Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Ubuntu 11.10 USN-1400-3 High: Thunderbird Remote Code Execution

ubuntu
Calendar Grey March 21, 2012
Scroller Ubuntu
Ubuntu Security Notice USN-1400-3 addresses vulnerabilities in Thunderbird. Key updates for user security are emphasized.
Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

USN-1400-1 fixed vulnerabilities in Firefox. This update provides the

corresponding fixes for Thunderbird.

Original advisory details:

Soroush Dalili discovered that Firefox did not adequately protect against

dropping JavaScript links onto a frame. A remote attacker could, through

cross-site scripting (XSS), exploit this to modify the contents or steal

confidential data. (CVE-2012-0455)

Atte Kettunen discovered a use-after-free vulnerability in Firefox's

handling of SVG animations. An attacker could potentially exploit this to

execute arbitrary code with the privileges of the user invoking Firefox.

(CVE-2012-0457)

Atte Kettunen discovered an out of bounds read vulnerability in Firefox's

handling of SVG Filters. An attacker could potentially exploit this to make

data from the user's memory accessibl...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory high severity software update remote code execution cross-site scripting ubuntu thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  thunderbird                     11.0+build1-0ubuntu0.11.10.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1400-3

https://ubuntu.com/security/notices/USN-1400-1

CVE-2012-0451, CVE-2012-0455, CVE-2012-0456, CVE-2012-0457,

CVE-2012-0458, CVE-2012-0459, CVE-2012-0460, CVE-2012-0461,

CVE-2012-0462, CVE-2012-0464, https://bugs.launchpad.net/ubuntu/+source/thunderbird/+bug/951262

Severity
important
Lowest
Low
Medium
High
Critical

March 21, 2012

Topics%20covered

Topics Covered

security advisory high severity software update remote code execution cross-site scripting ubuntu thunderbird

Package Information

https://launchpad.net/ubuntu/+source/thunderbird/11.0+build1-0ubuntu0.11.10.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.