Ubuntu 3897-1 Moderate: Thunderbird Denial Of Service Threats

ubuntu

February 26, 2019

Several security issues were fixed in Thunderbird.

Summary

Several security issues were fixed in Thunderbird.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

A use-after-free was discovered in libical. If a user were tricked in to

opening a specially crafted ICS calendar file, an attacker could

potentially exploit this to cause a denial of service. (CVE-2016-5824)

Multiple security issues were discovered in Thunderbird. If a user were

tricked in to opening a specially crafted message, an attacker could

potentially exploit these to cause a denial of service, or execute

arbitrary code. (CVE-2018-18356, CVE-2018-18500, CVE-2019-5785)

Multiple security issues were discovered in Thunderbird. If a user were

tricked in to opening a specially crafted website in a browsing context,

an attacker could potentially exploit these to cause a denial of service,

gain additional privileges by escaping the sandbox, or execute arbitrary

code. (CVE-2018-18501, CVE-2018-18505)

An issue was...

Read the Full Advisory

Topics Covered

security advisory denial of service code execution Ubuntu Thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
  thunderbird                     1:60.5.1+build2-0ubuntu0.18.10.1

Ubuntu 18.04 LTS:
  thunderbird                     1:60.5.1+build2-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  thunderbird                     1:60.5.1+build2-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:
  thunderbird                     1:60.5.1+build2-0ubuntu0.14.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.