RHEL 6 / 7 : thunderbird (RHSA-2017:1201)

High Nessus Plugin ID 100021

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 7.4

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

An update for thunderbird is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 52.1.0.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-5429, CVE-2017-5433, CVE-2017-5435, CVE-2017-5436, CVE-2017-5459, CVE-2017-5466, CVE-2017-5432, CVE-2017-5434, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5446, CVE-2017-5447, CVE-2017-5454, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5469, CVE-2016-10195, CVE-2016-10196, CVE-2017-5445, CVE-2017-5449, CVE-2017-5451, CVE-2017-5467, CVE-2016-10197)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Petr Cerny, Nils, Ivan Fratric (Google Project Zero), Takeshi Terada, Heather Miller (Google Skia team), Chun Han Hsiao, Chamal De Silva, Nicolas Gregoire, Holger Fuhrmannek, Atte Kettunen, Haik Aftandilian, and Jordi Chancel as the original reporters.

Solution

Update the affected thunderbird and / or thunderbird-debuginfo packages.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2017-13/

https://access.redhat.com/errata/RHSA-2017:1201

https://access.redhat.com/security/cve/cve-2016-10195

https://access.redhat.com/security/cve/cve-2016-10196

https://access.redhat.com/security/cve/cve-2016-10197

https://access.redhat.com/security/cve/cve-2017-5429

https://access.redhat.com/security/cve/cve-2017-5432

https://access.redhat.com/security/cve/cve-2017-5433

https://access.redhat.com/security/cve/cve-2017-5434

https://access.redhat.com/security/cve/cve-2017-5435

https://access.redhat.com/security/cve/cve-2017-5436

https://access.redhat.com/security/cve/cve-2017-5438

https://access.redhat.com/security/cve/cve-2017-5439

https://access.redhat.com/security/cve/cve-2017-5440

https://access.redhat.com/security/cve/cve-2017-5441

https://access.redhat.com/security/cve/cve-2017-5442

https://access.redhat.com/security/cve/cve-2017-5443

https://access.redhat.com/security/cve/cve-2017-5444

https://access.redhat.com/security/cve/cve-2017-5445

https://access.redhat.com/security/cve/cve-2017-5446

https://access.redhat.com/security/cve/cve-2017-5447

https://access.redhat.com/security/cve/cve-2017-5449

https://access.redhat.com/security/cve/cve-2017-5451

https://access.redhat.com/security/cve/cve-2017-5454

https://access.redhat.com/security/cve/cve-2017-5459

https://access.redhat.com/security/cve/cve-2017-5460

https://access.redhat.com/security/cve/cve-2017-5464

https://access.redhat.com/security/cve/cve-2017-5465

https://access.redhat.com/security/cve/cve-2017-5466

https://access.redhat.com/security/cve/cve-2017-5467

https://access.redhat.com/security/cve/cve-2017-5469

Plugin Details

Severity: High

ID: 100021

File Name: redhat-RHSA-2017-1201.nasl

Version: 3.14

Type: local

Agent: unix

Published: 2017/05/08

Updated: 2020/05/29

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 7.4

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:thunderbird, p-cpe:/a:redhat:enterprise_linux:thunderbird-debuginfo, cpe:/o:redhat:enterprise_linux:6, cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:7.3, cpe:/o:redhat:enterprise_linux:7.4, cpe:/o:redhat:enterprise_linux:7.5, cpe:/o:redhat:enterprise_linux:7.6, cpe:/o:redhat:enterprise_linux:7.7

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/05/08

Vulnerability Publication Date: 2017/03/15

Reference Information

CVE: CVE-2016-10195, CVE-2016-10196, CVE-2016-10197, CVE-2017-5429, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5436, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5449, CVE-2017-5451, CVE-2017-5454, CVE-2017-5459, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5467, CVE-2017-5469

RHSA: 2017:1201