Ubuntu 16.10: USN-3112-1 Moderate: Thunderbird DoS Risks Addressed

ubuntu

October 27, 2016

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Catalin Dumitru discovered that URLs of resources loaded after a

navigation start could be leaked to the following page via the Resource

Timing API. If a user were tricked in to opening a specially crafted

website in a browsing context, an attacker could potentially exploit this

to obtain sensitive information. (CVE-2016-5250)

Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard,

Steve Fink, Tyson Smith, and Carsten Book discovered multiple memory

safety issues in Thunderbird. If a user were tricked in to opening a

specially crafted message, an attacker could potentially exploit these to

cause a denial of service via application crash, or execute arbitrary

code. (CVE-2016-5257)

Atte Kettunen discovered a heap buffer overflow during text conversion

with some unicode characters. If a user were tri...

Read the Full Advisory

Topics Covered

security advisory DoS Ubuntu application crash memory safety Thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  thunderbird                     1:45.4.0+build1-0ubuntu0.16.10.1

Ubuntu 16.04 LTS:
  thunderbird                     1:45.4.0+build1-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:
  thunderbird                     1:45.4.0+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:45.4.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.