Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 591
Alerts This Week
Warning Icon 1 591

Ubuntu 14.10 USN-2552-1: Moderate Risk ThunderBird Threats Resolved

ubuntu
Calendar Grey April 2, 2015
Dist Ubuntu Esm H88
Numerous vulnerabilities resolved in Firefox for different Ubuntu editions; make sure to update your system without delay.
Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Olli Pettay and Boris Zbarsky discovered an issue during anchor

navigations in some circumstances. If a user were tricked in to opening

a specially crafted message with scripting enabled, an attacker could

potentially exploit this to bypass same-origin policy restrictions.

(CVE-2015-0801)

Christoph Kerschbaumer discovered that CORS requests from

navigator.sendBeacon() followed 30x redirections after preflight. If a

user were tricked in to opening a specially crafted message with

scripting enabled, an attacker could potentially exploit this to conduct

cross-site request forgery (XSRF) attacks. (CVE-2015-0807)

Aki Helin discovered a use-after-free when playing MP3 audio files using

the Fluendo MP3 GStreamer plugin in certain circumstances. If a user were

tricked in to opening a specially crafted message, an attacker ...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service ubuntu thunderbird cross-site request forgery

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  thunderbird                     1:31.6.0+build1-0ubuntu0.14.10.1

Ubuntu 14.04 LTS:
  thunderbird                     1:31.6.0+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:31.6.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2552-1

CVE-2015-0801, CVE-2015-0807, CVE-2015-0813, CVE-2015-0815,

CVE-2015-0816

Severity
important
Lowest
Low
Medium
High
Critical

April 02, 2015

Topics%20covered

Topics Covered

security advisory denial of service ubuntu thunderbird cross-site request forgery

Package Information

https://launchpad.net/ubuntu/+source/thunderbird/1:31.6.0+build1-0ubuntu0.14.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:31.6.0+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:31.6.0+build1-0ubuntu0.12.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.