This update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.17 http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.18

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0016     Justin Schuh, Tom Cross and Peter Williams discovered a     buffer overflow in the parser for UTF-8 URLs, which may     lead to the execution of arbitrary code. (MFSA 2008-37)

  - CVE-2008-1380     It was discovered that crashes in the JavaScript engine     could potentially lead to the execution of arbitrary     code. (MFSA 2008-20)

  - CVE-2008-3835     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLDocument::OnChannelRedirect() could be bypassed.
    (MFSA 2008-38)

  - CVE-2008-4058     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers. (MFSA 2008-41)

  - CVE-2008-4059     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers. (MFSA 2008-41)

  - CVE-2008-4060     Olli Pettay and 'moz_bug_r_a4' discovered a Chrome     privilege escalation vulnerability in XSLT handling.
    (MFSA 2008-41)

  - CVE-2008-4061     Jesse Ruderman discovered a crash in the layout engine,     which might allow the execution of arbitrary code. (MFSA     2008-42)

  - CVE-2008-4062     Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine     Labour discovered crashes in the JavaScript engine,     which might allow the execution of arbitrary code. (MFSA     2008-42)

  - CVE-2008-4065     Dave Reed discovered that some Unicode byte order marks     are stripped from JavaScript code before execution,     which can result in code being executed, which were     otherwise part of a quoted string. (MFSA 2008-43)

  - CVE-2008-4067     It was discovered that a directory traversal allows     attackers to read arbitrary files via a certain     character. (MFSA 2008-44)

  - CVE-2008-4068     It was discovered that a directory traversal allows     attackers to bypass security restrictions and obtain     sensitive information. (MFSA 2008-44)

  - CVE-2008-4070     It was discovered that a buffer overflow could be     triggered via a long header in a news article, which     could lead to arbitrary code execution. (MFSA 2008-46)

  - CVE-2008-4582     Liu Die Yu and Boris Zbarsky discovered an information     leak through local shortcut files. (MFSA 2008-47, MFSA     2008-59)

  - CVE-2008-5012     Georgi Guninski, Michal Zalewski and Chris Evan     discovered that the canvas element could be used to     bypass same-origin restrictions. (MFSA 2008-48)

  - CVE-2008-5014     Jesse Ruderman discovered that a programming error in     the window.__proto__.__proto__ object could lead to     arbitrary code execution. (MFSA 2008-50)

  - CVE-2008-5017     It was discovered that crashes in the layout engine     could lead to arbitrary code execution. (MFSA 2008-52)

  - CVE-2008-5018     It was discovered that crashes in the JavaScript engine     could lead to arbitrary code execution. (MFSA 2008-52)

  - CVE-2008-5021     It was discovered that a crash in the nsFrameManager     might lead to the execution of arbitrary code. (MFSA     2008-55)

  - CVE-2008-5022     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLHttpRequest::NotifyEventListeners() could be     bypassed. (MFSA 2008-56)

  - CVE-2008-5024     Chris Evans discovered that quote characters were     improperly escaped in the default namespace of E4X     documents. (MFSA 2008-58)

  - CVE-2008-5500     Jesse Ruderman discovered that the layout engine is     vulnerable to DoS attacks that might trigger memory     corruption and an integer overflow. (MFSA 2008-60)

  - CVE-2008-5503     Boris Zbarsky discovered that an information disclosure     attack could be performed via XBL bindings. (MFSA     2008-61)

  - CVE-2008-5506     Marius Schilder discovered that it is possible to obtain     sensible data via a XMLHttpRequest. (MFSA 2008-64)

  - CVE-2008-5507     Chris Evans discovered that it is possible to obtain     sensible data via a JavaScript URL. (MFSA 2008-65)

  - CVE-2008-5508     Chip Salzenberg discovered possible phishing attacks via     URLs with leading whitespaces or control characters.
    (MFSA 2008-66)

  - CVE-2008-5511     It was discovered that it is possible to perform     cross-site scripting attacks via an XBL binding to an     'unloaded document.' (MFSA 2008-68)

  - CVE-2008-5512     It was discovered that it is possible to run arbitrary     JavaScript with chrome privileges via unknown vectors.
    (MFSA 2008-68)

This update brings the Mozilla Thunderbird E-Mail program to version 2.0.0.18.

