Ubuntu 13.10: 2053-1 Critical: Thunderbird Denial Of Service Threat

ubuntu

December 11, 2013

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Ben Turner, Bobby Holley, Jesse Ruderman and Christian Holler discovered

multiple memory safety issues in Thunderbird. If a user were tricked in to

opening a specially crafted message with scripting enabled, an attacker

could potentially exploit these to cause a denial of service via

application crash, or execute arbitrary code with the privileges of the

user invoking Thunderbird. (CVE-2013-5609)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in

event listeners. If a user had enabled scripting, an attacker could

potentially exploit this to cause a denial of service via application

crash, or execute arbitrary code with the privileges of the user invoking

Thunderbird. (CVE-2013-5616)

A use-after-free was discovered in the table editing interface. An

attacker could potentially exploit this to cause...

Read the Full Advisory

Topics Covered

security advisory denial of service code execution application crash ubuntu thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  thunderbird                     1:24.2.0+build1-0ubuntu0.13.10.1

Ubuntu 13.04:
  thunderbird                     1:24.2.0+build1-0ubuntu0.13.04.1

Ubuntu 12.10:
  thunderbird                     1:24.2.0+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  thunderbird                     1:24.2.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.