Ubuntu 16.10 USN-3141-1 Critical: Thunderbird Memory Issues

ubuntu

December 1, 2016

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Christian Holler, Jon Coppeard, Olli Pettay, Ehsan Akhgari, Gary Kwong,

Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues

in Thunderbird. If a user were tricked in to opening a specially crafted

message, an attacker could potentially exploit these to cause a denial of

service via application crash, or execute arbitrary code. (CVE-2016-5290)

A same-origin policy bypass was discovered with local HTML files in some

circumstances. An attacker could potentially exploit this to obtain

sensitive information. (CVE-2016-5291)

A heap buffer-overflow was discovered in Cairo when processing SVG

content. If a user were tricked in to opening a specially crafted message,

an attacker could potentially exploit this to cause a denial of service

via application crash, or execute arbitrary code. (CVE-2016-5296)

...

Read the Full Advisory

Topics Covered

security advisory code execution DoS Ubuntu application crash Thunderbird memory exploitation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  thunderbird                     1:45.5.1+build1-0ubuntu0.16.10.1

Ubuntu 16.04 LTS:
  thunderbird                     1:45.5.1+build1-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:
  thunderbird                     1:45.5.1+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:45.5.1+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.