Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing-like
context, an attacker could potentially exploit these to read uninitialized
memory, bypass phishing and malware protection, conduct cross-site
scripting (XSS) attacks, cause a denial of service via application crash,
or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7814,
CVE-2017-7818, CVE-2017-7819, CVE-2017-7823, CVE-2017-7824)
Martin Thomson discovered that NSS incorrectly generated handshake hashes.
A remote attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2017-7805)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | thunderbird | 1:52.4.0+build1-0ubuntu0.14.04.2 |
| Ubuntu · 16.04 LTS 16.04:LTS | thunderbird | 1:52.4.0+build1-0ubuntu0.16.04.2 |
Vulnerabilities 8
-
Unscored —
A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still…
-
Unscored —
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for l…
-
Unscored —
Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corru…
-
Unscored —
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing a…
-
Unscored —
A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) eleme…
-
Unscored —
A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the…
-
Unscored —
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to be…
-
Unscored —
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. …
References
-
report
https://ubuntu.com/security/CVE-2017-7793
-
report
https://ubuntu.com/security/CVE-2017-7805
-
report
https://ubuntu.com/security/CVE-2017-7810
-
report
https://ubuntu.com/security/CVE-2017-7814
-
report
https://ubuntu.com/security/CVE-2017-7818
-
report
https://ubuntu.com/security/CVE-2017-7819
-
report
https://ubuntu.com/security/CVE-2017-7823
-
report
https://ubuntu.com/security/CVE-2017-7824