Ubuntu 15.10 USN-2819-1 Critical: Thunderbird Denial Of Service

ubuntu

December 1, 2015

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky,

Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong

discovered multiple memory safety issues in Thunderbird. If a user were

tricked in to opening a specially crafted message, an attacker could

potentially exploit these to cause a denial of service via application

crash, or execute arbitrary code with the privileges of the user invoking

Thunderbird. (CVE-2015-4513)

Tyson Smith and David Keeler discovered a use-after-poison and buffer

overflow in NSS. An attacker could potentially exploit these to cause a

denial of service via application crash, or execute arbitrary code with

the privileges of the user invoking Thunderbird. (CVE-2015-7181,

CVE-2015-7182)

Ryan Sleevi discovered an integer overflow in NSPR. An attacker could

...

Read the Full Advisory

Topics Covered

security advisory denial of service critical Ubuntu Thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  thunderbird                     1:38.4.0+build3-0ubuntu0.15.10.1

Ubuntu 15.04:
  thunderbird                     1:38.4.0+build3-0ubuntu0.15.04.1

Ubuntu 14.04 LTS:
  thunderbird                     1:38.4.0+build3-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:38.4.0+build3-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.