RHSA-2016:0460 — Red Hat Security Advisory: thunderbird security update

Fixed packages 16

Release	Package	Fixed in
Red Hat · RHEL 5 enterprise_linux:5::client	thunderbird	0:38.7.0-1.el5_11
Red Hat · RHEL 5 enterprise_linux:5::client	thunderbird-debuginfo	0:38.7.0-1.el5_11
Red Hat · RHEL 6 enterprise_linux:6::client	thunderbird	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::client	thunderbird-debuginfo	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::server	thunderbird	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::server	thunderbird-debuginfo	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::workstation	thunderbird	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::workstation	thunderbird-debuginfo	0:38.7.0-1.el6_7
Red Hat · RHEL 7 enterprise_linux:7::client	thunderbird	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client	thunderbird-debuginfo	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	thunderbird	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	thunderbird-debuginfo	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	thunderbird	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	thunderbird-debuginfo	0:38.7.0-1.el7_2
Red Hat · Rhel Productivity 5 rhel_productivity:5	thunderbird	0:38.7.0-1.el5_11
Red Hat · Rhel Productivity 5 rhel_productivity:5	thunderbird-debuginfo	0:38.7.0-1.el5_11

Vulnerabilities 22

Unscored —

CVE-2016-1952

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 3…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1954

The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR …

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1957

Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers t…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1960 Public exploit EPSS 31%

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1961

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox …

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1964

Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x befor…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1966

The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Fire…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1974

The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not …

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1977

The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2790

The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Fi…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2791

The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefo…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2792

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 an…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2793

CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, all…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2794

The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox bef…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2795

The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and F…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2796

Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mo…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2797

The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2798

The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 a…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2799

Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Fire…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2800

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 an…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2801

The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Fir…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2802

The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox befo…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016

References

article
https://access.redhat.com/security/updates/classification/#important
article
https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird38.7
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315566
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315569
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315573
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315576
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315577
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315774
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315778
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315785
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315795
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0460.json
report
https://access.redhat.com/security/cve/CVE-2016-1952
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1952
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1952
article
https://www.mozilla.org/security/announce/2016/mfsa2016-16.html
report
https://access.redhat.com/security/cve/CVE-2016-1954
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1954
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1954
article
https://www.mozilla.org/security/announce/2016/mfsa2016-17.html
report
https://access.redhat.com/security/cve/CVE-2016-1957
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1957
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1957
article
https://www.mozilla.org/security/announce/2016/mfsa2016-20.html
report
https://access.redhat.com/security/cve/CVE-2016-1960
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1960
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1960
article
https://www.mozilla.org/security/announce/2016/mfsa2016-23.html
report
https://access.redhat.com/security/cve/CVE-2016-1961
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1961
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1961
article
https://www.mozilla.org/security/announce/2016/mfsa2016-24.html
report
https://access.redhat.com/security/cve/CVE-2016-1964
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1964
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1964
article
https://www.mozilla.org/security/announce/2016/mfsa2016-27.html
report
https://access.redhat.com/security/cve/CVE-2016-1966
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1966
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1966

Red Hat Security Advisory: thunderbird security update

Fixed packages 16

Vulnerabilities 22

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 3…

The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR …

Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers t…

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox…

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox …

Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x befor…

The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Fire…

The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not …

The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45…

The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Fi…

The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefo…

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 an…

CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, all…

The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox bef…

The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and F…

Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mo…

The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.…

The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 a…

Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Fire…

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 an…

The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Fir…

The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox befo…

References