Ubuntu 15.10: USN-2859-1 Critical: Thunderbird Denial of Service

ubuntu

January 13, 2016

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Andrei Vaida, Jesse Ruderman, Bob Clary, and Jesse Ruderman

discovered multiple memory safety issues in Thunderbird. If a user were

tricked in to opening a specially crafted message, an attacker could

potentially exploit these to cause a denial of service via application

crash, or execute arbitrary code with the privileges of the user invoking

Thunderbird. (CVE-2015-7201)

Ronald Crane discovered a buffer overflow through code inspection. If a

user were tricked in to opening a specially crafted website in a browsing

context, an attacker could potentially exploit this to cause a denial of

service via application crash, or execute arbitrary code with the

privileges of the user invoking Thunderbird. (CVE-2015-7205)

Abhishek Arya discovered an integer overflow when allocating large

textures. If a user were tricked in to...

Read the Full Advisory

Topics Covered

security advisory denial of service buffer overflow critical ubuntu thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  thunderbird                     1:38.5.1+build2-0ubuntu0.15.10.1

Ubuntu 15.04:
  thunderbird                     1:38.5.1+build2-0ubuntu0.15.04.1

Ubuntu 14.04 LTS:
  thunderbird                     1:38.5.1+build2-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:38.5.1+build2-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.