Rapid7 Vulnerability & Exploit Database

RHSA-2012:1483: thunderbird security update

Back to Search

RHSA-2012:1483: thunderbird security update

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
11/20/2012
Created
07/25/2018
Added
11/21/2012
Modified
07/04/2017

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.Several flaws were found in the processing of malformed content. Maliciouscontent could cause Thunderbird to crash or, potentially, execute arbitrarycode with the privileges of the user running Thunderbird. (CVE-2012-4214,CVE-2012-4215, CVE-2012-4216, CVE-2012-5829, CVE-2012-5830, CVE-2012-5833,CVE-2012-5835, CVE-2012-5839, CVE-2012-5840, CVE-2012-5842)A buffer overflow flaw was found in the way Thunderbird handled GIF(Graphics Interchange Format) images. Content containing a malicious GIFimage could cause Thunderbird to crash or, possibly, execute arbitrary codewith the privileges of the user running Thunderbird. (CVE-2012-4202)A flaw was found in the way Thunderbird decoded the HZ-GB-2312 characterencoding. Malicious content could cause Thunderbird to run JavaScript codewith the permissions of different content. (CVE-2012-4207)A flaw was found in the location object implementation in Thunderbird.Malicious content could possibly use this flaw to allow restricted contentto be loaded by plug-ins. (CVE-2012-4209)A flaw was found in the way cross-origin wrappers were implemented.Malicious content could use this flaw to perform cross-site scriptingattacks. (CVE-2012-5841)A flaw was found in the evalInSandbox implementation in Thunderbird.Malicious content could use this flaw to perform cross-site scriptingattacks. (CVE-2012-4201)Red Hat would like to thank the Mozilla project for reporting these issues.Upstream acknowledges Abhishek Arya, miaubiz, Jesse Ruderman, AndrewMcCreight, Bob Clary, Kyle Huey, Atte Kettunen, Masato Kinugawa, MariuszMlynski, Bobby Holley, and moz_bug_r_a4 as the original reporters ofthese issues.Note: All issues except CVE-2012-4202 cannot be exploited by aspecially-crafted HTML mail message as JavaScript is disabled by defaultfor mail messages. They could be exploited another way in Thunderbird, forexample, when viewing the full remote content of an RSS feed.All Thunderbird users should upgrade to this updated package, whichcontains Thunderbird version 10.0.11 ESR, which corrects these issues.After installing the update, Thunderbird must be restarted for the changesto take effect.

Solution(s)

  • redhat-upgrade-thunderbird
  • redhat-upgrade-thunderbird-debuginfo

References

  • redhat-upgrade-thunderbird
  • redhat-upgrade-thunderbird-debuginfo

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;