Your submission was sent successfully! Close

You have successfully unsubscribed! Close

USN-2904-1: Thunderbird vulnerabilities

8 March 2016

Several security issues were fixed in Thunderbird.

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Releases

Packages

  • thunderbird - Mozilla Open Source mail and newsgroup client

Details

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly
allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were
able to perform a machine-in-the-middle attack, this flaw could be exploited to
view sensitive information. (CVE-2015-7575)

Yves Younan discovered that graphite2 incorrectly handled certain malformed
fonts. If a user were tricked into opening a specially crafted website in a
browsing context, an attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitary code with the
privileges of the user invoking Thunderbird. (CVE-2016-1523)

Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman,
Carsten Book, and Randell Jesup discovered multiple memory safety issues
in Thunderbird. If a user were tricked in to opening a specially crafted
website in a browsing context, an attacker could potentially exploit these
to cause a denial of service via application crash, or execute arbitrary
code with the privileges of the user invoking Thunderbird. (CVE-2016-1930)

Aki Helin discovered a buffer overflow when rendering WebGL content in
some circumstances. If a user were tricked in to opening a specially
crafted website in a browsing context, an attacker could potentially
exploit this to cause a denial of service via application crash, or
execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-2016-1935)

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.10
Ubuntu 14.04
Ubuntu 12.04

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

Related notices

  • USN-2866-1: firefox-locale-et, firefox-locale-sl, firefox-locale-zu, firefox-locale-el, firefox-locale-as, firefox-locale-pl, firefox-locale-ga, firefox-locale-ml, firefox-locale-an, firefox-locale-bg, firefox-locale-ku, firefox-locale-lv, firefox-locale-de, firefox-locale-sw, firefox-locale-be, firefox-locale-en, firefox-locale-si, firefox-locale-fr, firefox-locale-eo, firefox-locale-mn, firefox-locale-pt, firefox-locale-th, firefox-locale-ast, firefox-locale-az, firefox-locale-lt, firefox-locale-ms, firefox-globalmenu, firefox-locale-zh-hant, firefox-locale-nso, firefox-locale-nl, firefox-locale-te, firefox-locale-gd, firefox-locale-ko, firefox-locale-id, firefox-locale-cy, firefox-locale-sr, firefox-locale-da, firefox-locale-is, firefox-mozsymbols, firefox-locale-cs, firefox-locale-fa, firefox-locale-bs, firefox-locale-bn, firefox-locale-nn, firefox-locale-hu, firefox-locale-he, firefox-testsuite, firefox-locale-es, firefox-locale-fy, firefox-locale-zh-hans, firefox-locale-ja, firefox-locale-gu, firefox-locale-ro, firefox-locale-kk, firefox-locale-br, firefox-locale-mai, firefox-locale-hsb, firefox-locale-pa, firefox-locale-hi, firefox-locale-ka, firefox-locale-sk, firefox-locale-ca, firefox-locale-af, firefox-locale-tr, firefox-locale-ru, firefox-locale-xh, firefox-locale-hr, firefox-locale-lg, firefox-locale-hy, firefox-locale-uk, firefox-locale-kn, firefox-locale-sv, firefox-locale-eu, firefox-locale-km, firefox, firefox-locale-ar, firefox-locale-mk, firefox-locale-sq, firefox-locale-ta, firefox-locale-uz, firefox-locale-csb, firefox-locale-vi, firefox-locale-oc, firefox-locale-fi, firefox-dev, firefox-locale-nb, firefox-locale-gl, firefox-locale-or, firefox-locale-mr, firefox-locale-it
  • USN-2863-1: openssl, libssl1.0.0
  • USN-2865-1: libgnutls-deb0-28, gnutls26-doc, libgnutls-dev, gnutls28, libgnutls26, gnutls-bin, libgnutlsxx28, libgnutlsxx27, libgnutls-openssl27, gnutls26
  • USN-2884-1: openjdk-7-jre, icedtea-7-jre-jamvm, openjdk-7-doc, openjdk-7-jre-lib, openjdk-7-source, openjdk-7-demo, openjdk-7, openjdk-7-jre-headless, openjdk-7-jdk, openjdk-7-jre-zero
  • USN-2864-1: libnss3-1d, nss, libnss3-nssdb, libnss3, libnss3-tools, libnss3-dev
  • USN-2902-1: libgraphite2-doc, libgraphite2-dev, graphite2, libgraphite2-3
  • USN-2880-1: firefox-locale-et, firefox-locale-sl, firefox-locale-zu, firefox-locale-el, firefox-locale-as, firefox-locale-pl, firefox-locale-ga, firefox-locale-ml, firefox-locale-an, firefox-locale-bg, firefox-locale-ku, firefox-locale-lv, firefox-locale-de, firefox-locale-sw, firefox-locale-be, firefox-locale-en, firefox-locale-si, firefox-locale-fr, firefox-locale-eo, firefox-locale-mn, firefox-locale-pt, firefox-locale-th, firefox-locale-ast, firefox-locale-az, firefox-locale-lt, firefox-locale-ms, firefox-globalmenu, firefox-locale-zh-hant, firefox-locale-nso, firefox-locale-nl, firefox-locale-te, firefox-locale-gd, firefox-locale-ko, firefox-locale-id, firefox-locale-cy, firefox-locale-sr, firefox-locale-da, firefox-locale-is, firefox-mozsymbols, firefox-locale-cs, firefox-locale-fa, firefox-locale-bs, firefox-locale-bn, firefox-locale-nn, firefox-locale-hu, firefox-locale-he, firefox-testsuite, firefox-locale-es, firefox-locale-fy, firefox-locale-zh-hans, firefox-locale-ja, firefox-locale-gu, firefox-locale-ro, firefox-locale-kk, firefox-locale-br, firefox-locale-mai, firefox-locale-hsb, firefox-locale-pa, firefox-locale-hi, firefox-locale-ka, firefox-locale-sk, firefox-locale-ca, firefox-locale-af, firefox-locale-tr, firefox-locale-ru, firefox-locale-xh, firefox-locale-hr, firefox-locale-lg, firefox-locale-hy, firefox-locale-uk, firefox-locale-kn, firefox-locale-sv, firefox-locale-eu, firefox-locale-km, firefox, firefox-locale-ar, firefox-locale-mk, firefox-locale-sq, firefox-locale-ta, firefox-locale-uz, firefox-locale-csb, firefox-locale-vi, firefox-locale-oc, firefox-locale-fi, firefox-dev, firefox-locale-nb, firefox-locale-gl, firefox-locale-or, firefox-locale-mr, firefox-locale-it