Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

Ubuntu 16.04 LTS: USN-2934-1 Critical: Thunderbird Memory Safety Threats

ubuntu
Calendar Grey April 27, 2016
Scroller Ubuntu
Ubuntu Security Notice USN-2934-2 addresses several vulnerabilities in Thunderbird, outlines their potential risks, and specifies necessary patches.
Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel

Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory

safety issues in Thunderbird. If a user were tricked in to opening a

specially crafted message, an attacker could potentially exploit these to

cause a denial of service via application crash, or execute arbitrary code

with the privileges of the user invoking Thunderbird. (CVE-2016-1952)

Nicolas Golubovic discovered that CSP violation reports can be used to

overwrite local files. If a user were tricked in to opening a specially

crafted website in a browsing context with addon signing disabled and

unpacked addons installed, an attacker could potentially exploit this to

gain additional privileges. (CVE-2016-1954)

Jose Martinez and Romina Santillan discovered a memory leak in

libs...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical memory corruption Ubuntu Thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  thunderbird                     1:38.7.2+build1-0ubuntu0.16.04.1

Ubuntu 15.10:
  thunderbird                     1:38.7.2+build1-0ubuntu0.15.10.1

Ubuntu 14.04 LTS:
  thunderbird                     1:38.7.2+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:38.7.2+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2934-1

CVE-2016-1950, CVE-2016-1952, CVE-2016-1954, CVE-2016-1957,

CVE-2016-1960, CVE-2016-1961, CVE-2016-1964, CVE-2016-1966,

CVE-2016-1974, CVE-2016-1977, CVE-2016-2790, CVE-2016-2791,

CVE-2016-2792, CVE-2016-2793, CVE-2016-2794, CVE-2016-2795,

CVE-2016-2796, CVE-2016-2797, CVE-2016-2798, CVE-2016-2799,

CVE-2016-2800, CVE-2016-2801, CVE-2016-2802

Severity
critical
Lowest
Low
Medium
High
Critical

April 27, 2016

Topics%20covered

Topics Covered

security advisory denial of service critical memory corruption Ubuntu Thunderbird

Package Information

https://launchpad.net/ubuntu/+source/thunderbird/1:38.7.2+build1-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.7.2+build1-0ubuntu0.15.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.7.2+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.7.2+build1-0ubuntu0.12.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.