openSUSE Security Update : Mozilla Thunderbird (openSUSE-2016-851)

high Nessus Plugin ID 91986
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote openSUSE host is missing a security update.

Description

This update contains Mozilla Thunderbird 45.2. (boo#983549)

It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail.

The following vulnerabilities were fixed :

- CVE-2016-2818, CVE-2016-2815: Memory safety bugs (boo#983549, MFSA2016-49)

Contains the following security fixes from the 45.1 release:
(boo#977333)

- CVE-2016-2806, CVE-2016-2807: Miscellaneous memory safety hazards (boo#977375, boo#977376, MFSA 2016-39)

Contains the following security fixes from the 45.0 release:
(boo#969894)

- CVE-2016-1952, CVE-2016-1953: Miscellaneous memory safety hazards (MFSA 2016-16)

- CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)

- CVE-2016-1955: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18)

- CVE-2016-1956: Linux video memory DOS with Intel drivers (MFSA 2016-19)

- CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20)

- CVE-2016-1960: Use-after-free in HTML5 string parser (MFSA 2016-23)

- CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24)

- CVE-2016-1964: Use-after-free during XML transformations (MFSA 2016-27)

- CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34)

The graphite font shaping library was disabled, addressing the following font vulnerabilities :

- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

The following tracked packaging changes are included :

- fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637)

- gcc6 fixes (boo#986162)

- running on 48bit va aarch64 (boo#984126)

Solution

Update the affected Mozilla Thunderbird packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=969894

https://bugzilla.opensuse.org/show_bug.cgi?id=977333

https://bugzilla.opensuse.org/show_bug.cgi?id=977375

https://bugzilla.opensuse.org/show_bug.cgi?id=977376

https://bugzilla.opensuse.org/show_bug.cgi?id=983549

https://bugzilla.opensuse.org/show_bug.cgi?id=984126

https://bugzilla.opensuse.org/show_bug.cgi?id=984637

https://bugzilla.opensuse.org/show_bug.cgi?id=986162

Plugin Details

Severity: High

ID: 91986

File Name: openSUSE-2016-851.nasl

Version: 2.9

Type: local

Agent: unix

Published: 7/11/2016

Updated: 1/19/2021

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:H/RL:OF/RC:C

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:MozillaThunderbird, p-cpe:/a:novell:opensuse:MozillaThunderbird-buildsymbols, p-cpe:/a:novell:opensuse:MozillaThunderbird-debuginfo, p-cpe:/a:novell:opensuse:MozillaThunderbird-debugsource, p-cpe:/a:novell:opensuse:MozillaThunderbird-devel, p-cpe:/a:novell:opensuse:MozillaThunderbird-translations-common, p-cpe:/a:novell:opensuse:MozillaThunderbird-translations-other, cpe:/o:novell:opensuse:13.2, cpe:/o:novell:opensuse:42.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/10/2016

Reference Information

CVE: CVE-2016-1952, CVE-2016-1953, CVE-2016-1954, CVE-2016-1955, CVE-2016-1956, CVE-2016-1957, CVE-2016-1960, CVE-2016-1961, CVE-2016-1964, CVE-2016-1974, CVE-2016-1977, CVE-2016-2790, CVE-2016-2791, CVE-2016-2792, CVE-2016-2793, CVE-2016-2794, CVE-2016-2795, CVE-2016-2796, CVE-2016-2797, CVE-2016-2798, CVE-2016-2799, CVE-2016-2800, CVE-2016-2801, CVE-2016-2802, CVE-2016-2806, CVE-2016-2807, CVE-2016-2815, CVE-2016-2818