USN-3141-1: Thunderbird vulnerabilities

Ubuntu Security Notice USN-3141-1

30th November, 2016

thunderbird vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Thunderbird.

Software description

• thunderbird - Mozilla Open Source mail and newsgroup client

Details

Christian Holler, Jon Coppeard, Olli Pettay, Ehsan Akhgari, Gary Kwong,
Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues
in Thunderbird. If a user were tricked in to opening a specially crafted
message, an attacker could potentially exploit these to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2016-5290)

A same-origin policy bypass was discovered with local HTML files in some
circumstances. An attacker could potentially exploit this to obtain
sensitive information. (CVE-2016-5291)

A heap buffer-overflow was discovered in Cairo when processing SVG
content. If a user were tricked in to opening a specially crafted message,
an attacker could potentially exploit this to cause a denial of service
via application crash, or execute arbitrary code. (CVE-2016-5296)

An error was discovered in argument length checking in Javascript. If a
user were tricked in to opening a specially crafted website in a browsing
context, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2016-5297)

A buffer overflow was discovered in nsScriptLoadHandler. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit this to cause a denial of service
via application crash, or execute arbitrary code. (CVE-2016-9066)

A use-after-free was discovered in SVG animations. If a user were tricked
in to opening a specially crafted website in a browsing context, an
attacker could exploit this to cause a denial of service via application
crash, or execute arbitrary code. (CVE-2016-9079)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 16.10:

thunderbird 1:45.5.1+build1-0ubuntu0.16.10.1

Ubuntu 16.04 LTS:

thunderbird 1:45.5.1+build1-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

thunderbird 1:45.5.1+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:

thunderbird 1:45.5.1+build1-0ubuntu0.12.04.1

To update your system, please follow these instructions: http://ift.tt/17VXqjU.

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

CVE-2016-5290, CVE-2016-5291, CVE-2016-5296, CVE-2016-5297, CVE-2016-9066, CVE-2016-9079

from Ubuntu Security Notices http://ift.tt/2gX2X5e