It fixes following security problems :

CVE-2008-5012 / MFSA 2008-48: Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.

CVE-2008-5014 / MFSA 2008-50

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.

CVE-2008-5016 / MFSA 2008-52 :

The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.

CVE-2008-5017 / MFSA 2008-52: Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors.

CVE-2008-5018 / MFSA 2008-52: The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to 'insufficient class checking' in the Date class. CVE-2008-5019 / MFSA 2008-53: The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting (XSS) attacks and execute arbitrary JavaScript with chrome privileges via unknown vectors.

CVE-2008-5021 / MFSA 2008-55: nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.

CVE-2008-5022 / MFSA 2008-56: The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.

CVE-2008-5024 / MFSA 2008-58: Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.

CVE-2008-5052 / MFSA 2008-52: The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.

MFSA 2008-59: Mozilla developer Boris Zbarsky reported that a malicious mail message might be able to glean personal information about the recipient from the mailbox URI (such as computer account name) if the mail recipient has enabled JavaScript in mail. If a malicious mail is forwarded 'in-line' to a recipient who has enabled JavaScript, then comments added by the forwarder could be accessed by scripts in the message and potentially revealed to the original malicious author if that message has also been allowed to load remote content. Scripts in mail messages no longer have access to the DOM properties .documentURI and .textContent.

This update backports the latest security fixes to the Mozilla XULRunner engine.

It fixes following security issues :

  - The http-index-format MIME type parser     (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox     2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13     does not check for an allocation failure, which allows     remote attackers to cause a denial of service (crash)     and possibly execute arbitrary code via an HTTP index     response with a crafted 200 header, which triggers     memory corruption and a buffer overflow. (CVE-2008-0017     / MFSA 2008-54)

  - Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x     before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not     properly change the source URI when processing a canvas     element and an HTTP redirect, which allows remote     attackers to bypass the same origin policy and access     arbitrary images that are not directly accessible to the     attacker. NOTE: this issue can be leveraged to enumerate     software on the client by performing redirections     related to moz-icon. (CVE-2008-5012 / MFSA 2008-48)

  - Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x     before 1.1.13 do not properly check when the Flash     module has been dynamically unloaded properly, which     allows remote attackers to execute arbitrary code via a     crafted SWF file that 'dynamically unloads itself from     an outside JavaScript function,' which triggers an     access of an expired memory address. (CVE-2008-5013 /     MFSA 2008-49)

  - jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox     2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18,     and SeaMonkey 1.x before 1.1.13 allows remote attackers     to cause a denial of service (crash) and possibly     execute arbitrary code by modifying the     window.__proto__.__proto__ object in a way that causes a     lock on a non-native object, which triggers an assertion     failure related to the OBJ_IS_NATIVE function.
    (CVE-2008-5014 / MFSA 2008-50)

  - The layout engine in Mozilla Firefox 3.x before 3.0.4,     Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x     before 1.1.13 allows remote attackers to cause a denial     of service (crash) via multiple vectors that trigger an     assertion failure or other consequences. (CVE-2008-5016     / MFSA 2008-52)

  - Integer overflow in xpcom/io/nsEscape.cpp in the browser     engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x     before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and     SeaMonkey 1.x before 1.1.13 allows remote attackers to     cause a denial of service (crash) via unknown vectors.
    (CVE-2008-5017 / MFSA 2008-52)

  - The JavaScript engine in Mozilla Firefox 3.x before     3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x     before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows     remote attackers to cause a denial of service (crash)     via vectors related to 'insufficient class checking' in     the Date class. (CVE-2008-5018 / MFSA 2008-52)

  - nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x     before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and     SeaMonkey 1.x before 1.1.13 allows remote attackers to     cause a denial of service (crash) and possibly execute     arbitrary code by modifying properties of a file input     element while it is still being initialized, then using     the blur method to access uninitialized memory.
    (CVE-2008-5021 / MFSA 2008-55)

  - The nsXMLHttpRequest::NotifyEventListeners method in     Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18,     Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x     before 1.1.13 allows remote attackers to bypass the     same-origin policy and execute arbitrary script via     multiple listeners, which bypass the inner window check.
    (CVE-2008-5022 / MFSA 2008-56)

  - Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18,     and SeaMonkey 1.x before 1.1.13 allows remote attackers     to bypass the protection mechanism for codebase     principals and execute arbitrary script via the
    -moz-binding CSS property in a signed JAR file.
    (CVE-2008-5023 / MFSA 2008-57)

  - Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before     2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey     1.x before 1.1.13 do not properly escape quote     characters used for XML processing, allows remote     attackers to conduct XML injection attacks via the     default namespace in an E4X document. (CVE-2008-5024 /     MFSA 2008-58)

  - The AppendAttributeValue function in the JavaScript     engine in Mozilla Firefox 2.x before 2.0.0.18,     Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x     before 1.1.13 allows remote attackers to cause a denial     of service (crash) via unknown vectors that trigger     memory corruption, as demonstrated by     e4x/extensions/regress-410192.js. (CVE-2008-5052 / MFSA     2008-52)

Several remote vulnerabilities have been discovered in the Iceweasel webbrowser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0017     Justin Schuh discovered that a buffer overflow in the     http-index-format parser could lead to arbitrary code     execution.

  - CVE-2008-4582     Liu Die Yu discovered an information leak through local     shortcut files.

  - CVE-2008-5012     Georgi Guninski, Michal Zalewski and Chris Evan     discovered that the canvas element could be used to     bypass same-origin restrictions.

  - CVE-2008-5013     It was discovered that insufficient checks in the Flash     plugin glue code could lead to arbitrary code execution.

  - CVE-2008-5014     Jesse Ruderman discovered that a programming error in     the window.__proto__.__proto__ object could lead to     arbitrary code execution.

  - CVE-2008-5017     It was discovered that crashes in the layout engine     could lead to arbitrary code execution.

  - CVE-2008-5018     It was discovered that crashes in the JavaScript engine     could lead to arbitrary code execution.

  - CVE-2008-5021     It was discovered that a crash in the nsFrameManager     might lead to the execution of arbitrary code.

  - CVE-2008-5022     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLHttpRequest::NotifyEventListeners() could be     bypassed.

  - CVE-2008-5023     Collin Jackson discovered that the -moz-binding property     bypasses security checks on codebase principals.

  - CVE-2008-5024     Chris Evans discovered that quote characters were     improperly escaped in the default namespace of E4X     documents.

Liu Die Yu discovered an information disclosure vulnerability in Firefox when using saved .url shortcut files. If a user were tricked into downloading a crafted .url file and a crafted HTML file, an attacker could steal information from the user's cache.
(CVE-2008-4582)

Georgi Guninski, Michal Zalewsk and Chris Evans discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker could obtain private information from data stored in the images, or discover information about software on the user's computer. This issue only affects Firefox 2. (CVE-2008-5012)

It was discovered that Firefox did not properly check if the Flash module was properly unloaded. By tricking a user into opening a crafted SWF file, an attacker could cause Firefox to crash and possibly execute arbitrary code with user privileges. This issue only affects Firefox 2. (CVE-2008-5013)

Jesse Ruderman discovered that Firefox did not properly guard locks on non-native objects. If a user were tricked into opening a malicious website, an attacker could cause a browser crash and possibly execute arbitrary code with user privileges. This issue only affects Firefox 2. (CVE-2008-5014)

