Red Hat Security Advisory: thunderbird security update

Fixed packages 16

Vulnerabilities 7

• Unscored —
  CVE-2016-9893

  Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we pr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2016-9895

  Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inlin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2016-9899 Public exploit EPSS 19%

  Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2016-9900

  External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2016-9901

  HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will …

  Mozilla Firefox Firefox ESR firefox Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2016-9902

  The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin …

  Mozilla Firefox Firefox ESR firefox Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2016-9905

  A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability a…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jun 11, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1404083
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1404086
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1404090
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1404094
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1404096
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1404358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1404359
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2973.json
• report
  https://access.redhat.com/security/cve/CVE-2016-9893
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9893
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9893
• article
  https://www.mozilla.org/security/announce/2016/mfsa2016-95/#CVE-2016-9893
• report
  https://access.redhat.com/security/cve/CVE-2016-9895
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9895
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9895
• article
  https://www.mozilla.org/security/announce/2016/mfsa2016-95/#CVE-2016-9895
• report
  https://access.redhat.com/security/cve/CVE-2016-9899
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9899
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9899
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/#CVE-2016-9899
• report
  https://access.redhat.com/security/cve/CVE-2016-9900
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9900
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9900
• article
  https://www.mozilla.org/security/announce/2016/mfsa2016-95/#CVE-2016-9900
• report
  https://access.redhat.com/security/cve/CVE-2016-9901
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9901
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9901
• article
  https://www.mozilla.org/security/announce/2016/mfsa2016-95/#CVE-2016-9901
• report
  https://access.redhat.com/security/cve/CVE-2016-9902
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9902
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9902
• article
  https://www.mozilla.org/security/announce/2016/mfsa2016-95/#CVE-2016-9902
• report
  https://access.redhat.com/security/cve/CVE-2016-9905
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-9905
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-9905
• article
  https://www.mozilla.org/security/announce/2016/mfsa2016-95/#CVE-2016-9905