Ubuntu 15.10: USN-2904-1 Moderate: Multiple Thunderbird Issues

ubuntu

March 8, 2016

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly

allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could be exploited to

view sensitive information. (CVE-2015-7575)

Yves Younan discovered that graphite2 incorrectly handled certain malformed

fonts. If a user were tricked into opening a specially crafted website in a

browsing context, an attacker could potentially exploit this to cause a

denial of service via application crash, or execute arbitary code with the

privileges of the user invoking Thunderbird. (CVE-2016-1523)

Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman,

Carsten Book, and Randell Jesup discovered multiple memory safety issues

in Thunderbird. If a user were tricked in to opening a ...

Read the Full Advisory

Topics Covered

security advisory moderate denial of service update issue ubuntu thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  thunderbird                     1:38.6.0+build1-0ubuntu0.15.10.1

Ubuntu 14.04 LTS:
  thunderbird                     1:38.6.0+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:38.6.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.