Luke Bryan discovered that Firefox sometimes opened file URIs with chrome privileges. If a user saved malicious code locally, then opened the file in the same tab as a privileged document, an attacker could run arbitrary JavaScript code with chrome privileges. This issue only affects Firefox 3.0. (CVE-2008-5015)

Several problems were discovered in the browser, layout and JavaScript engines. These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges.
(CVE-2008-5016, CVE-2008-5017, CVE-2008-5018)

David Bloom discovered that the same-origin check in Firefox could be bypassed by utilizing the session restore feature. An attacker could exploit this to run JavaScript in the context of another site or execute arbitrary JavaScript code with chrome privileges.
(CVE-2008-5019)

Justin Schuh discovered a flaw in Firefox's mime-type parsing. If a user were tricked into opening a malicious website, an attacker could send a crafted header in the HTTP index response, causing a browser crash and execute arbitrary code with user privileges. (CVE-2008-0017)

A flaw was discovered in Firefox's DOM constructing code. If a user were tricked into opening a malicious website, an attacker could cause the browser to crash and potentially execute arbitrary code with user privileges. (CVE-2008-5021)

It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker could execute JavaScript in the context of a different website. (CVE-2008-5022)

Collin Jackson discovered various flaws in Firefox when processing stylesheets which allowed JavaScript to be injected into signed JAR files. If a user were tricked into opening malicious web content, an attacker could execute arbitrary code with the privileges of the signed JAR or of a different website. (CVE-2008-5023)

Chris Evans discovered that Firefox did not properly parse E4X documents, leading to quote characters in the namespace not being properly escaped. (CVE-2008-5024).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Georgi Guninski, Michal Zalewsk and Chris Evans discovered that the same-origin check in Thunderbird could be bypassed. If a user were tricked into opening a malicious website, an attacker could obtain private information from data stored in the images, or discover information about software on the user's computer. (CVE-2008-5012)

Jesse Ruderman discovered that Thunderbird did not properly guard locks on non-native objects. If a user had JavaScript enabled and were tricked into opening malicious web content, an attacker could cause a browser crash and possibly execute arbitrary code with user privileges. (CVE-2008-5014)

Several problems were discovered in the browser, layout and JavaScript engines. If a user had JavaScript enabled, these problems could allow an attacker to crash Thunderbird and possibly execute arbitrary code with user privileges. (CVE-2008-5016, CVE-2008-5017, CVE-2008-5018)

A flaw was discovered in Thunderbird's DOM constructing code. If a user were tricked into opening a malicious website while having JavaScript enabled, an attacker could cause the browser to crash and potentially execute arbitrary code with user privileges.
(CVE-2008-5021)

It was discovered that the same-origin check in Thunderbird could be bypassed. If a user had JavaScript enabled and were tricked into opening malicious web content, an attacker could execute JavaScript in the context of a different website. (CVE-2008-5022)

Chris Evans discovered that Thunderbird did not properly parse E4X documents, leading to quote characters in the namespace not being properly escaped. (CVE-2008-5024)

Boris Zbarsky discovered that Thunderbird did not properly process comments in forwarded in-line messages. If a user had JavaScript enabled and opened a malicious email, an attacker may be able to obtain information about the recipient.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
34836	Fedora 8 : thunderbird-2.0.0.18-1.fc8 (2008-9807)	Nessus	Fedora Local Security Checks	11/21/2008	1/11/2021	critical
35313	Debian DSA-1696-1 : icedove - several vulnerabilities	Nessus	Debian Local Security Checks	1/8/2009	1/4/2021	critical
39894	openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-333)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	critical
41511	SuSE 10 Security Update : gecko-sdk and mozilla-xulrunner (ZYPP Patch Number 5813)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical
34950	Debian DSA-1671-1 : iceweasel - several vulnerabilities	Nessus	Debian Local Security Checks	11/25/2008	1/4/2021	critical
36711	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : firefox, firefox-3.0, xulrunner-1.9 vulnerabilities (USN-667-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	critical
37649	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : mozilla-thunderbird, thunderbird vulnerabilities (USN-668-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical