SCIENTIFIC-LINUX-ERRATA Archives

October 2015

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Security ERRATA Important: thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64
From:
Pat Riehecky <[log in to unmask]>
Reply To:
[log in to unmask]
Date:
Thu, 1 Oct 2015 17:15:45 +0000
Content-Type:
text/plain
Parts/Attachments:
text/plain (59 lines) 
Synopsis:          Important: thunderbird security update

Advisory ID:       SLSA-2015:1852-1

Issue Date:        2015-10-01

CVE Numbers:       CVE-2015-4500

                   CVE-2015-4509

                   CVE-2015-4519

                   CVE-2015-4520

                   CVE-2015-4517

                   CVE-2015-4521

                   CVE-2015-4522

                   CVE-2015-7174

                   CVE-2015-7175

                   CVE-2015-7176

                   CVE-2015-7177

                   CVE-2015-7180

--



Several flaws were found in the processing of malformed web content. A web

page containing malicious content could cause Thunderbird to crash or,

potentially, execute arbitrary code with the privileges of the user

running Thunderbird. (CVE-2015-4500, CVE-2015-4509, CVE-2015-4517,

CVE-2015-4521, CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176,

CVE-2015-7177, CVE-2015-7180)



Two information leak flaws were found in the processing of malformed web

content. A web page containing malicious content could cause Thunderbird

to disclose sensitive information or, in certain cases, crash.

(CVE-2015-4519, CVE-2015-4520)



Note: All of the above issues cannot be exploited by a specially crafted

HTML mail message because JavaScript is disabled by default for mail

messages. However, they could be exploited in other ways in Thunderbird

(for example, by viewing the full remote content of an RSS feed).



After installing the update, Thunderbird must be restarted for the changes

to take effect.

--



SL5

  x86_64

    thunderbird-38.3.0-1.el5_11.x86_64.rpm

    thunderbird-debuginfo-38.3.0-1.el5_11.x86_64.rpm

  i386

    thunderbird-38.3.0-1.el5_11.i386.rpm

    thunderbird-debuginfo-38.3.0-1.el5_11.i386.rpm

SL6

  x86_64

    thunderbird-38.3.0-1.el6_7.x86_64.rpm

    thunderbird-debuginfo-38.3.0-1.el6_7.x86_64.rpm

  i386

    thunderbird-38.3.0-1.el6_7.i686.rpm

    thunderbird-debuginfo-38.3.0-1.el6_7.i686.rpm

SL7

  x86_64

    thunderbird-38.3.0-1.el7_1.x86_64.rpm

    thunderbird-debuginfo-38.3.0-1.el7_1.x86_64.rpm



- Scientific Linux Development Team

ATOM RSS1 RSS2