Ubuntu 21.10: 5168-2 Moderate: Thunderbirds Denial Of Service Threat

ubuntu

December 1, 2021

Thunderbird could be made to crash or run programs if it verified a specially crafted signature.

Summary

Thunderbird could be made to crash or run programs if it verified a

specially crafted signature.

Software Description:

- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Tavis Ormandy discovered that NSS, included with Thunderbird, incorrectly

handled verifying DSA/RSA-PSS signatures. A remote attacker could use this

issue to cause Thunderbird to crash, resulting in a denial of service, or

possibly execute arbitrary code.

Topics Covered

security advisory denial of service remote code execution Ubuntu thunderbird

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  thunderbird                     1:91.3.1+build1-0ubuntu0.21.10.2

Ubuntu 21.04:
  thunderbird                     1:78.14.0+build1-0ubuntu0.21.04.2

Ubuntu 20.04 LTS:
  thunderbird                     1:78.14.0+build1-0ubuntu0.20.04.2

Ubuntu 18.04 LTS:
  thunderbird                     1:78.14.0+build1-0ubuntu0.18.04.2

After a standard system update you need to restart Thunderbird to make
all the necessary changes.