Jesse Ruderman and Bob Clary discovered memory safety issues affecting

Thunderbird. If the user were tricked into opening a specially crafted

page, an attacker could exploit these to cause a denial of service via

application crash, or potentially execute code with the privileges of the

user invoking Thunderbird. (CVE-2012-0442)

It was discovered that Thunderbird did not properly handle node removal in

the DOM. If the user were tricked into opening a specially crafted page, an

attacker could exploit this to cause a denial of service via application

crash, or potentially execute code with the privileges of the user invoking

Thunderbird. (CVE-2011-3659)

It was discovered that memory corruption could occur during the decoding of

Ogg Vorbis files. If the user were tricked into opening a specially crafted

file, an attack...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical memory issue ubuntu thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  thunderbird                     3.1.18+build2+nobinonly-0ubuntu0.11.04.1

Ubuntu 10.10:
  thunderbird                     3.1.18+build2+nobinonly-0ubuntu0.10.10.1

Ubuntu 10.04 LTS:
  thunderbird                     3.1.18+build2+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1350-1

CVE-2011-3659, CVE-2011-3659, CVE-2011-3670, CVE-2012-0442,

CVE-2012-0444, CVE-2012-0449

Severity
critical
Lowest
Low
Medium
High
Critical

February 08, 2012

Topics%20covered

Topics Covered

security advisory denial of service critical memory issue ubuntu thunderbird

Package Information

https://launchpad.net/ubuntu/+source/thunderbird/3.1.18+build2+nobinonly-0ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/thunderbird/3.1.18+build2+nobinonly-0ubuntu0.10.10.1
https://launchpad.net/ubuntu/+source/thunderbird/3.1.18+build2+nobinonly-0ubuntu0.10.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.