Ubuntu 14.04 LTS USN-2189-1 Critical: Thunderbird Denial Of Service

ubuntu

April 30, 2014

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij,

Jesse Ruderman, Nathan Froyd and Christian Holler discovered multiple

memory safety issues in Thunderbird. If a user were tricked in to opening

a specially crafted message with scripting enabled, an attacker could

potentially exploit these to cause a denial of service via application

crash, or execute arbitrary code with the privileges of the user invoking

Thunderbird. (CVE-2014-1518)

Abhishek Arya discovered an out of bounds read when decoding JPG images.

An attacker could potentially exploit this to cause a denial of service

via application crash. (CVE-2014-1523)

Abhishek Arya discovered a buffer overflow when a script uses a non-XBL

object as an XBL object. If a user had enabled scripting, an attacker

could potentially exploit this to execute...

Read the Full Advisory

Topics Covered

security advisory denial of service critical software update ubuntu thunderbird memory safety

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  thunderbird                     1:24.5.0+build1-0ubuntu0.14.04.1

Ubuntu 13.10:
  thunderbird                     1:24.5.0+build1-0ubuntu0.13.10.1

Ubuntu 12.10:
  thunderbird                     1:24.5.0+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  thunderbird                     1:24.5.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.