Ubuntu Security Notice USN-741-1
19th March, 2009
mozilla-thunderbird, thunderbird vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 8.10
- Ubuntu 8.04 LTS
- Ubuntu 7.10
- Ubuntu 6.06 LTS
Software description
- mozilla-thunderbird
- thunderbird
Details
Several flaws were discovered in the browser engine. If Javascript were
enabled, an attacker could exploit these flaws to crash Thunderbird and
possibly execute arbitrary code with user privileges. (CVE-2009-0352)
Jesse Ruderman and Gary Kwong discovered flaws in the browser engine. If a
user had Javascript enabled, these problems could allow a remote attacker to
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2009-0772, CVE-2009-0774)
Georgi Guninski discovered a flaw when Thunderbird performed a cross-domain
redirect. If a user had Javascript enabled, an attacker could bypass the
same-origin policy in Thunderbird by utilizing nsIRDFService and steal
private data from users authenticated to the redirected website.
(CVE-2009-0776)
Update instructions
The problem can be corrected by updating your system to the following package version:
- Ubuntu 8.10:
- thunderbird 2.0.0.21+nobinonly-0ubuntu0.8.10.1
- Ubuntu 8.04 LTS:
- thunderbird 2.0.0.21+nobinonly-0ubuntu0.8.04.1
- Ubuntu 7.10:
- thunderbird 2.0.0.21+nobinonly-0ubuntu0.7.10.1
- Ubuntu 6.06 LTS:
- mozilla-thunderbird 1.5.0.13+1.5.0.15~prepatch080614k-0ubuntu0.6.06.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system upgrade you need to restart Thunderbird to effect
the necessary changes.