RHEL 5 / 6 : thunderbird (RHSA-2012:0516)

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

An updated thunderbird package that fixes multiple security issues is
now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having
critical security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

A flaw was found in Sanitiser for OpenType (OTS), used by Thunderbird
to help prevent potential exploits in malformed OpenType fonts.
Malicious content could cause Thunderbird to crash or, under certain
conditions, possibly execute arbitrary code with the privileges of the
user running Thunderbird. (CVE-2011-3062)

Malicious content could cause Thunderbird to crash or, potentially,
execute arbitrary code with the privileges of the user running
Thunderbird. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469)

Content containing a malicious Scalable Vector Graphics (SVG) image
file could cause Thunderbird to crash or, potentially, execute
arbitrary code with the privileges of the user running Thunderbird.
(CVE-2012-0470)

A flaw was found in the way Thunderbird used its embedded Cairo
library to render certain fonts. Malicious content could cause
Thunderbird to crash or, under certain conditions, possibly execute
arbitrary code with the privileges of the user running Thunderbird.
(CVE-2012-0472)

A flaw was found in the way Thunderbird rendered certain images using
WebGL. Malicious content could cause Thunderbird to crash or, under
certain conditions, possibly execute arbitrary code with the
privileges of the user running Thunderbird. (CVE-2012-0478)

A cross-site scripting (XSS) flaw was found in the way Thunderbird
handled certain multibyte character sets. Malicious content could
cause Thunderbird to run JavaScript code with the permissions of
different content. (CVE-2012-0471)

A flaw was found in the way Thunderbird rendered certain graphics
using WebGL. Malicious content could cause Thunderbird to crash.
(CVE-2012-0473)

A flaw in the built-in feed reader in Thunderbird allowed the Website
field to display the address of different content than the content the
user was visiting. An attacker could use this flaw to conceal a
malicious URL, possibly tricking a user into believing they are
viewing a trusted site, or allowing scripts to be loaded from the
attacker's site, possibly leading to cross-site scripting (XSS)
attacks. (CVE-2012-0474)

A flaw was found in the way Thunderbird decoded the ISO-2022-KR and
ISO-2022-CN character sets. Malicious content could cause Thunderbird
to run JavaScript code with the permissions of different content.
(CVE-2012-0477)

A flaw was found in the way the built-in feed reader in Thunderbird
handled RSS and Atom feeds. Invalid RSS or Atom content loaded over
HTTPS caused Thunderbird to display the address of said content, but
not the content. The previous content continued to be displayed. An
attacker could use this flaw to perform phishing attacks, or trick
users into thinking they are visiting the site reported by the Website
field, when the page is actually content controlled by an attacker.
(CVE-2012-0479)

Red Hat would like to thank the Mozilla project for reporting these
issues. Upstream acknowledges Mateusz Jurczyk of the Google Security
Team as the original reporter of CVE-2011-3062
Aki Helin from OUSPG
as the original reporter of CVE-2012-0469
Atte Kettunen from OUSPG as
the original reporter of CVE-2012-0470
wushi of team509 via iDefense
as the original reporter of CVE-2012-0472
Ms2ger as the original
reporter of CVE-2012-0478
Anne van Kesteren of Opera Software as the
original reporter of CVE-2012-0471
Matias Juntunen as the original
reporter of CVE-2012-0473
Jordi Chancel and Eddy Bordi, and Chris
McGowen as the original reporters of CVE-2012-0474
Masato Kinugawa as
the original reporter of CVE-2012-0477
and Jeroen van der Gun as the
original reporter of CVE-2012-0479.

Note: All issues except CVE-2012-0470, CVE-2012-0472, and
CVE-2011-3062 cannot be exploited by a specially-crafted HTML mail
message as JavaScript is disabled by default for mail messages. It
could be exploited another way in Thunderbird, for example, when
viewing the full remote content of an RSS feed.

See also :

https://www.redhat.com/security/data/cve/CVE-2011-3062.html
https://www.redhat.com/security/data/cve/CVE-2012-0467.html
https://www.redhat.com/security/data/cve/CVE-2012-0468.html
https://www.redhat.com/security/data/cve/CVE-2012-0469.html
https://www.redhat.com/security/data/cve/CVE-2012-0470.html
https://www.redhat.com/security/data/cve/CVE-2012-0471.html
https://www.redhat.com/security/data/cve/CVE-2012-0472.html
https://www.redhat.com/security/data/cve/CVE-2012-0473.html
https://www.redhat.com/security/data/cve/CVE-2012-0474.html
https://www.redhat.com/security/data/cve/CVE-2012-0477.html
https://www.redhat.com/security/data/cve/CVE-2012-0478.html
https://www.redhat.com/security/data/cve/CVE-2012-0479.html
http://rhn.redhat.com/errata/RHSA-2012-0516.html

Solution :

Update the affected thunderbird and / or thunderbird-debuginfo
packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.4
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false