Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to bypass same origin
restrictions, obtain sensitive information, cause a denial of service via
application crash or hang, or execute arbitrary code. (CVE-2017-5398,
CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5405,
CVE-2017-5407, CVE-2017-5408, CVE-2017-5410)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | thunderbird | 1:45.8.0+build1-0ubuntu0.14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | thunderbird | 1:45.8.0+build1-0ubuntu0.16.04.1 |
Vulnerabilities 9
-
Unscored —
Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we pr…
-
Unscored —
JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potent…
-
Unscored —
A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The res…
-
Unscored —
A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroy…
-
Unscored —
A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree an…
-
Unscored —
Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. Th…
-
Unscored —
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract p…
-
Unscored —
Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-…
-
Unscored —
Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in ho…
References
-
report
https://ubuntu.com/security/CVE-2017-5398
-
report
https://ubuntu.com/security/CVE-2017-5400
-
report
https://ubuntu.com/security/CVE-2017-5401
-
report
https://ubuntu.com/security/CVE-2017-5402
-
report
https://ubuntu.com/security/CVE-2017-5404
-
report
https://ubuntu.com/security/CVE-2017-5405
-
report
https://ubuntu.com/security/CVE-2017-5407
-
report
https://ubuntu.com/security/CVE-2017-5408
-
report
https://ubuntu.com/security/CVE-2017-5410