USN-741-1: Thunderbird vulnerabilities

Ubuntu Security Notice USN-741-1

19th March, 2009

mozilla-thunderbird, thunderbird vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 8.10
  • Ubuntu 8.04 LTS
  • Ubuntu 7.10
  • Ubuntu 6.06 LTS

Software description

  • mozilla-thunderbird
  • thunderbird

Details

Several flaws were discovered in the browser engine. If Javascript were
enabled, an attacker could exploit these flaws to crash Thunderbird and
possibly execute arbitrary code with user privileges. (CVE-2009-0352)

Jesse Ruderman and Gary Kwong discovered flaws in the browser engine. If a
user had Javascript enabled, these problems could allow a remote attacker to
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2009-0772, CVE-2009-0774)

Georgi Guninski discovered a flaw when Thunderbird performed a cross-domain
redirect. If a user had Javascript enabled, an attacker could bypass the
same-origin policy in Thunderbird by utilizing nsIRDFService and steal
private data from users authenticated to the redirected website.
(CVE-2009-0776)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 8.10:
thunderbird 2.0.0.21+nobinonly-0ubuntu0.8.10.1
Ubuntu 8.04 LTS:
thunderbird 2.0.0.21+nobinonly-0ubuntu0.8.04.1
Ubuntu 7.10:
thunderbird 2.0.0.21+nobinonly-0ubuntu0.7.10.1
Ubuntu 6.06 LTS:
mozilla-thunderbird 1.5.0.13+1.5.0.15~prepatch080614k-0ubuntu0.6.06.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system upgrade you need to restart Thunderbird to effect
the necessary changes.

References

CVE-2009-0352, CVE-2009-0772, CVE-2009-0774, CVE-2009-0776