Ubuntu 18.04 LTS: High Security Flaw Found in Firefox 3456-2

ubuntu

May 19, 2016

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Christian Holler, Tyson Smith, and Phil Ringalda discovered multiple

memory safety issues in Thunderbird. If a user were tricked in to opening

a specially crafted message, an attacker could potentially exploit these

to cause a denial of service via application crash, or execute arbitrary

code. (CVE-2016-2805, CVE-2016-2807)

Hanno Böck discovered that calculations with mp_div and mp_exptmod in NSS

produce incorrect results in some circumstances, resulting in

cryptographic weaknesses. (CVE-2016-1938)

A use-after-free was discovered in ssl3_HandleECDHServerKeyExchange in

NSS. A remote attacker could potentially exploit this to cause a denial of

service via application crash, or execute arbitrary code. (CVE-2016-1978)

A use-after-free was discovered in PK11_ImportDERPrivateKeyInfoAndReturnKey

in NSS. A remote attack...

Read the Full Advisory

Topics Covered

security advisory denial of service critical software update ubuntu thunderbird memory safety

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  thunderbird                     1:38.8.0+build1-0ubuntu0.16.04.1

Ubuntu 15.10:
  thunderbird                     1:38.8.0+build1-0ubuntu0.15.10.1

Ubuntu 14.04 LTS:
  thunderbird                     1:38.8.0+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:38.8.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.