Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 492
Alerts This Week
Warning Icon 1 492

Ubuntu 15.04: USN-2754-1 Moderate: Thunderbird Memory Safety Exploits

ubuntu
Calendar Grey October 5, 2015
Scroller Ubuntu
Numerous vulnerabilities in Thunderbird addressed by Ubuntu Security Notice USN-2754-1, impacting different versions.
Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David

Major, Andrew McCreight, and Cameron McCormack discovered multiple memory

safety issues in Thunderbird. If a user were tricked in to opening a

specially crafted message, an attacker could potentially exploit these to

cause a denial of service via application crash, or execute arbitrary code

with the privileges of the user invoking Thunderbird. (CVE-2015-4500)

Khalil Zhani discovered a buffer overflow when parsing VP9 content in some

circumstances. If a user were tricked in to opening a specially crafted

message, an attacker could potentially exploit this to cause a denial of

service via application crash, or execute arbitrary code with the

privileges of the user invoking Thunderbird. (CVE-2015-4506)

A use-after-free was discovered when manipulati...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow ubuntu thunderbird memory safety

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  thunderbird                     1:38.3.0+build1-0ubuntu0.15.04.1

Ubuntu 14.04 LTS:
  thunderbird                     1:38.3.0+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:38.3.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2754-1

CVE-2015-4500, CVE-2015-4506, CVE-2015-4509, CVE-2015-4511,

CVE-2015-4517, CVE-2015-4519, CVE-2015-4520, CVE-2015-4521,

CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176,

CVE-2015-7177, CVE-2015-7180

Severity
important
Lowest
Low
Medium
High
Critical

October 05, 2015

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow ubuntu thunderbird memory safety

Package Information

https://launchpad.net/ubuntu/+source/thunderbird/1:38.3.0+build1-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.3.0+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.3.0+build1-0ubuntu0.12.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.