Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Ubuntu: USN-2151-1 Moderate: Multiple Memory Issues in Thunderbird

ubuntu
Calendar Grey March 21, 2014
Scroller Ubuntu
Important vulnerabilities in Thunderbird addressed in Ubuntu USN-2151-1. Ensure you update promptly for improved safety and reliability.
Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan

Gohman and Christoph Diehl discovered multiple memory safety issues in

Thunderbird. If a user were tricked in to opening a specially crafted

message with scripting enabled, an attacker could potentially exploit

these to cause a denial of service via application crash, or execute

arbitrary code with the privileges of the user invoking Thunderbird.

(CVE-2014-1493)

Atte Kettunen discovered an out-of-bounds read during WAV file decoding.

If a user had enabled audio, an attacker could potentially exploit this

to cause a denial of service via application crash. (CVE-2014-1497)

Robert O'Callahan discovered a mechanism for timing attacks involving

SVG filters and displacements input to feDisplacementMap. If a user had

enabled scripting, an attacker cou...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory Ubuntu Denial of Service application crash Mozilla Thunderbird out-of-bounds access memory issues

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  thunderbird                     1:24.4.0+build1-0ubuntu0.13.10.2

Ubuntu 12.10:
  thunderbird                     1:24.4.0+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  thunderbird                     1:24.4.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2151-1

CVE-2014-1493, CVE-2014-1497, CVE-2014-1505, CVE-2014-1508,

CVE-2014-1509, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512,

CVE-2014-1513, CVE-2014-1514, https://bugs.launchpad.net/ubuntu/+source/thunderbird/+bug/1293851

Severity
important
Lowest
Low
Medium
High
Critical

March 21, 2014

Topics%20covered

Topics Covered

security advisory Ubuntu Denial of Service application crash Mozilla Thunderbird out-of-bounds access memory issues

Package Information

https://launchpad.net/ubuntu/+source/thunderbird/1:24.4.0+build1-0ubuntu0.13.10.2
https://launchpad.net/ubuntu/+source/thunderbird/1:24.4.0+build1-0ubuntu0.12.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:24.4.0+build1-0ubuntu0.12.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.