Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

USN-2859-1: Thunderbird vulnerabilities

13 January 2016

Several security issues were fixed in Thunderbird.

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Releases

Packages

  • thunderbird - Mozilla Open Source mail and newsgroup client

Details

Andrei Vaida, Jesse Ruderman, Bob Clary, and Jesse Ruderman
discovered multiple memory safety issues in Thunderbird. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-2015-7201)

Ronald Crane discovered a buffer overflow through code inspection. If a
user were tricked in to opening a specially crafted website in a browsing
context, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking Thunderbird. (CVE-2015-7205)

Abhishek Arya discovered an integer overflow when allocating large
textures. If a user were tricked in to opening a specially crafted
website in a browsing context, an attacker could potentially exploit this
to cause a denial of service via application crash, or execute arbitrary
code with the privileges of the user invoking Thunderbird. (CVE-2015-7212)

Ronald Crane dicovered an integer overflow when processing MP4 format
video in some circumstances. If a user were tricked in to opening a
specially crafted website in a browsing context, an attacker could
potentially exploit this to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-2015-7213)

Tsubasa Iinuma discovered a way to bypass same-origin restrictions using
data: and view-source: URLs. If a user were tricked in to opening a
specially crafted website in a browsing context, an attacker could
potentially exploit this to obtain sensitive information and read local
files. (CVE-2015-7214)

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.10
Ubuntu 15.04
Ubuntu 14.04
Ubuntu 12.04

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

Related notices

  • USN-2833-1: firefox-locale-ro, firefox-locale-vi, firefox-locale-mai, firefox-locale-nl, firefox-mozsymbols, firefox-locale-th, firefox-locale-de, firefox-locale-fa, firefox-locale-fi, firefox-locale-sk, firefox-locale-hy, firefox-locale-oc, firefox-locale-is, firefox-locale-ml, firefox-locale-mk, firefox-locale-sq, firefox-locale-te, firefox-locale-lv, firefox-locale-ms, firefox-locale-nso, firefox-locale-zh-hant, firefox-locale-ta, firefox-globalmenu, firefox-locale-eu, firefox-locale-km, firefox-locale-an, firefox-locale-gd, firefox-locale-lt, firefox-locale-es, firefox-locale-nn, firefox-locale-eo, firefox-testsuite, firefox-locale-ka, firefox-locale-fy, firefox-locale-zu, firefox-locale-zh-hans, firefox-locale-uz, firefox-locale-ja, firefox-locale-bs, firefox-locale-cs, firefox-locale-da, firefox-locale-pl, firefox-locale-af, firefox-locale-gl, firefox-locale-bg, firefox-locale-sw, firefox-locale-ko, firefox-locale-as, firefox-locale-ku, firefox-locale-be, firefox-locale-hr, firefox-locale-sr, firefox-locale-xh, firefox-dev, firefox-locale-ru, firefox-locale-et, firefox-locale-kn, firefox-locale-bn, firefox-locale-el, firefox-locale-it, firefox, firefox-locale-hsb, firefox-locale-br, firefox-locale-ga, firefox-locale-mn, firefox-locale-pa, firefox-locale-id, firefox-locale-en, firefox-locale-nb, firefox-locale-sv, firefox-locale-hu, firefox-locale-mr, firefox-locale-az, firefox-locale-kk, firefox-locale-he, firefox-locale-csb, firefox-locale-si, firefox-locale-ast, firefox-locale-ca, firefox-locale-gu, firefox-locale-sl, firefox-locale-lg, firefox-locale-tr, firefox-locale-or, firefox-locale-pt, firefox-locale-fr, firefox-locale-cy, firefox-locale-ar, firefox-locale-hi, firefox-locale-uk