Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 509
Alerts This Week
Warning Icon 1 509

Ubuntu 16.04 LTS 3165-1 Critical: Thunderbird Memory Safety Threats

ubuntu
Calendar Grey January 28, 2017
Scroller Ubuntu Esm H88
The critical security update USN-3166-1 for Firefox addresses several vulnerabilities in outdated Ubuntu installations, aiming to bolster defense against potential exploits.
Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Multiple memory safety issues were discovered in Thunderbird. If a user were

tricked in to opening a specially crafted message, an attacker could

potentially exploit these to cause a denial of service via application

crash, or execute arbitrary code. (CVE-2016-9893, CVE-2017-5373)

Andrew Krasichkov discovered that event handlers on elements

were executed despite a Content Security Policy (CSP) that disallowed

inline JavaScript. If a user were tricked in to opening a specially

crafted website in a browsing context, an attacker could potentially

exploit this to conduct cross-site scripting (XSS) attacks.

(CVE-2016-9895)

A memory corruption issue was discovered in WebGL in some circumstances.

If a user were tricked in to opening a specially crafted website in a

browsing context, an attacker could potentially exploit ...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service software update cross-site scripting ubuntu thunderbird memory safety

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  thunderbird                     1:45.7.0+build1-0ubuntu0.16.10.1

Ubuntu 16.04 LTS:
  thunderbird                     1:45.7.0+build1-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:
  thunderbird                     1:45.7.0+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  thunderbird                     1:45.7.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3165-1

CVE-2016-9893, CVE-2016-9895, CVE-2016-9897, CVE-2016-9898,

CVE-2016-9899, CVE-2016-9900, CVE-2016-9904, CVE-2016-9905,

CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378,

CVE-2017-5380, CVE-2017-5383, CVE-2017-5390, CVE-2017-5396

Severity
critical
Lowest
Low
Medium
High
Critical

January 28, 2017

Topics%20covered

Topics Covered

security advisory denial of service software update cross-site scripting ubuntu thunderbird memory safety

Package Information

https://launchpad.net/ubuntu/+source/thunderbird/1:45.7.0+build1-0ubuntu0.16.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:45.7.0+build1-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:45.7.0+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:45.7.0+build1-0ubuntu0.12.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.