Ubuntu 13.10: 2010-1 Moderate: Thunderbird Memory Flaws and Threats

ubuntu

October 31, 2013

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Multiple memory safety issues were discovered in Thunderbird. If a user

were tricked in to opening a specially crafted message with scripting

enabled, an attacker could possibly exploit these to cause a denial of

service via application crash, or potentially execute arbitrary code with

the privileges of the user invoking Thunderbird. (CVE-2013-1739,

CVE-2013-5590, CVE-2013-5591)

Jordi Chancel discovered that HTML select elements could display arbitrary

content. If a user had scripting enabled, an attacker could potentially

exploit this to conduct URL spoofing or clickjacking attacks.

(CVE-2013-5593)

Abhishek Arya discovered a crash when processing XSLT data in some

circumstances. If a user had scripting enabled, an attacker could

potentially exploit this to execute arbitrary code with the privileges

of the user in...

Read the Full Advisory

Topics Covered

security advisory moderate denial of service code execution Ubuntu memory safety Thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  thunderbird                     1:24.1.0+build1-0ubuntu0.13.10.1

Ubuntu 13.04:
  thunderbird                     1:24.1.0+build1-0ubuntu0.13.04.1

Ubuntu 12.10:
  thunderbird                     1:24.1.0+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  thunderbird                     1:24.1.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.